6ad61c5b205f437baa2a9fea1b773bad8624c0c8a9a9baf57a4925f83f07480e

Analysis

max time kernel
88s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 20:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 869KB
Sample260712-zksbaaax71
SHA256 6ad61c5b205f437baa2a9fea1b773bad8624c0c8a9a9baf57a4925f83f07480e
MD5 5f2e68f87a4c7e9d4f809c6d7ea19cde
SHA1 d7f6c9df1a8740a6ade5e8a7b313463a0754cc64
SHA512 7b63034a97581cb19e89d723698ad7495218323855dae08d6a8edf75a922f29ec181f71bee606a22327e18336a55e4ee985123e7711e3977d42e6f3eb11b3eb9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMa:A3kM+
TLSH
T11E159E03E7A010F5E65A823499E61A12FB75BC221760DBDF136497252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4844-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000f00000001c538-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4844-208-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-258.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/772-259-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-820.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000f00000001c538-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-258.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-489.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-820.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1047.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1078.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1127.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1146.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
772	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4844	2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
772	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_5f2e68f87a4c7e9d4f809c6d7ea19cde_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4844

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 869KB
SHA256 6ad61c5b205f437baa2a9fea1b773bad8624c0c8a9a9baf57a4925f83f07480e
MD5 5f2e68f87a4c7e9d4f809c6d7ea19cde
SHA1 d7f6c9df1a8740a6ade5e8a7b313463a0754cc64
SHA512 7b63034a97581cb19e89d723698ad7495218323855dae08d6a8edf75a922f29ec181f71bee606a22327e18336a55e4ee985123e7711e3977d42e6f3eb11b3eb9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMa:A3kM+
TLSH
T11E159E03E7A010F5E65A823499E61A12FB75BC221760DBDF136497252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 aae5011502c6754c6e3bf9b6c1ed141730c466a00690602e2a35070213595d55
MD5 819306c6eb0aec4562fad90b246e7600
SHA1 3709df2c16188b41a6c5fd97c828bc96a0586fbe
SHA512 6fee30bd90fba2bc6a7626fca909ba8e012b67451e27f1efa0f66be317ab7e6df86ac590f83810c7936d766c32738683ac26b3a2136c53441acbdaf0fb9acffb
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaP0Le5ji0hmxNrM:A3kM+bPji0Aj
TLSH
T10A656B17F6A402B5E077C179C9E25A5AEB7238521B308ACF1394C7682F237D19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 883KB
SHA256 9a9ae68a100ac112ba47b771e1f471100ae700cfcf6daedf082b50fd039b0c77
MD5 ed8feb69c0e77ce6816855ed11fa1dfc
SHA1 534ef8ee0a30ee00213f0ed21a887a8cdcd953c3
SHA512 cd773d72d64095fd0578c1f53092fb3ef2279ec19e1aa513d1f7922ac091a98abcbf9cdbe5b8549c3265d150e35689124385cae5916bea8ded239c82c79c3650
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaRa:A3kM+
TLSH
T15C159E03E7A010F5E66A813499E61A12EB75BC221760DBDF136497252F327C0EF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 892KB
SHA256 c43abe0d4aa949b0818e83371d07efb416ee59e3b88a6f8eb651b1be89f8ce4d
MD5 4cbfe654aa1c64560056de9ee515ff3c
SHA1 cb0d57ff379a50fcb0a87e4ca48f7d360bc98a60
SHA512 6c28b2949378371d8fd82c697e0f88aed694e6a02a9acc0411e43f3ca47677c42623f202f4a87b978bc9cd5f4335a239f2707d5f7fab8d9ae1be2f4f8c1e2b1d
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMao6:A3kM+j
TLSH
T108159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 892KB
SHA256 030360ea83782aaf3619f59fa8bcb7b5577d97693a43722212a241ba1632713d
MD5 b8466110b282aed6e2ac8a34f1bae0b4
SHA1 c57c8b35394e3612605b00ae4c201c4c84b1708f
SHA512 f89219532f3d6714f88a97393822521f29cb2a2472caed2c64a1f85a640eaca20f13329424e31bdfda53432acd7ac4fb5e89848a7e2ca9f2eb2c99606244190a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMasN:A3kM+e
TLSH
T10A159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 892KB
SHA256 67b651896338da685fd5e157ca7a403cd69a8efcb39c3ab3d6486563ae019f5b
MD5 c2a53a114f8531ce146f6623cc1c91da
SHA1 066fe4eafa91cb1ab3339b2ddd606f701e554194
SHA512 c258812ffb57acde68ad08066e2220327480e3933df7231a3936f36df9a8f9864f841144d5384013ef2c9476462f07b2e109652c1126335fa988ea85d2035353
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaif:A3kM+y
TLSH
T1F0159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 892KB
SHA256 7743144ef66efb963a05b745a17916afd3219d5a0121d165f10920ea931b2137
MD5 1ecb2553adc585dd59f5c07960a5b1da
SHA1 9ccb9035d2d3a1e5e83e95daa36274324fdf2ded
SHA512 f136489d7bae44b7a647107e20d06390adc63f1a1084258bff65d8e5e5dd7efc3e2c990f3f2de61eb08b3cdc979319c0536100f58640481abb1454e50d1d90a1
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMa8o:A3kM+7
TLSH
T1B4159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 892KB
SHA256 2eb7c57825c2c72810d6871f5e6bd5e7119280f951cd27951340bdd8167a9b20
MD5 6173f5c698f63ca3d6fef62c9d3f351c
SHA1 8f58c4e1b2ee8cbe244ded7e1b861f1df3d16913
SHA512 49919e0403d025d70b8de0946b883baf1680a0ac2a6a37cd1fbfacc357123b36520b7b1075c950280e1b8f0e91f970f6d9b7208996fed3df8b97c28fa561277c
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMacu:A3kM+9
TLSH
T1E8159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 892KB
SHA256 4f1e2ade2a264ec0c8dff7393eb5561aebfb9d12289348039fc1fc2c43183190
MD5 4d1368f0381724b82032ab2066f81ca0
SHA1 afd564eb8012c10b35c42831b7ba063bbec8fe21
SHA512 8d410bffd5455bfa71666caa8d1d071b4596b0856f44684dafce8a1ab8d6eab104869ee0019754c56ca7c67b2b5b231bec83555dac60bbf58a272734b8c40362
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMag9:A3kM+I
TLSH
T13C159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 892KB
SHA256 62f0fc624982e1b8ea4d2b02a01445f4a841121bad3e735e30773913fb00f823
MD5 7c676f28a70ccee53491cc8ac8d346b0
SHA1 5734f6558926437c2c6679b668a2762afbe355ad
SHA512 6ee3319b08468382409d5dc304f1f0ee0618d2c5ec907bef8f7f4a7a4bce77df8fe466fdb2191c585dc23ed8304372cec8283ac3c86b41c695dfcafd8539f761
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaoc:A3kM+J
TLSH
T1A7159F03E7A010F5E65A813499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 892KB
SHA256 df9681e979f47a62e20bfbe6874a15f8046e58151a27174483a0eaf87d98c385
MD5 139a869f85afee05ec5d52e6682d0882
SHA1 4c3e0547ead6e350b19441bfc055d2fe5dbc815d
SHA512 48a457e4c918cab08d918222929bbdf4861f8d7d7197489e44bbd797683390de9608279e41c980b43d0e236d4b02d8f683e23cc6672fd3d6418d72b489fd87ab
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaBp:A3kM+n
TLSH
T10B159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 892KB
SHA256 63adee7b2baa7a40e2293bc2b73e03525a9f1b730b614b27d38ef6a8035b4eb1
MD5 4416f3f2ce72e18eee56dbe106126504
SHA1 51708d2e35dc05f5986baaa5cf0bbd5bafa38632
SHA512 cd6c1c6e18ae8a3ad99b806a70d10658f4fcbb729017b1b54173b13ce5138e60b4f614d6d40777f991a18737ec14db7e20770137bbe4cb3207cb570bfeb9a8a1
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaWN:A3kM+s
TLSH
T14C159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 892KB
SHA256 0758efbe25385750bc9110702501cd7bc1454765ed7299e3c893f3dfa400456b
MD5 bf80c1a9ff8c764b23666025f80aefda
SHA1 c4b5cbf0b3ec15b051624fa63462133d79d37197
SHA512 39b7fe69a75da00a68a4a36588ec867b6b7806527dc8832409658c96f4dbe8576c7a84b9eea7ddf829c644e350088bac5b1d6e03b859bbc92ba57efe76c43726
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaaF:A3kM+6
TLSH
T18B159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 892KB
SHA256 88f62764515b4bc75bd93d0dcbf4611a977d831e5d1b13b7709981f7a83cf823
MD5 c641f29528747f1653e407d0458f3d11
SHA1 14b11928d21717a3ad7e3ad67cbdd28dc2e8dc5e
SHA512 9ff8e39b2b3a55260ca02192d1a9841676925686c894a5d35332812b736b85be41cb34a2729c212477cc26edc3f5b7e6a68bd505c4bce8e68da35539a893e668
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMavC:A3kM+O
TLSH
T121159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 892KB
SHA256 ca7ecac300feec5beaa9e9e4ba9a6b2455055a674b3c7d6bd7fc2a62bde82e37
MD5 153c874c6069ed8fbb6c56960abbeb30
SHA1 de04435eed6e8074677bc8492f34351ad02a7928
SHA512 16760fcaac8c4ad5c603138ff8fbdacbda760cb4e3be40447261eb583824374327fa5101ecc528d5815a94b828fe492754be08c5667fdf70766b065d8cd30ab7
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaQw:A3kM+b
TLSH
T172159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 892KB
SHA256 34685a2df9546eddc27a37f6d9d6a6dad30eedc9f2e639e116a3f9357ec9d7e9
MD5 b4bd3e70c7e53be1fb42bfb001db74a4
SHA1 c584bbf5be77bf6092ca4fd5fe8a76799a444cc5
SHA512 36c2534bd645c291c4d4d9b49895a4644cefd6423c527e817243195d064bbada835e9712331d14dd7a61f53e39a33a957a9c5c3343c67a4797379c38c003923f
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMavT:A3kM+H
TLSH
T1BE159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 892KB
SHA256 3d9e766049106caa0cfd0e80a6ec9069f8f1c571fa9e5c330e94f9f93886192e
MD5 d07274acfbbeba9227aee264b3c4fca8
SHA1 b7abead96de49eebd1b3b9228ca4f964ca863191
SHA512 30f8eff56ef7b09b4b2acb5069c89c1c4d48ca2f42659711a82c36aee6958853fddccfcd508812fc9684d55304c2f0644925a078bc12af1f9a4582a67d15e535
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMapu:A3kM+I
TLSH
T144159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 892KB
SHA256 ec1980f8506d007ff175952144fdc1b135d00865cb402de88c9e09d9abccd59a
MD5 ad88b29008ac0cc66615e32110e81983
SHA1 2a1364dbc4e2f71869b4ce0f5403eb070d7c5c25
SHA512 0aaa11c3d35bb7658c83051acf10f78c43b605c5d08f7a496c98990c1540a5a95b8f878c25178039615b3a9ea30be313245f92d8dc8d4bf92859e554068c56f7
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMahb:A3kM+x
TLSH
T1D2159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 892KB
SHA256 6fe7708f9a0445d12e72f8a94a0c61bc18825f2b9d794b53ac1829c98bc08d4d
MD5 8ee358fc3ead923f68af22b4dd345bcb
SHA1 9cba2a2fc614e1216d9ec472f2b99c3a37161116
SHA512 c3ff866b15f3d1c297ab3c454d143bcd56ba408bd349b3e1172aeb15fcd78aac1ef70082ba2735ae543c701b019e52d0585134529b2d23bb546ba1d9918006e3
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMapf:A3kM+x
TLSH
T125159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 892KB
SHA256 4cd54779d679a77c32f29271d02f003a84161bcac4a8d0742a48e06e1d82a6af
MD5 df74f717e15a7f33d261834cff8c8df9
SHA1 2221d9da7088a8973a44e00a148a1d810295d095
SHA512 d533b09edde736f03f88fab07481a7f903bb2ed9f4b9bb46c6a519a74197ec10086faa822d1791bad27a65e1b1c2e47eee3f65adcbbdc9fa681a1af7a69e1d65
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaSK:A3kM+J
TLSH
T17A159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 892KB
SHA256 431536b4d060120eb623e99e1d21f5cdc0a206571f7f2503878e7130d989c3e9
MD5 7fbc0c83097ad1f4e9597ccbfea243a7
SHA1 08e84576122c7cbd152e96467d9053cf462df63d
SHA512 ecbf04910f68bc25d2003866e38ffb4bc72944f9b18ef39e911d103027dc6a659567798c026cff6c906da786e4c2b7f2b985dce004fd69a1d8d605198b8fac5e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMa3k:A3kM+A
TLSH
T188159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 892KB
SHA256 bfe32b9266d5851983ba7b912dc9b40a62a33c9c2b5da11c22751ace14412cd8
MD5 b19d6cd693acaad7b0f2ad9015652a3a
SHA1 c2497d63a80122ff5ea24421554258dab7025515
SHA512 2db89e1d4672481fb24714ce8a6f6691dae9976e8afa254cb535cb631622740ecf1e1c19f0eff8361f7d19d54dfc59fad1869f4af0c2d01a048e171e151559dd
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaA0:A3kM+J
TLSH
T1B1159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 892KB
SHA256 33e2430f014c1c1b1fd59b0a92bc1fed90431ea2eec84cf5132f1e7e8ca96f2c
MD5 6be2b3d6cfb52e74328b9203e8b5bb88
SHA1 b17d37ab0ba1d68b761db3cf381c33d9f3adb01e
SHA512 f4d81beada7bce4c725abdef9a5d0bb378d10407c0fb183ffcf23c325bf603cc4c07f5c231e79cd045c0bca7c346df47e67ddd9dfceba7629a269d279bba26d1
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMabg:A3kM+Y
TLSH
T17A159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 892KB
SHA256 b9480e3122cb103507bf97d7682323f909766c6e0a109c0a92ea2aab78394fc5
MD5 71dcc75d736a902880435d5a6214f195
SHA1 eb943e5048e2965fd7d46894b491909b6501c846
SHA512 b1ce10d97c419802a40e0444b9b5c44208c8a3e19fc37c81567a31fa381b1cb5a0d5875b0e45a63e1905092daaf1cd6d8ff03905d0add74db24965e3be674343
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaWr:A3kM+C
TLSH
T101159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 892KB
SHA256 1700856c7d2878cbb79ec040758025df3588b435782693af13e2ade3fd4e1316
MD5 e24f679ae2ebbc894263f6bc3702d6b7
SHA1 592846171dc828e7a29f0a69f18d7847383242d7
SHA512 6c18eec6044a644ac5008036454ecce6a59bbd3f5b5e4e676fa78722d4ef5b7bf7d8b62be15009a31f5c194d6705e38dbae24f4b5565ecaebe680b9b04dabba9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMa8n:A3kM+U
TLSH
T19C159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 892KB
SHA256 1e882152f25b797a32902809290ced04ecbbafbd8574754c48239406e2060584
MD5 cdaa5cb293ac8f7b6441035f2a0fbc11
SHA1 02fb2ee0fe4e9b66aabff45ae1046404bda65e9a
SHA512 89d62b04cdd326855425c8235667d6b015a2d5a1f539207b801bed665eb1e16a51ecc56cb7b81dc975559f4b9440983d72e4f9ab8b8e190f704fb188207766c9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMa6x:A3kM+S
TLSH
T1C5159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 892KB
SHA256 933301e9585d00900b5e43d206d83e1c56dd2931976dd70de526b48cabb3b92b
MD5 6ce71ac062350ccc2c399adc50697ac0
SHA1 cefe4b638b62b1346755408eaf73b061bdd833c8
SHA512 9f74db2aae4a0a6dcde26169cba65ce0bedc1b83c0e59f06c8604243c35a8ba77e3b3b2848c5235f534ec2e67ee83be7e263895d1a9b94f5f5a444191a866493
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMa8A:A3kM+x
TLSH
T14A159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 892KB
SHA256 22f1aa49c6e25142eee50e3427efc732aa89cc3d152f88d18eed961bdef5a5a4
MD5 e1f6a8ab0fe59c3f018899ec8570a176
SHA1 87d89d2e29b13be38e6e9c31dab578e3023a83cd
SHA512 6994183aa829f01fa2575ea2f802500f0f1b5c0a5bb591b7c5b6c7c4f22c882f17027b1375a0479f215bebeb959eb347a7626c3049fd1e5c790028991c571793
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMal9Q:A3kM+I
TLSH
T1C4159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 892KB
SHA256 da027adaa7cadd95697d1ba54385bf840a70e979743073545a891c498c63e78a
MD5 be587a2e72f67195bfc01b7a118cf291
SHA1 a7cac3da1bb6ad76b23cf86a20b28751472359d7
SHA512 4379d33b17a3a8e23e8a6a13c9cf4f9553a0ffaa5fe7fb93a75a81561048235dae6d9f1a43d37b1dd34d1f935081196901cfe143de2a8d66306bb777f0052dcc
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaQ4:A3kM+z
TLSH
T16E159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 892KB
SHA256 2105f7bc6fbec46106c71f34157b42ee43b3da71cf734732e15c9841c91a969f
MD5 ab8f5a019134e48ed37cd337e241aee9
SHA1 6ea79c009821af9e75bed33f82cffa297d5766e8
SHA512 fe15c92a17a978d8b3c0abdc3447a40fa5dbb16b3de860b9a99ba6ffb51ca79c472572ab4a0ab2870cac4b5a772cc290d16557e4f346c4053ae45b83f3939e1d
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaTu:A3kM+W
TLSH
T1C9159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 892KB
SHA256 c95c979bed9676b0ddde653d87d062dd6103114b1a760d7024b5f1ba8e126bf2
MD5 ed20ff17ee25a9486600a1f5409ba2a5
SHA1 1703f8f501b4e8cb4038606cfd74b061f5c75d4d
SHA512 956863634c0afdaeabd43ee3272b24bac25e0d71dba6cf43d5f23c210970b622a6385e30392952ec8ed41305bf311716f445fb379ac87e81f0bc621d22bb274e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaOj:A3kM+o
TLSH
T191159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 892KB
SHA256 8bac9ea4959009ce2d0e4a3ccd9491a427a6084db48f1f96265028122ef23af6
MD5 2444f158612c73d0258d9bf46e1c6d60
SHA1 3d5c8ab6d5dd211ade1cede1bf2b0fc4ee086849
SHA512 9fce1274d4b9e24440512916da179f6fb0dedc951a62cc2fa02cbd98acff875162e792836d13f277a3e9c707d220101dbb447fd6cee0b43fb39dbc2e3278e956
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMa7g:A3kM+w
TLSH
T197159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 892KB
SHA256 afaaf37858c05e2abe50ebeb8cad11f5a61061fb8eeb5ee39ad1084ab94860c0
MD5 3111850c81349adad0a54429f482e3fd
SHA1 d50f35ec7932742e5922f863f78baf8d55a61d7a
SHA512 84ac34b97f4c3da666547f2477098aff20441aa92eb17f2ee2d2284e4b58d16d21710db5ab50f264f3f4f8e60d69f5ac50a6b6e99da1668c5992cd8c0150ed38
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMamI:A3kM+R
TLSH
T19D159E03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 892KB
SHA256 63004a86354799e719dc1f9758734fe9f2feea60a273b8d3434d0952f751a3ca
MD5 5fa46d08410bcf6dd9dfe3370a61b6f8
SHA1 d1509c8af8a957002b20fbdcd084bf7e9168f92a
SHA512 341243d7eb054c6d188d65728b78632937573a99df3de43c9893a51c34eef86f5e7eebc929ce97d6110dcb50c694bae3150f04af0d20e6909bb8fc35d12653e6
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaUo:A3kM+v
TLSH
T106159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 892KB
SHA256 3d594cd3ae8335fac1b9f02ff389cd51d1c0e2b0fbb89db5130ae5ebaca5cad2
MD5 2db821d0a629c6492f9a4621d99f648f
SHA1 c91733629a3a07858bbefb35db1bca9cd864b1b5
SHA512 63a5ef734493284af686a63256a43f22694b4139a9dc0b8467247d2aa77819dc75b7e3a1e14bbd96c9c4370bb7a9b6aa6c7fa83a05b99c565954f15e2f8e539f
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMa3+:A3kM+a
TLSH
T1B9159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 892KB
SHA256 cd65f77189a724a4ce8ed9eba95d7e612821e020decfa28af81e472846afc811
MD5 3e9daefe42bfbd64d6646cbf92b929a5
SHA1 c505497e34afb3a9c94ba7f2a633bc3cc2881317
SHA512 7169927d0c7982bb0a6e76d84a5a366d95a1f30018bc582e7dfe9c8be39c16ed5445a485bd9c3f9fa356890538707d41e18c78b67acfc883cf437af8ed7cc1b5
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaNQ:A3kM+e
TLSH
T1F0159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 892KB
SHA256 6e1cb62a97a65f28e5936d92546d8670a570fb0168a71c287de4db55e67260f5
MD5 2e7caab1160b24872d0df4ea34fc2ac5
SHA1 972328d0bde5d2a24b28a2657b21b7bcfc811df7
SHA512 a6123f7603fdd90c32987ce51f724917f66df5cebdce2e4435b2a89895e5a5232d44355dfff1121dbc8f45a97ec1b978a0aad21e11504591b299c8265ecb14ff
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaCX:A3kM++
TLSH
T11F159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 892KB
SHA256 6b752cd7cafa00d6e56468299c7cbf224bd56503400e080f7a693f63787d79b6
MD5 5860cddecd097f331b16bd14328ecd68
SHA1 0a65c5f8267fe596b0843f32b518cfec1514d97a
SHA512 2871013ed01f519f23ebe7d1b951a5bdd898bfa4edefac6058d01d6bd032c29bad701c60cb8dff721b5485eaa4624249dfe8daac35ed01c888810851a28b94f6
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMakL:A3kM+Q
TLSH
T1D0159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 892KB
SHA256 c2eca07464265fff1a283d57a950cc9c404ea84f65de59724a9fd8bac1ed5bb6
MD5 67ea05afb379290b953149d191b8e370
SHA1 77de70fd9030bdfbd83dac6f469cf2a869d9fed1
SHA512 8faa37be64b6c1ba83214711bfa49683ce2893716ae63a17b1694e3d7abbec26061895604496a3bba591b35445e1cbf93a713286a58dd9c98e8156006a5f7063
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMaAM:A3kM+B
TLSH
T1C3159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 892KB
SHA256 c4a48cbde40b2120f670850e59fa5e9ff917347bef42947f2cc5f011ff7153e2
MD5 13de422d38b2581f63d16d0597e20a99
SHA1 ba107ad3d38a5cf84802982f0d96fd598e4e10ab
SHA512 ee29a6426d128618b9c1c0bcd0a7bdc8a055ace39b49213c45fa9f8e0550f667fdcc31ab13a5f289ec2504229720ca64b7ca49f752ac8e8834aab20398c39469
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+vMahh:A3kM+T
TLSH
T112159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/772-259-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4844-208-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4844-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads