33eb4a2605125d56147ea02f56c6d831e4725f78dd0c6be8fcdb22e66590be22

Analysis

max time kernel
93s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Size 909KB
Sample261011-excfdaez5s
SHA256 33eb4a2605125d56147ea02f56c6d831e4725f78dd0c6be8fcdb22e66590be22
MD5 b96d3f8b5dc5b4e752fd1a2696806ec8
SHA1 ffea015034ac66a83479c7ceee43e008ebd216d7
SHA512 e501824987dbfea8e6c86c244bfc477b6d200d3a48f639540293f252a538d40d767808ef56c3f07548d7693a15131e0542bc2e303aa9f91ff4a7254710a9b7e7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNY:A3mnXoZjzyacNVEuzyUD5TvinrmycNY
TLSH
T1EA156B07A6951FE9D12F813489924962E7737C225F2087DF1354AE263F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5948-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c55c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c55d-10.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5948-39-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4192-40-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c8a-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-644.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1073.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1141.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c55c-5.dat	aspack_v212_v242
behavioral2/files/0x000e00000001c55d-10.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c8a-59.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-644.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-981.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1073.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1122.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1141.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4192	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5948	2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
4192	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_b96d3f8b5dc5b4e752fd1a2696806ec8_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5948

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 909KB
SHA256 33eb4a2605125d56147ea02f56c6d831e4725f78dd0c6be8fcdb22e66590be22
MD5 b96d3f8b5dc5b4e752fd1a2696806ec8
SHA1 ffea015034ac66a83479c7ceee43e008ebd216d7
SHA512 e501824987dbfea8e6c86c244bfc477b6d200d3a48f639540293f252a538d40d767808ef56c3f07548d7693a15131e0542bc2e303aa9f91ff4a7254710a9b7e7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNY:A3mnXoZjzyacNVEuzyUD5TvinrmycNY
TLSH
T1EA156B07A6951FE9D12F813489924962E7737C225F2087DF1354AE263F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.4MB
SHA256 4d50259e811dd8770878c77c863efb3643bb967b0b50ff30d2df6aa9abf7e054
MD5 0094849fdced3dd556818ac6ea4bf059
SHA1 9f13e18ad7ee446d3c15ef8dad3cb31dde6b7e1e
SHA512 7ec803588bb847e689df83e3f6249d5ce15a2c612a4852bfe335b13aaea04c814af61d6673fd9680136c29bb4a8589367c8675c61850707bd29420046ef02a7a
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5TvinrmycNQ0Le5ji0hmxNrM:A3kMuX56rbPji0Aj
TLSH
T132655A16F6A44BA5D02BC178C9D2565AEB733C521F308BCB03549E293F237D19E3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 957KB
SHA256 2880772dc6ff9ad69b4fd5721d91215a9abc245596621fede2516f770fc9e6e6
MD5 f8518b5af28512148999806cb29fea45
SHA1 473776285c1c6e01d3cf1f9447f50490019535e5
SHA512 f237f0531f996a718ee0ea957c78eedb67060e788f3ee2f5b442d6ca0f2222c2ce2f233a041d9d6e4664d71c2019640296fabf1437c166aa2bb4b55296ff1ed2
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycN5b:A3mnXoZjzyacNVEuzyUD5TvinrmycN5b
TLSH
T1FC256B07A6941FE9D12F823499A24522E7737C225F2087DF1354AE263F727D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 933KB
SHA256 a86055e1411f1c9c8b9d4ea6341931066839e050cb1cfe699da61b11a78f9e2e
MD5 a5b3850f1cc4c3987047ba9de5320ace
SHA1 ff05d30bc04ac5e5d462836701a6f52f8e502fcd
SHA512 42c470d0e62fb850373e8eee20532e85ac3a2b97b700510ba6004c1e6596f7add6c1ba1cf68b046cd986cf268d18e919fee390f279cd3efa33b3a96059ed2a92
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNb6:A3mnXoZjzyacNVEuzyUD5TvinrmycNb6
TLSH
T1F0156B17A6941FE9D12F813489924922E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 933KB
SHA256 d1d83bc6adfbdc9c38847496fbccbaf41d7c29e601b1156104b47a6d12ec0c1e
MD5 e50313fca55a32cabd7e35286b4c512f
SHA1 0180860a6fbb0b6f1a6df34a1122c340c91099b2
SHA512 b52a8c7e711a28033ad69d2c090933e087ba64ed7d93948b1a1b63537b42aedeea512173ea9711d395534a11773cfb306b93a38f56f4249b050acf236afc6c54
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNFN:A3mnXoZjzyacNVEuzyUD5TvinrmycNFN
TLSH
T151156B07A6941FE9D12F813499924962E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 933KB
SHA256 7808af91f8eaec3ca00cf03af33acb2313997fc08d236852e82ac5ab8978afb5
MD5 6dddb15f3d32d5cfde55d24cd93e3810
SHA1 b9728a6b6d2fe972a2d3da828293abdeb6406ddf
SHA512 774433660d32e6a28c820f35962ee4e49fe591a5191983c380b6c92f877aad9f45f9ed22bb8547adfd71fb71eeca1ef33a1181b01776821417705eb719667c22
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNDf:A3mnXoZjzyacNVEuzyUD5TvinrmycNDf
TLSH
T1F4156B17A6941FE9D12F813489924922E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 933KB
SHA256 374bb6992dba345b88047607c6549390606995498b965b3d4fe9454beb8bab1b
MD5 115a27e233ef67ccb615b26e6704aca4
SHA1 2fc6123408ebeddeff3d30f8d7da846ac35efedd
SHA512 8e53ec4f7bcac911ab3362dab63d621b49ba1290438e63b0154e75fc1507d049a5ac2b9b10fd0235948c740ba0b8c0da72223c8419da3ac0b8dd86f29d43c96a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNVo:A3mnXoZjzyacNVEuzyUD5TvinrmycNVo
TLSH
T107156B07A6941FE9D12F813499924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 933KB
SHA256 54e2584ade474c8bc30c58fe965b34538a7641981806e87959df58263f11fb75
MD5 55dd110a791c55eb2e5f76686c3d5ef4
SHA1 ef4f6f977c54c281fe7f7c0d20b0da58cedbbd9c
SHA512 d820300bbce70c06b8271efd1832f0ddb411b2348977c5ebda0d25a37cb4eaefa8c8df42796b7e6b91422f20c34d7ddc382251f92922d41559fe8519482a9ffd
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNVu:A3mnXoZjzyacNVEuzyUD5TvinrmycNVu
TLSH
T144156B07A6941FE9D12F813499924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 933KB
SHA256 4c29bfa476c18c86658f9ef6b7069415f74452b5393b01b2c9cc22d83ae30460
MD5 97bd4e3c3770d92aa2e50baeba790a84
SHA1 d62821a737a43e5d93cfe7c90603ba07b67f4467
SHA512 98806530e772a3844989bca0db8d677be3993fd8b92edb35f1e893adf86ed53a05c2e5c60f6fd3426df4c70801a70674357aca100c890d85c4db16a26ed91a8a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNL9:A3mnXoZjzyacNVEuzyUD5TvinrmycNL9
TLSH
T1D4156B07A6951FE9D12F813489924562E7737C225F2087DF1364AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 933KB
SHA256 33d497d759fcd121079798b10696f2bd7a64b6e4345044eb0da06a133443924a
MD5 a37e56552e22d0f4561dd0e4f4c8a8a3
SHA1 c3db0f0fe0e62bb64bfa6259c41a8ab365dd8b96
SHA512 75264d5043f8c9774442ddb6f694d1706c49056282d9ea8a8b41c7bcf5d5eeea6ddd3bdbad80c046d78c52eaf10f080aee868f3b54ff60beed6c1916e157247a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNXc:A3mnXoZjzyacNVEuzyUD5TvinrmycNXc
TLSH
T1C2156B17A6941FE9D12F817489924922E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 933KB
SHA256 dcc9ab12771484d3bf6d51b4a892dae551b40615fdeda2efd880743a3db19907
MD5 05f9f3e1acd68474c044788f29301358
SHA1 23e9e1221a17227c0a3616c2a4bd8316f49c900e
SHA512 9a0660eda1540df4e25d59756a6d48a1a0280fbc51bfec467a3f08814f8bad48f1b751c144dcb3c539c6a27076edde49ac87f9282b8a4a2857a82f8fa671e32a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNgp:A3mnXoZjzyacNVEuzyUD5TvinrmycNgp
TLSH
T1D9156B17A6941FE9D12F813489924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 933KB
SHA256 0ca79b8a25b90141ed17e3d4f09f3865aba1cfaa29d89df2faac69adbab386bf
MD5 21a3e1e853e8029286888a8fb686d720
SHA1 d7e66aff63db989fca7644f3e973e038648b6c88
SHA512 c9464318422c9ae6310397f732ce90a9921c99b93e0b38a21459bfe096cf8010945486cf938e9d9727c523cbddd0b3b2b9641d0cd6888ea21d5b105c2e61be50
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNn0a:A3mnXoZjzyacNVEuzyUD5TvinrmycNnN
TLSH
T1B5156B17A6941FE9D12F813489924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 933KB
SHA256 4b18e04c2e5f6e52f879b6e9111784cd3904f4c016380110cd42ef4ea0fc266c
MD5 cb4cca033d918a91d5a1252c4d3eb50a
SHA1 e63d8969934322d199b11fb1c38043633c178c09
SHA512 d1deca27f613a0b269e7ec0f8c6ce08a5f7ca66553671b94f06f2b65e27a9f5d211f42fa72c358b62e6cbde4ffdcdac5f430651666349e1c36a1d563606a0ba1
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNFF:A3mnXoZjzyacNVEuzyUD5TvinrmycNFF
TLSH
T1CC156B07A6941FE9D12F813499924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 933KB
SHA256 08369b2af5fc06b5903eaffda02cac890a2120b5aa3b209df009af79f622210d
MD5 a8e5ec892eec8211dc7f215d9d10ac6e
SHA1 f31e85ec009289b796c555b5edd543e33cc09b4c
SHA512 947469c099978345c27ceb7e4b7faccededfc0d55833810707935e48c999365fda56b5248e3d9c522020eb151939908a73cf6316d31a00dae841194240c259ea
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNmC:A3mnXoZjzyacNVEuzyUD5TvinrmycNmC
TLSH
T179156B07A6941FE9D12F817489924922E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 933KB
SHA256 66b63b86c0addd5aee1966ae39455176edc271dc3dd4b4a1c401c98b84a8609e
MD5 f235eb4547183eea0bb0995591886663
SHA1 4a9849b8eff7f29567f0feb6cd56e1ebc2019156
SHA512 aff46a5728e1263bd6da4e833a04f9c7427d25a96791ef329ac5d250a8b8652338a7d07dd5356ae382c9e25310314a0af25f18043d5d665710e2fed962c8d1d4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNpw:A3mnXoZjzyacNVEuzyUD5TvinrmycNpw
TLSH
T13C156B07A6941FE9D12F813499924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 933KB
SHA256 417939890db190f85751785a876061acc4a12fcef9845bb2ea069ab18f862aac
MD5 9a55e2b3e46a8be19f4beb14ed15b6c7
SHA1 9116b0476c6a582ec4623d8b802d19e9ab084539
SHA512 ab0005239071a2a04b4a0483213490dafdd4ed65f740fc8013df9b33ceeb78309a4216785f0726e716505f89d708b872b63dc67bdc32332d247b99795704a479
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNwT:A3mnXoZjzyacNVEuzyUD5TvinrmycNwT
TLSH
T1F3156B17A6941FE9D12F817489924922E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 933KB
SHA256 588b3e6ae7e109c6a05ba8ba052db5436a8a8b9f5d8a8f4582333bcd9c7d8c9e
MD5 39f8c5f94305f52acf2c117afafa0197
SHA1 a794402cff03f530cb242c3d11e8f568b18243bf
SHA512 9c40286038514a71de4a7fdafda3e425b87390cbede55cfd6468a198598ed3fa1dfdd0ff9933f47864d3a9f4f042619d5e295b8490363c7f8de4b350b866ed3c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNcu:A3mnXoZjzyacNVEuzyUD5TvinrmycNcu
TLSH
T19D156B07A6941FE9D12F813489924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 933KB
SHA256 ebb5091f11f210c1fdc8505c35cb0eb196276922bb28fa53d99473cc889d0f8b
MD5 33f7d819de1228a44bcf943a4aeb150b
SHA1 3f7c072474100d51a07bb3fdb9bba41c74d98bb7
SHA512 e3533a7a8c1209af8b104710f8b7609e1512f1aae71d6306e6fc2054f412e90ff892b57793a575695344ad8747b5e2ea06c63c0c395eb4397f10ddff9e8e5fac
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycN6b:A3mnXoZjzyacNVEuzyUD5TvinrmycN6b
TLSH
T1E7156B17A6951FE9D12F813489924922E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 933KB
SHA256 f47e4b5d6cc17225683692158cbcb9bb98e436b734ca5335c18000622baaead8
MD5 d06480acf2cd49bef40c790791f0639a
SHA1 48dec9d1be3da2adda6e4696aff9ff77549eff5a
SHA512 4995163d3d36baee45fd08266a5533d29edc00de7e82a1bb2a9f0653589c6990c14430d762e5bc5a0d56a82c436eaaca36f8684a8faba7fc7451ae2eac1e8735
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycN8f:A3mnXoZjzyacNVEuzyUD5TvinrmycN8f
TLSH
T1AF156B17A6941FE9D12F813489924962E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 933KB
SHA256 310771913bddc6d085294e35e60b6bb4182670c92c2434242ee7e4ec271bd2b0
MD5 9480b674b6a4886868b5868f07324e4b
SHA1 d6739f57787b242003ba913df2247fc9830f96ca
SHA512 3977e188f8259104c64676d5c08faab818e1f3654f3f2f8a8df3a467d5a8d8f76909bed8e31478b40d4fdc7dc634b19bb7bfd205f8c39c9dbb643ac03084e780
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNZK:A3mnXoZjzyacNVEuzyUD5TvinrmycNZK
TLSH
T19F156B17A6941FE9D12F817489924922E7737C225F2087DF1354AE263F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 933KB
SHA256 f60f82e539fe447e24c227b2ca95a282819ac177c8f37262168d560bdaee1e3c
MD5 b1cf618e2195325b555ab0d44b50734d
SHA1 5bc8904b1f64ab74320265a7cb2481bc3232bf36
SHA512 77afcfc911051fc4f145322d04e13451e91ffa7edc1c92d9dda7f606125b7143f824fae43cd5b2ba5e53d3601b6ebc20b988970be059fa2b4cabc266f8c7bc9f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNCk:A3mnXoZjzyacNVEuzyUD5TvinrmycNCk
TLSH
T119156B07A6951FE9D12F813489924562E7737C225F2087DF1354AE263F327D0AE3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 933KB
SHA256 1fc577446f31d96a4922b73cfe79719ee5a669a858062192e15e69851c5f8212
MD5 83b74f5bde606b32a9efbe242e752acc
SHA1 0b069f72fa302b3af0705833fd454c34d5776759
SHA512 a9a56f01779d1c59f1e205b48149fdbae056caa7393fe517d72a885b5912e7eb89c3ece8e2d083407a55da4070e8930fc5ef1fb577e2b6d35de04a4c94683ba6
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNX0:A3mnXoZjzyacNVEuzyUD5TvinrmycNX0
TLSH
T155156B17A6941FE9D12F813489924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 933KB
SHA256 b30bc641b251849b8e0c325bb75a797da763b58013d2e9159af4d86b30327dbd
MD5 fbed6a186d7703043c8ed804dddce6b9
SHA1 78fd832e5b16ac52b4ed8edf9517a73490829cf4
SHA512 5b0bac6661eb73306edb99e9be28056c8fe8f2df42571a52b3c6a5b278480e18a7898e6ef4628d5b08c26087e4fe8223d27e5ae569d3907bd90deea2216954b0
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNG70:A3mnXoZjzyacNVEuzyUD5TvinrmycNGg
TLSH
T17E156B17A6941FE9D12F813489924922E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 933KB
SHA256 da8742c93ece599c1ef0107834c594da5c92833e449b9de76c6c6e373451947b
MD5 1dd4f00d6d05e70718ee0d67a91bc5f7
SHA1 a471afc6ab6e9ecc1d233d84de19959ef1f0a413
SHA512 d19036fcb89979856be0bfb367c96ff0c6d9467812f9186d46004c7c289e6b59f6d9cfdf019a5b10ea990254203fb907ed3b60921a2e3185c4497fcf7195f1a9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNPr:A3mnXoZjzyacNVEuzyUD5TvinrmycNPr
TLSH
T14A156B07A6951FE9D12F813489924562E7737C225F2087DF1354AE263F327D0AE3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 933KB
SHA256 82cf51352663eeb9b27dcb1eebd0e26be2559ca7924aa238da1d409a43b1787a
MD5 ed21fada26bd71293bbac2bb19fd33dc
SHA1 1e4d921def78181c1a72805402bb56b8f4ab9a54
SHA512 78b28679b4b62d9d4eb8e2e3f67aba3b1afcf13e117df3b66fbeef0595d28c40909c233a626873ef47f693fa62120be75748bb22ae7d908dcae82cd13065d5c4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNZn:A3mnXoZjzyacNVEuzyUD5TvinrmycNZn
TLSH
T113156B07A6941FE9D12F813499924562E7737C225F2087DF1354AE263F327D0AE3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 933KB
SHA256 dfac15a62c14d6702c3b538e93513b377656a6016203b8226b83cb5c14da6c0f
MD5 9ab47d12a37275fce13bf2e8f1f7b34f
SHA1 4507ae1c71aa184fd78daf257cd12c644cd4f336
SHA512 a112992f44d20da65d0620d9c65542d0b673335824b229e9b6a4dde4e320441fc451f4ddc96d0f061bd0a6a8d35c778cd5ffc449c7305de5cc0b1a88bc7b729a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycN1x:A3mnXoZjzyacNVEuzyUD5TvinrmycN1x
TLSH
T18C156B07A6951FE9D12F813489924562E7737C225F2087DF1364AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 933KB
SHA256 f4b5bff2d0273bbc70c1267f7570136417f28d1edc83aa89c03fef86404ffa75
MD5 539849dcd644ffb4bb862a9a99fff19e
SHA1 df2f2c89881219006ff20392197d8019997da4c2
SHA512 d35d78c504ab245f3e74c6f8b0aefb27a5fcec7390459306c1ce7807074fa5ed73fc4a33c14fee4a3d2f799c8563babd643ba43d649e0fb2ab07ae909501ff6f
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNrA:A3mnXoZjzyacNVEuzyUD5TvinrmycNrA
TLSH
T148156B17A6951FE9D12F813489924922E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 933KB
SHA256 710ff2df2305accba0f66c946e0f5325fedde66e53f308ff7c650128e331297d
MD5 b06eea73cd9dee3eb72645e5330cc862
SHA1 676710d74a8fb715eeadaaa54f023562010fd02e
SHA512 94931d0ce7030fd24d94aaeb93796039dcda1783b8813889f4454c268763d62c8bac97e21a7e24aee1bdf4602dd756dce99e69a80cc7f7ce9c91cd5252f4c6c4
SSDEEP 24576:A3mnXoZjzyacNVEuzyUD5TvinrmycN89Q:A3kMuX56rI
TLSH
T131156B07A6951FE9D12F817489924922E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 933KB
SHA256 cdc80969c6258b58a8deb0155c53e55afadb854e6bc3044afce8f7779ca95fd4
MD5 1aefdc981bf80d5aab2e80a2b18be361
SHA1 bff6f5396c6865797c958134551b521490c295ae
SHA512 6de5d7abb4c8b1d0b126da03155f3f6b6990829dab77d2d848fbf30aea72db187edce519961b6ef3fa621e92cc115eb0d638baead0f397d0147c830a8cfe9772
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNl4:A3mnXoZjzyacNVEuzyUD5TvinrmycNl4
TLSH
T1C2156B07A6941FE9D12F817489924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 933KB
SHA256 1ae3aa7ef2f9354fe2faa188a900a3d6e281d3a6a2e51145a64f1d79f802124f
MD5 12705c9077085a0dca6df284fbfa6378
SHA1 9873956d5c412225cff92afd3a57b5d13cf64dae
SHA512 a7093d7dec4e26d8c79c9ea95d329c0085e0bcc574c5e06c1f9db74d9f88653b3842155e376e547985d34b6e7743fe6299444ea3e5f61e8dd41d6c6893241871
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNwu:A3mnXoZjzyacNVEuzyUD5TvinrmycNwu
TLSH
T182156B07A6951FE9D12F817489924922E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 933KB
SHA256 75317c04d2d52f4857de20b7f88eae61315f37446dd2ec8f80a7947af18429d0
MD5 549044920a50164994d23d5e7e64443a
SHA1 cfd1aa6d947b4cedd92c63aaafad7b924a15ad1a
SHA512 51e860c12a3773e8c79394d57c18864203dab9d93a20c8ee983250e17bbdcf51443da72bc34ba05410d7141b08226b4dbeda77634c611448fe04807e8e37ee5d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNxj:A3mnXoZjzyacNVEuzyUD5TvinrmycNxj
TLSH
T1A5156B07A6941FE9D12F813499924562E7737C225F2087DF1354AE263F327D0AE3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 933KB
SHA256 7b19bc88c66550191fcc01019746c81400c92a6caceb83fbf486562b5275c0f1
MD5 adcab9a04f0f623c853e43ff28f4c0bb
SHA1 7c8a227e25c13324ddd6db5a4815dd1bcbfa9e5c
SHA512 5c3d688861b2980dc22277a691cb6f47c20bc50ab1f194a725687a8e7cc0a94f5340359c82a78281cff023f8d0c760b44e94000abcb9a54a2d48ede119e306e6
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNYg:A3mnXoZjzyacNVEuzyUD5TvinrmycNYg
TLSH
T181156B07A6941FE9D12F813499924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 933KB
SHA256 65b14fa392f63cd67f4340b4856e78069e9d8252bdc19fc923d8e931f5a056ce
MD5 9a42b24cfec8150176d74c7a6c3d82bd
SHA1 3be34a037c0d98fd77cf6d262fbbf2716ec109af
SHA512 18b80f409c88a3e609ad0985b1990158fcea475367e852bbc818f8a51f98536d1eebfeb2210d0e0ced5e501046a077a1d71e9482cc7b6d671e8321d7f5ffd758
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycN3I:A3mnXoZjzyacNVEuzyUD5TvinrmycN3I
TLSH
T133156B07A6951FE9D12F813489924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 933KB
SHA256 372f0c736d5cc71f6d161b542d70a4dc0d415e768d8dc0d18ee2049732282abc
MD5 d3a56b80d589890a686fef176bccfaaa
SHA1 d5db6f9f4f05aaf680e3ff4eb6c38fa782c3c836
SHA512 89b7e0f98775f89a645a9f0931f93864655ac4d7213e353ebfbd54494238155f3f6847dc045a51f6eb4ebcf4b6a493955c1b3331b43e2256925dd1ef3091a870
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycN9o:A3mnXoZjzyacNVEuzyUD5TvinrmycN9o
TLSH
T1F1156B17A6941FE9D12F813489924922E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 933KB
SHA256 3c555197c01babae33684c2aa6457dd0b7538d49fa508ddbb2b8d622278d7a57
MD5 f62e99a90a41db6687e616b436e56470
SHA1 a9129490e4473cba9f9d6e0bacb2bd3970109e3a
SHA512 09040797e3e65ccc63d7b81d2225d1178134f8013bc7a97212239a30d987eb2547cce071de69149d1b1ea4042d69b53522059a23ca7672f9c58f678130c35d39
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNu+:A3mnXoZjzyacNVEuzyUD5TvinrmycNu+
TLSH
T1D7156B17A6941FE9D12F813489924562E7737C225F2087DF1364AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 933KB
SHA256 11679ecbb786cbc74d5430adbbb938f2bfb083483b505e14f653831508db6d53
MD5 7ca193c218a7b326a2c1b3fb4cd39855
SHA1 59b115f94d0774422aa1abbc30357110c21fc205
SHA512 ffe8a7b42b4c24a116cb4990172052bf6fdfd134e46f28a6ac866a2cb996ebec0262ae3728bf7fe82ed9f891c6384b42e494b3ac66271eaa093c34ddf564c55e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNuQ:A3mnXoZjzyacNVEuzyUD5TvinrmycNuQ
TLSH
T18A156B07A6951FE9D12F813489924962E7737C225F2087DF1364AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 933KB
SHA256 5b9c7b4e4eb3fe6eaa7c8da82c6278fc4eae4dec71b91880b5662cd961157762
MD5 212ac614eee9d2b1a7c270ab09514107
SHA1 9cc57dc80e7125c3b8da880930533751f9adb6e7
SHA512 80537126cdb2170ff504251c2c50c49a308cfb7c58e6fc4f626c75ef3e0e0e05e565646099c13e2a1dfb526f32f4f3fc8078259415fbd322241b9695171ff254
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNPX:A3mnXoZjzyacNVEuzyUD5TvinrmycNPX
TLSH
T1EE156B07A6941FE9D12F817489924962E7737C225F2087DF1354AE263F327D0AE3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 933KB
SHA256 300391d5249e9ee5045225df4794a0e365018215dba2ab41bae50f18c673bd2d
MD5 921a4a202a9368f765c7b958f5a82648
SHA1 ba9e4f094a361af1010c79ef4ad1561a93271a8c
SHA512 24568d3aa0c19b345bbceab889d594f42ce669ae2b93aebfd31ae7943ae7847ead7dc14850dd46646e06942d8f4f1ded9bcb14ae1c8aa73669880ede0c81c5b2
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNFL:A3mnXoZjzyacNVEuzyUD5TvinrmycNFL
TLSH
T193156B07A6941FE9D12F817489924562E7737C225F2087DF1354AE263F327D0AE3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 933KB
SHA256 37bd0d83495453250000afd569dd66a2aeaf18b847ab7d62ecef81d16c65e2b1
MD5 cbbc4ea0f8d67b5de7fbc425a8b8e960
SHA1 ba13b7384f8b069e627feb6b90c542cff6603bb1
SHA512 96d2ba164336ef02ae8ccc6c81b592bf3963ae53bdb6b8e0e4bcbe19ddfa82092ae2b3051fc43018a1205d5fc8eaf85be9fce4b5b0903f23d20c5116735e8afd
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNjFC:A3mnXoZjzyacNVEuzyUD5TvinrmycNjM
TLSH
T12F156B17A6941FE9D12F817489924922E7737C225F2087DF1354AE263F327D06E3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 933KB
SHA256 6acf6a12917f4613930bd01f30ac462126e195c14c584d655b3fb1cf8bd91222
MD5 c3f6a6e34a213b617ca5e53af5c88ab5
SHA1 06171e4971d903d217153103393d1561572588fc
SHA512 5e0ab3ae25ff2de0c7e936c43f58c82b447ba4c4062f3313987750e84929d5793e773494690e97a1245b8269e19c429f365c72bce7d2caa2cee611c6794e89de
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVEDyPz5L8UD3JeU7vinrmycNkh:A3mnXoZjzyacNVEuzyUD5TvinrmycNkh
TLSH
T131156B07A6951FE9D12F813489924962E7737C225F2087DF1354AE263F327D06E3A7A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4192-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5948-39-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5948-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads