60615ab5cc28bbff657fca356193a88cee1dc0882d0315ca37d42f2242d5940d

Analysis

max time kernel
101s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Size 898KB
Sample260715-spp86aft2p
SHA256 60615ab5cc28bbff657fca356193a88cee1dc0882d0315ca37d42f2242d5940d
MD5 ab4ed12ebd9363b3a4032c9b59c06502
SHA1 cf810ed546127864fc3391ff884f497af48c2f9e
SHA512 8f42a7d670368b640053e2699d8b446dd315808b3722fde1f1a3f9aec763bfd027f66b1b57b927d205234e53419268911ed7857610831f9cfb52acb43c5c5e27
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0a:A3mnXoZjzyaEFo3+aWiauoOas06zAHN
TLSH
T13B157C03AA9000B5E11549305AA5961EE7357C16DB538ECB23589EDEFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4216-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5dd-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2476-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4216-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-545.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-607.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-975.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1086.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1291.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1353.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5dd-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-12.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-39.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-222.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-545.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-607.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-975.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1086.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1291.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1353.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2476	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe

Drops file in Windows directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4216	2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
2476	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_ab4ed12ebd9363b3a4032c9b59c06502_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njra.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4216

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 898KB
SHA256 60615ab5cc28bbff657fca356193a88cee1dc0882d0315ca37d42f2242d5940d
MD5 ab4ed12ebd9363b3a4032c9b59c06502
SHA1 cf810ed546127864fc3391ff884f497af48c2f9e
SHA512 8f42a7d670368b640053e2699d8b446dd315808b3722fde1f1a3f9aec763bfd027f66b1b57b927d205234e53419268911ed7857610831f9cfb52acb43c5c5e27
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0a:A3mnXoZjzyaEFo3+aWiauoOas06zAHN
TLSH
T13B157C03AA9000B5E11549305AA5961EE7357C16DB538ECB23589EDEFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 ebeb4dd0cbad5d629c3d46b7d8097417c74636382b323a6c3e2108edac5ca1fa
MD5 1a794c8c3a1e2e5faaffc7ca3fd5d1f2
SHA1 70e0bc46b2fe99033f6e554629e42973695d6555
SHA512 e3dcffff35f63d1886a996371355763649f3b1ab9fc1fc35b9f77c4f96c3f5cf58f360622cb716eed7241325e012cee60ea945d671edc394317cd782342efea3
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zAHZ0Le5ji0hmxNrM:A3kM2Pji0Aj
TLSH
T17A653916FA644275D022C074C5D2A65EEA313842D7338ECB13949EEDFFE26D19A3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 912KB
SHA256 309a8d1cb01186b777e4dfb67801e273396918f92a64a40cf54d8d60d1cc1ee5
MD5 0a48574973a8958a72956b5a7539b9ee
SHA1 84a188d7bddf106f256a119bc2f141f70d8107aa
SHA512 43186725e9536e2f0e4bba49b845a9ca17563df250b11a6a36fc89aec20eab43e603a0ff074dfb0dde9f4b608edc692437d925868bdbc111fb991accc646dadc
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zAHLa:A3kM
TLSH
T191157C03AA9000B5E11649305AA5961EE735BC15DB538ECB23589EDDFFF17C0AF2A3B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 921KB
SHA256 ea4cbddf61c816a43686c70bc046cd2294999b54ac1f144a50ab2fceca5342b8
MD5 19a4d4ee647bf24dcc722f3ef3d68630
SHA1 0a473c56d3d5029b20d54a945a16d76e029490cb
SHA512 4133ba2a3a6189292662b85eecfecc8cfa80e06f01265569716b9d755c672d730ddae0f7fa3acd897c99f96535fed2447968cdeca5609bafb44eda4a301375c6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0d6:A3mnXoZjzyaEFo3+aWiauoOas06zAHK6
TLSH
T15E157B03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 921KB
SHA256 6d0ccd0f2ca82d6be49d689a0a51282699ccaf9e9c3a4f56df5b63f9c7be1e94
MD5 ad831e6598b172c30621251a6097e08a
SHA1 b9a01e65f61a465fcaa35c8e7e90f0ab0286774a
SHA512 46b23a0db2def4e32313817e5924d69d366d38d47906c5128846988e2e1295543622840768dcba74cf1b7cdb7240d7402b115e9ddc581d57711734cd6f5f52d1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0zN:A3mnXoZjzyaEFo3+aWiauoOas06zAHiN
TLSH
T1DF157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 921KB
SHA256 70221ea3c42e51fe9b4e73f82464637bbc5130904730c7c85f1c5b88bda72766
MD5 4a14e04ae53477f07e73405345e23178
SHA1 1b6f1e0dfa401351f0e54cda7cef02c2857e509a
SHA512 673b0603b28c4e606fac9866f70c4798a841fe45b428da5f9ffb4a57aa2a979a740174cf67976268e534fdf5de8ead09a4a90373114d9bb0b99e0f0da3e6a11c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0Bf:A3mnXoZjzyaEFo3+aWiauoOas06zAHYf
TLSH
T18A157C03AA9000B5E11649305AA5961EE735BC16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 921KB
SHA256 adda6e2a8db0d72561c6d450263d60b3e7967f26ac0e8ae8cff5e90a9d7a030d
MD5 adce5ac874676f0261a193ba387b8028
SHA1 d5f269ff0229c9506f82f5c61874a83a60e95123
SHA512 b4ee3bca4bb61ce05f423212940cedb40ae7d8d1a651bd3524ed9bffd83cb3e429d6427b33e358cc6b90de35eeeb0dfcb5f2244c791ff1b2035c15dfa98e9364
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0jo:A3mnXoZjzyaEFo3+aWiauoOas06zAHyo
TLSH
T1B1157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 921KB
SHA256 8b914cef7c35475f3ab5c7114127b5e0208caf5e67b93a8c922602d225652325
MD5 204912eb6487561325e90d4da0e878a9
SHA1 89f152e47e3cf640d96f5d90498924c6410b6edb
SHA512 e8535210b0436c649d54eadf691d6f781e4a35958b58fa5fc05a96ecb4d9932bc2a009535e20ddeb3539af9245bda8f02f64cf2f2caf13cadea879abb498427c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0Xu:A3mnXoZjzyaEFo3+aWiauoOas06zAHmu
TLSH
T122157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 921KB
SHA256 71c943de87eb1fa760507772290d56205fe5770a842e1f9daa3592fae99ae70c
MD5 184057dd70fc85eb685381a165bccf4b
SHA1 34efdd5ebe1624195fdc20292181f5c38ea28643
SHA512 786a8beb34a438065201dd29dc4feb53f455da499272c1f799e65066da38080cbad6866c5f0fc4d49fb85201e0eb0e4b9904d0cca21247f5b475d691eb0b8c38
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0l9:A3mnXoZjzyaEFo3+aWiauoOas06zAHa9
TLSH
T112157C03AA9000B5E11549305AA5961EE7357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 921KB
SHA256 308197d98aca391b09c60ee4fe20ab99f3cb46994614ad5f0aa79d138369bf4b
MD5 b5fec84203669c6d4404f638bd93022a
SHA1 ef6b52088e1e5d488310333835632a0619a2d060
SHA512 cefa20bccd16d4006e0764ac6fbf3c370ad1f371decb22cd1395ba93a94072f8ab36ab80183c1de5e0c754b8b1755026a73eca3e5f3cc37fa2792b4070ce425f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0Bc:A3mnXoZjzyaEFo3+aWiauoOas06zAHac
TLSH
T18B157C03AA9000B5E11645305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 921KB
SHA256 4b29d83d64979b3026b1febcca77a28c945f4a71e7988d21ada32d5f38072b7e
MD5 c20dcf417004f38b12c2edbbd40dda40
SHA1 eab944536fc80fbc0cd7d6da5067ade2e154fa47
SHA512 c5e9234cbd918f320e6fe0841cca56838c089a64841d2fa41892e6e90522ce0a2b2ab0f25bda5de06a7be11aa11097870512809109a339d93b485ae30a303cfa
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0qp:A3mnXoZjzyaEFo3+aWiauoOas06zAHTp
TLSH
T196157C03AA9000B5E11549305AA5961EEB357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 921KB
SHA256 8d827e9f59c1e2d84c1150cd0c8843f4ff1d9d5a62cdc2f8d4d8a62684afe4c2
MD5 04a10e72589e60695b8bc11b9f518073
SHA1 1c6e1d6390b48ddb46825312ea1c6b89801606b9
SHA512 75a6e689a391369843f75b01174f5b31d9e69aa135fb768c05023a73a78d838de363b9686a33735405eebe65093cef3c9bdc6fe03e0e6f53715a7431546289b1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0N0a:A3mnXoZjzyaEFo3+aWiauoOas06zAH0N
TLSH
T1E3157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 921KB
SHA256 e2fe043f4e3fb2d3ab66c62c52e33e04b6f18854d5d481b2c3eb56476c547ff2
MD5 d9ab4361f4181ceb084381e2ce1f66fc
SHA1 9519d0ed09799b090723d45326afa67575f45e92
SHA512 214b9495da17a4dea254d2cb9b44bb646cfd5a0ab1d370308dcb65e6df8197df0b079851806af4ed2c2662987a97e6c80c01ec7db507c2625f456f52ee75b8ea
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0/F:A3mnXoZjzyaEFo3+aWiauoOas06zAHcF
TLSH
T15E157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 921KB
SHA256 a1e2f274bfe064e1119f36d15b67776e2b8f0fd27b3bc68fd679913253779156
MD5 b8abd07837dd113d2dfe85e8f78f6f68
SHA1 c18ff9f8bd3b04b80d1f6b4c9a9292bc773103e1
SHA512 9fa2a0ebcf6cbaeca2b9fd19ef462875dec41098ecb78cc3d47b2dac464aa0e87b916816161dd12e65e06a9ac15e9cc737e594794ccd59ab4a924c1adb2f30c7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0gC:A3mnXoZjzyaEFo3+aWiauoOas06zAHJC
TLSH
T142157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 921KB
SHA256 8cb4c33861201fd9d9230990ccbded4c3cc533717e85003c3cd19a88fc17ced7
MD5 e457cc32a0adecba13e66e147749d616
SHA1 b74d4bcb6624d1d81e57d914893e1ef09cffb664
SHA512 f018c1173c9ac31b5f9380273d9b0831c3a5e344653deef02aff6b37ed94029f3c49a5b8a38984382914efbc679b7553b344b4710924a50a3f676ef26e27d1ab
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0zw:A3mnXoZjzyaEFo3+aWiauoOas06zAHqw
TLSH
T191157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 921KB
SHA256 3f23a4a9d01c8840e55896f85e9fb2919372d8f6de9e47e86165ea252ed92034
MD5 ef0cba8af7bc4b01abdb642f8a4d862a
SHA1 7ab79b406c0a86fe099c2edd85f63e8e31be401f
SHA512 90efdafdf48b8e2f7b9b35b7eb70690437467fa9f614c41b27bb07226c9e93124ed9bb793b3e8afbd6bef0cb62ff791492b70cc90e8e8cec5a8c594eac85272f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH06T:A3mnXoZjzyaEFo3+aWiauoOas06zAHxT
TLSH
T17C157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 921KB
SHA256 683c8e3020c8ba43dbb74b60c331f3a28f373f70f7a0428fb2599ec01f8010f6
MD5 03a4669b0c619b769f1790e548dccbc7
SHA1 0770ad81bf30fa5bf7b40f6ba5c7bd83633f292b
SHA512 e5bff7ee5b7b990a4caa738a2898acd78372b601c6cb7b6336d81553d7d33aea637d96fe0edd9151f7ffc243369c9cc5f6ea1702e98823b457aebbc1178d9e2c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0au:A3mnXoZjzyaEFo3+aWiauoOas06zAHfu
TLSH
T154157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 921KB
SHA256 b928cfb56596591021665e0e93b370765872be4b8a9d08284d2f38891d5085c1
MD5 80c681997986d93cf2192a62f6103dcd
SHA1 cc9f6bac698afe508d5d65dcd8e2bebb9596a06c
SHA512 fac8742e4b95f9d0bce1c7504b116a60e5ca799d6f500522cad7007c6a4e53b229f10b8160d5b5d584a72503ce75c5cd1cd27edfed3f3d7ebbd3161bb4249b4d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0kb:A3mnXoZjzyaEFo3+aWiauoOas06zAHDb
TLSH
T1F5157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 921KB
SHA256 2e063557fdae02eec257154423a9aa210acc160d247f37fbd53aaccf3f4c14ec
MD5 ab0c0974b87be4241439b03bbb2586dd
SHA1 cb09c6cf5b4b045c7f548676bddb765a6bdb89f4
SHA512 650de2783074f555b0d19c305e00f9f341e190d4074bbae4644613acd529d5595bdd664ac0b9472f4549f03952870c3d881f1dbfea220a0f4de3b740ff366d9e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0qf:A3mnXoZjzyaEFo3+aWiauoOas06zAHXf
TLSH
T14F157C03AA9000B5E11549305AA5961EE7357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 921KB
SHA256 28d0d8f4e546ebac82648584c048e191b0d89cad2b3f008fd35a0696c5373e4e
MD5 f1f4efe01c514fa6ebcece47468e7ef6
SHA1 b2b105a6eaa743b63475eb84492ad122f27dd6ca
SHA512 5897e88b22cc16f74e617227853ca33690290a4d4fc1bb923d7a33192c148eed840efbfe2c1176b6ffcf4353b0c1aaa42ff9b4a7a7e62631eb198d9c99cf7e69
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH03K:A3mnXoZjzyaEFo3+aWiauoOas06zAHgK
TLSH
T15E157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 921KB
SHA256 6424767ec33b451e4471219d7f5ec0dc0abc5b1e0b0a11f4b362f63ef249c2a0
MD5 9752b59332e445db1667292bebcab1f3
SHA1 eea615c3c486b30e78a60c7feaea2cd44611f863
SHA512 4f71a4f7375c34e953318cf5ba49251cc5bbc3701139d35abd3a0b619994375c6352f2b12213bbaa303a224848ca8203d51271366e71da8b835f2772fac39f65
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0Ak:A3mnXoZjzyaEFo3+aWiauoOas06zAHdk
TLSH
T16F157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 921KB
SHA256 3ef7f3d14d7919d171eadd378a5ae06b67c31bec08501a365c7fab7342d669fa
MD5 7a4de912a82ae5f83d77801ec76cca33
SHA1 37ac2539281777d6c0751f37c5b8c615df3f7525
SHA512 27b4e3e0ec93c3a4b18530ae524fb0e8283ab7dcd7793165c868429e3d6dceea920f9b2bb74f93a412c69b4a55e03a68f00615fa9eac173c9cb75f26ca77aa8f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0x0:A3mnXoZjzyaEFo3+aWiauoOas06zAHC0
TLSH
T1E4157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 921KB
SHA256 fa15bf1a82471e08d8761894d75db1832764c49fa6dc94f0f79a0ae678683e14
MD5 fe9f6153a2d6764a35e12e9a8aa6c03c
SHA1 e981275324b0184179ec749bc712b61e10f0d718
SHA512 c166799e65d61502e79ee420fc445bad47d26e8a1224806d3624968673d03565cc87487a227687f7d9af8a3cbfe96370feef1f3552279ad80c0e1f6dca06bae6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0k70:A3mnXoZjzyaEFo3+aWiauoOas06zAHRg
TLSH
T12A157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 921KB
SHA256 495b4243bf1d92210c46cf973cff14b066f5c666e1af603c082d5105b111f039
MD5 1614f8febdba5df2eaaef4f558e43134
SHA1 348daa0d1681566de4d847c3ad23eec24da55098
SHA512 9cf3c07b9b78d4fcfc00995719a44a1a618a4ab0385ce37d12d47046ae167141e48445c0bf1831f5ed4c4225be61f17f92d7c62fc479803744af4f38d6d4ce41
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0Br:A3mnXoZjzyaEFo3+aWiauoOas06zAH4r
TLSH
T1EA157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 921KB
SHA256 d81e5d3bf3d8c491f2e9a1f523095e4a2d0c61a50b67ce1182593304280cf3e5
MD5 823ea620b76796b3d38ea357b12d9d40
SHA1 e6acf86f966c3ea0f4eb670d42d783168cac4ad0
SHA512 d68a1dec9494e43f1f62e64d08c0e50c8cabf9b57704b7711b0982d4faa4d047e062ea462d609ae024aa8ca8c0f00eac39623b1a42cf03f05756596be227d438
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0Dn:A3mnXoZjzyaEFo3+aWiauoOas06zAHWn
TLSH
T151157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 921KB
SHA256 b341b0cdf2b125aa938e58bb03753135157aef9dce71eafe7ea64d4868dc568b
MD5 51cfe994d153162253230325762e1ef7
SHA1 7c4b52520302fb136dcde46d52655b6ebf85f47c
SHA512 18101dc8fd0f1bf4d65d7c131967e3f691e4245718ea1f1330683437ba9f8f55e1f77d465819666352e70035459da268cb67140e332563cfa1c80d663af602da
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0fx:A3mnXoZjzyaEFo3+aWiauoOas06zAH8x
TLSH
T181157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 921KB
SHA256 a33c3c6ad69a9754dbad024690caeeb309f8003fa0b38e01b9cfad6893a137bb
MD5 cd7954316821682989422b13ee1af738
SHA1 43ab7ac43eb93f157fe89424411adeaf1d38b5e1
SHA512 4884d03ae6307ce96e32774f21fcb32aec43d19c0904865882584b73af481a72fad7e1353e7c5897e26785f4a1993cd1b69bddf21042768c97e8e0372a82ba7a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0FA:A3mnXoZjzyaEFo3+aWiauoOas06zAH2A
TLSH
T1BC157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 921KB
SHA256 34971630d854d6b1cfc9965d952aaa1905a1161e08282affc72ea4b1e44e56c9
MD5 b5f48b0fc41649dab48891ec02f20612
SHA1 2b8454b8d8ac152c683399d449855050e48f8c05
SHA512 7bf9cd464c892636432242702a7b5d43de4325f488069111a5f1cc2d57dec963b23b98432e9b2e24c5d948b17c5260ed85057a765bb7f7ba386d8721100195f7
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauoOas06zAHv9Q:A3kMP
TLSH
T108157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 921KB
SHA256 069f56d8923f23070b23e176f0c4cd20058d65ce2cf45fcbb310a8ce7f6df078
MD5 1f332b185a7075a62f880269863c9a8a
SHA1 b76e00139136292a87c68233b857a29b847a6e15
SHA512 d1d5173342908dd61eb188d376dc3bf0671db3f7ec7fe5e552703c30b376f543bc67166fedafbfb8ccd1dec4fe70befa88c0eb9aa6d5976bfb840acb019132e3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0r4:A3mnXoZjzyaEFo3+aWiauoOas06zAHG4
TLSH
T100157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 921KB
SHA256 19ccaceb7e497c786047362eb9e2d540e94830168245e484f6d973dc24365319
MD5 826d1aedb45f347e4dd3f683033abaac
SHA1 d2fad23c13c15beb21656fd2e1ee5f67208d57b0
SHA512 eacacc35e0c92207c61bc4ed98e2e9edd43a9de005c8ebc97034793ac584a5b2ea3726cc086a887f2c7d264e5cf433ae60bd17000a33b53d01b9217989e0a0e7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0iu:A3mnXoZjzyaEFo3+aWiauoOas06zAHVu
TLSH
T154157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 921KB
SHA256 11442a648204e91b14069bc33d685ac2657952a5d2c2881ad6973d6f0a8d6020
MD5 4410a90067db562c4c57709a4a47919f
SHA1 90dbfe5d8cfc97eaf44db0bb927e47880cdfff4a
SHA512 b6d33791cb50216e2f8c959ad2bdcb0185411b78f223de71d22345f51ec7fafed7b644daf0e4dfaef1196743ec39e75fd774045232cdf7e15cdb1e5e93ead641
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0zj:A3mnXoZjzyaEFo3+aWiauoOas06zAHIj
TLSH
T138157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 921KB
SHA256 4b9b55ce71a1f356a9fa9b34fab68a0146211d24a9a197ad265e65985feb68be
MD5 047d32da7533e1419c6f6a17f87fcbf3
SHA1 a8db60de3341777cce89a4a7c795cb318bbe2eae
SHA512 b1f60053fc48bebcf26a63fac32e1d9784e32eb477ce35f9fc507d5cf96a68b965cce61a9aa4cd6f7760fa036a6ea9688e04a2343b57080436fe81d111137beb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0+g:A3mnXoZjzyaEFo3+aWiauoOas06zAH5g
TLSH
T18A157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 921KB
SHA256 358b6ca0609d85371a561e2c813c046a3dbc3b4ce076d68ddfa5883d363b96dc
MD5 ab10452f4fd62e219f2ee1d4528194b8
SHA1 f67b634166a4739645a784ce081026c7647d5e46
SHA512 ec69f94be882e95368429183e6390d070b7fe5e0cf448f0a6fad1f98827fd9b2ce92aa81cf4777f6f6634bbe466aa418c25721c96c286fd052f57e64386bc206
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0xI:A3mnXoZjzyaEFo3+aWiauoOas06zAHgI
TLSH
T1A0157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDDFFF17C0AF2A3B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 921KB
SHA256 dd4d411fc12e17fdf131b0d6c6455028a4734a61ba8a5c449e1882fc3d850e6d
MD5 0516ccd24422ffc15289561ae357184d
SHA1 c3c8c0b0576ba4664f633303d68e0f2ba84d90e2
SHA512 5019b0099b609c31495c271c56be628f2ec66dd6ac3a5447e3f757550156aa9b8ec5d9f05c0320aabc9ab165df9a935ef78a6d7cb1ef0ab31e0eb37e34e1055c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0zo:A3mnXoZjzyaEFo3+aWiauoOas06zAHio
TLSH
T1FE157C03AA9000B5E11649305AA5961EE735BC16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 921KB
SHA256 1fd2fc117fb82a77b1214e0a72996146586d4ce0ec310591566c70c15a2e1e25
MD5 e4a1f804de8c0cd73ab4feda2b666360
SHA1 ae4bffeecf2cfebb0a9dd31732269b1e191bb692
SHA512 1357fb100f911e6c5d405fb46bc2e14df3e9137c4ee67b96851739804fd9265a46177e9706e654d10b289041727c6703fccb58990aecd6db156448233021a3e7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH04+:A3mnXoZjzyaEFo3+aWiauoOas06zAHZ+
TLSH
T191157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 921KB
SHA256 7a1b78eafb3cedd367b27d3ea2afa1467fb42b4b89f168d445d070f32b8a63d5
MD5 d7018febc50aac9196f8f41a89efa490
SHA1 2cc379a6dd9ef7e0bc3e7a3df0773da8ee23f82d
SHA512 05a84b8d9ff5550d94d3cfc5e251aadadfb6c9201d3490f37c825a1baa3526dbe2feb9e99d4badb48690a8b3da03f0bcd839f02b9dcdb1f278bf04cba4453661
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0QQ:A3mnXoZjzyaEFo3+aWiauoOas06zAHHQ
TLSH
T136157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 921KB
SHA256 5c98e288d1e86069ad93abae26af48f1180a4c212d04f08b69da805221d91da3
MD5 a4d2b217cda46eb989b4b4f1726f2064
SHA1 85edb51abd7d1769cf3bf6be46fd75251bf6d029
SHA512 0320f88f4b6f697764f74f3241596ce685df741a01af7c8be030274a333fbdfccd422da6072cff6ac5ee76fb536c35251c6f1e130067177af8359d280d951f6f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH05X:A3mnXoZjzyaEFo3+aWiauoOas06zAHcX
TLSH
T109157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 921KB
SHA256 c6134eac68b9ac970942f490e689812e898cbaaaffc6b860103354462ae001f7
MD5 3f78e28a594576ae2112feb7c406c4f2
SHA1 91e149cd0544a4ec857032b4e1b60df797c8ccec
SHA512 3a0c277d6e9b6cba26288db01ee5b8dad4b13f827e41343419772cb769547b49ba93865b49d4c5ba2fe0a8a32f085eba46c33f2b1d52782a87ac258f0e4dc32b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0TL:A3mnXoZjzyaEFo3+aWiauoOas06zAHaL
TLSH
T116157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 921KB
SHA256 a1eb4f1fdc49faccc0776d7aed09062429e72dddfa1918be85f30ac2e584096d
MD5 17ff84cef21cc03f1f0ef71533ee548b
SHA1 3e0ceebd8bae082bfeb0eb789076f41f9038f465
SHA512 3c51191b215913abeda20ea3e3c694ee2161c558d50474e2139260f1cb810714ca6f04594984ab956c5d04275db5f28d5b733b6813366857c7abb9b673429856
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH05FC:A3mnXoZjzyaEFo3+aWiauoOas06zAH+M
TLSH
T141157C03AA9000B5E11649305AA5961EEB357C16DB538ECB23589EDDFFF17C0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 921KB
SHA256 3960297a9331ce841f042c895f5d845d35521057764bbc52e2adcc34d010be5d
MD5 806ffc95fb3cc4385d4464ee7463e5ca
SHA1 7497767d0fdc541c10f0a6fb118337f023f6586f
SHA512 db61781dce4be1bee56cc3eb5513089db22cfdcb02041fc2bb5bb7723d5132a5fca75acd8e2ad3b96b72f5d610e30db2b78f7ec8750062cedb5b0683d6061e5d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zauoOas00noizAH0Ch:A3mnXoZjzyaEFo3+aWiauoOas06zAHnh
TLSH
T12D157C03AA9000B5E11649305AA5961EE7357C16DB538ECB23589EDDFFF1BC0AF293B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2476-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4216-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4216-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads