9b412f620d0fa83a14650ee67e90c3ec17862ce4b0747baac9a1872a77698fe6

Analysis

max time kernel
100s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 815KB
Sample260716-cnsd5aew2t
SHA256 9b412f620d0fa83a14650ee67e90c3ec17862ce4b0747baac9a1872a77698fe6
MD5 0dcdd9e784214c4901c153cdc2c0de3c
SHA1 62cfd48d46e14a2d5ecb7576bc31a4caca5487a9
SHA512 bec31303ddfdfd90acfe6c0790c6e24ba058e5da91b579bb0d19734c5a731dd2eb1af37678597e9885f2ec107370110e9242d9f0f9ce515357deac698f0b40b4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdW:A3mnXoZjzyacNVOI/7PYaiOLHdfW
TLSH
T127059D03E7A500E5E127C23499E54612FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4116-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c614-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b2cd-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4116-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1172-203-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001ba8e-404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198d8-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-697.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-866.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1361.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c614-5.dat	aspack_v212_v242
behavioral2/files/0x000400000001b2cd-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-259.dat	aspack_v212_v242
behavioral2/files/0x000400000001ba8e-404.dat	aspack_v212_v242
behavioral2/files/0x00040000000198d8-477.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-593.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-697.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-798.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-866.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1081.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1361.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1172	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe

Drops file in Windows directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4116	2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
1172	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_0dcdd9e784214c4901c153cdc2c0de3c_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4116

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 815KB
SHA256 9b412f620d0fa83a14650ee67e90c3ec17862ce4b0747baac9a1872a77698fe6
MD5 0dcdd9e784214c4901c153cdc2c0de3c
SHA1 62cfd48d46e14a2d5ecb7576bc31a4caca5487a9
SHA512 bec31303ddfdfd90acfe6c0790c6e24ba058e5da91b579bb0d19734c5a731dd2eb1af37678597e9885f2ec107370110e9242d9f0f9ce515357deac698f0b40b4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdW:A3mnXoZjzyacNVOI/7PYaiOLHdfW
TLSH
T127059D03E7A500E5E127C23499E54612FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 7c48ec69557535afe28a114e8fce1f13a80f9605858076553cfc317c667d0dfa
MD5 5d17c1d0682803241326f68b4c35470f
SHA1 93a6d9ba0fa957655a51c2cad0d8937ae5970f9e
SHA512 0b5edd431b95c5bb29f58aee24ecc62b671eb57a3acf983bc76c261ba9a1d35121591b72e70581118109f2763b3f43eec91e0e497cb1c2c7ae94da7603a09087
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiOLHdfc0Le5ji0hmxNrM:A3kMfPji0Aj
TLSH
T1F9557C16F6B402B5D033C179C9D2965AFB7138421B308ACF5399C7282F67BE19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 829KB
SHA256 a36e9f6c43e52a41460a8dfa70651f95a83740db1c5fb89f33ac40cfbdbd430a
MD5 58f62e7172800300e5b5adfac4baea98
SHA1 da7d8f27565abd5006b55be975423a20c56c0aa9
SHA512 a2b83c1fae8c264f9881a0608690b7747bfcc964d09606f026d258b3b456e8fb4b63db9cbbe307ff5dc0c0d9aab7a69d55efee56a141cae0b032a9c682a5f867
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdWa:A3mnXoZjzyacNVOI/7PYaiOLHdfWa
TLSH
T1B8059E03E7A400E5E127C23499E54612FBB5BC122760DBDF536892152F72BD0AF3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 839KB
SHA256 478b0399bd7a1a7f39cdc409b292318617f99f3e836157c1231cbf93973e72f8
MD5 2e2bb6e52efec3a2bf64429237f1ff44
SHA1 2019f086c355beee660288cc4c7e8d4abf4568f6
SHA512 57931e35a6701ae7aae7097b4503b74b9f5d33ee6d6d9dc286e38822229dbd780d4e2b331803e6a206b0b05343dcfb5d5f1c2f336ded2c8ce52a9c267029daec
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBd36:A3mnXoZjzyacNVOI/7PYaiOLHdf36
TLSH
T1C7059D03E7A500E5E127C23499E14616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 839KB
SHA256 f5c333d0d0873e751d36bb2677aa9cdbd0d9464f822972c50dda1864319d2bea
MD5 2c419c3b2b49287f1c3eb8bb25acd79e
SHA1 d9d4f401a0714dbc7ec5da67c1c582fa17567b83
SHA512 82189c717d000fd81d2be310ac7eb8aeb0dba9257a5d6cecb066eb6802b6179a6eada6c2a8a9934ca7117a048035a0021770e84ff0abcd58c03286a2b2c26c4e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdZN:A3mnXoZjzyacNVOI/7PYaiOLHdfZN
TLSH
T1CD059D03E7A500E5E027C23499E54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 839KB
SHA256 1c29295976ade1a6c74d08967d7ef637940faf08acb39a4e8698fb29dd9cf6bd
MD5 68f9252e54e1e2abf1b8d3b931b5b4bd
SHA1 aa82e88be9fe0e01834073971301223ebe4f6b2b
SHA512 cb1f0765f61b80d2393697353558bb567a64ce604d0396bd119ba230fded80b93f64910b293089f30890ae68bd80822e04fdeff01faed390d1350f26e8ac4a87
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBd/f:A3mnXoZjzyacNVOI/7PYaiOLHdf/f
TLSH
T141059D03E7A500E5E026C23499E54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 839KB
SHA256 5b883059ba58f1d8e2161fd152621b1c3e5b5a6f3aea87c228eeb587ab7c15be
MD5 1d9e543b9965525cb276899db2002835
SHA1 3181ad7e5abcc9cd4e25930852821d401b377217
SHA512 31d340d4f87e96f54da64c95a766ab4da47920ea5e35a503b03bdac5a055e453201790c3802efef1f5f0365f1f088c663b213aad0575f8adfc103cf40ca0a68b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdBo:A3mnXoZjzyacNVOI/7PYaiOLHdfBo
TLSH
T10C059D03E7A500E5E027C23499E54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 839KB
SHA256 b027e70ed80f7bd7da4a25d7da725f1091c21168a2c8038755bf2b3410479a9c
MD5 3b32f309bfbde491a91a6e73d190c432
SHA1 46ff58d6a3067d160e18f5bf3a68a433ea079255
SHA512 43f40d9f7827311fb84d41cde9377c768f0c6d6cf553f9eeb044a1fda5cf02dea6a62a2457a03fe90a088f6a538795e0112f3f63c19a4b003f48b722ea73c64c
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdRu:A3mnXoZjzyacNVOI/7PYaiOLHdfRu
TLSH
T1B6059D03E7A500E5E127C23499E14616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 839KB
SHA256 88bae3510a296a4739e7f5373ff8bd74b2318713b071ab44fa3bd6ce118cd48b
MD5 06a80e449435abedb77bafa2549905fb
SHA1 f416eebfa48f93afcf0d41a9d22edf22696d8403
SHA512 d08750a42079c6b02055e17b220532133e014d50500ed0559315c66b8cea56c2d614fcb6ae6a4bbff7d4c3ebbaf5811263aabe554283c9bf88d415a7e87d5924
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdX9:A3mnXoZjzyacNVOI/7PYaiOLHdfX9
TLSH
T118059D03E7A500E5E126C234D9E14612FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 839KB
SHA256 1c955c96c9ddfd71dc5370b47e81af6d5e99c9d7ad13c8fbc69b6457a038296d
MD5 18e7aef2872cbd87a0e9320c58988d7a
SHA1 059e77a9cd709df42b8278f6c2c8170e1999daf3
SHA512 89dbd3b874782c932daca43882fcc98d684dda68a905d38b26e11dfb24765d55d3a8f6341c9ac993df8494d5df234e62153bfb371079c0c9f78725b9b4e32cef
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdzc:A3mnXoZjzyacNVOI/7PYaiOLHdfzc
TLSH
T14D059E03E7A500E5E027C23499E54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 839KB
SHA256 100ea5c4d5c2c49089f2a56da5d8f2d8fe0bac4fb0ffbfb1a104849a8e86146e
MD5 11e43e522bd82bd1934b08eab3ec4fa4
SHA1 5dc2d84f3fea349febee045c9a0a8f4984f53e93
SHA512 3b3f83e84d91887a317e5061bfcd058d078d17002904b9a7dbda2583b4eda22966c8a2af8081752b9b9220e9fb01e12623c9bda3862d11654f24dbfc7de0ef55
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdMp:A3mnXoZjzyacNVOI/7PYaiOLHdfMp
TLSH
T18F059E03E7A500E5E026C234D9D54616FBB5BC522760DBDF636882152F72BD0AF3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 839KB
SHA256 3d34057d162b460981daba103340e81961680cda853b7ec23f90672903605c34
MD5 617b69b17f0af39102deddbd0c3d7539
SHA1 67e9c3c3a62b026e410a0a38875db0ec2f228b17
SHA512 b8805c05f656677605f28b8a5ced7513645d65256c1cd6752aed45c2f0de87eeed10b68636e35e2bf7aca03a09e77c8afe05f83c158e109c917005eecea3f75b
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdj0a:A3mnXoZjzyacNVOI/7PYaiOLHdfjN
TLSH
T15C059E03E7A500E5E027C23499D54612FBB5BC522760DBDF636882152F72BD0AF3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 839KB
SHA256 c2d4dfd8273829c98cf667cd6f9c931a26c625873beb5f0d6bbc56a68f9d7054
MD5 f9be6fe51e4f2246a1222f3e45d5d03e
SHA1 2e41e68ee5d1a9d59553acf0f0f9146c0c9d5d62
SHA512 fbe0bfe65766b4074264c8ce2dd7df20c1e3345f834bfdf02faed9fa5ceeddf49f1bd04e6b9845836178324968603d35ae43fef3cc004cf3a63a8dfd6af04dc2
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdRF:A3mnXoZjzyacNVOI/7PYaiOLHdfRF
TLSH
T1B9059E03E7A500E5E127C23499D54612FBB5BC522760DBDF636882152F72BD0AF3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 839KB
SHA256 d9e942a86577ce7b123671d3f5751db196acba439fd32443cc4598d3adca48f0
MD5 c5a388ad9c9d67a5fbf3be9d794883ba
SHA1 1be04fc6fea83023f8fbbcaad2a239080fae2e0a
SHA512 1d01c3369264f8299f180d19d18f00686ca9c3cdffbf6a972a5f844ac09ba3775f5f9d87dffec8508237230cb93a92f9a5ef4eb6fee3de555c9b5593690cb7f0
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBd6C:A3mnXoZjzyacNVOI/7PYaiOLHdf6C
TLSH
T18F059D03E7A500E5E127C23499E54612FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 839KB
SHA256 60f07c0d9bbf7c0b7f0c7c7a48ecd566e72afd4ef7de9e2d0306ce0a0ee23420
MD5 17e41e3c70b403250c63e9569bc234a5
SHA1 c606a771b2ae637c471bdf1b50937f554f44a528
SHA512 83dbd0c78018ac6a6354c09a51b414d1b9763bf19c33fa47c804adc29152ca39d676483707f9112e4cbadfda1a49210b35527ef2c50e524810a74d910fe9c243
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBd1w:A3mnXoZjzyacNVOI/7PYaiOLHdf1w
TLSH
T12E059D03E7A500E5E026C234D9E54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 839KB
SHA256 e6f4a380a344830819603c77996470f15043211ebc3d683be3403c39248f0be7
MD5 48e4e3c556aac681706ed46562428883
SHA1 df8a94ac16b9206276457f74689f1234a5bbda84
SHA512 30d6bb44944d50195d612f4c01261a330ff2ac57e1739832310e43b8e06b6a37be207936363d581f14e70770c877710fafc4f192fd69646a3095de1a63430ce7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdET:A3mnXoZjzyacNVOI/7PYaiOLHdfET
TLSH
T1C9059D03E7A500E5E127C23499D54612FBB5BC522760DBDF636882152F72BD0AF3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 839KB
SHA256 71f4a9aee925673f48875a16bc5c4887c4e964445a7f88ea4ba24a2ea0b73ac3
MD5 cd46bfb77e5ff11fc29f9eba3af43911
SHA1 f5b536b56570aa3c7a681fe15aeb62b543556d40
SHA512 46fba19414b79c033bb3a735b5a2ee50ab4500caadf7a6a02a3acf04d5be00321ecdea83f9195b15fef667a3b9ce563f94a809dfd2f508210d7cf602566af4a6
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdou:A3mnXoZjzyacNVOI/7PYaiOLHdfou
TLSH
T13C059D03E7A500E5E027C23499D54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 839KB
SHA256 40f37845931ddbf748522dcb3956db2427caa89aa79a339d874376a0485cf64b
MD5 9ad306a6be4601a82ed52eb7fedef0c9
SHA1 7d77e34ea5277c39f71606229ca7ddc7399e2cca
SHA512 07e0289949d2de47bf345c2b05f240f7722982c320b96c4695423c17956530febce50cc6b73477abfca2a0108192bee7ac53b8248d2f209d0a210a9c78109a19
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdWb:A3mnXoZjzyacNVOI/7PYaiOLHdfWb
TLSH
T1B4059D03E7A500E5E126C234D9E54616FBB5BC522760DBDF236882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 839KB
SHA256 360cae2c549977c01195cbab50267b26c0bb50d908eafbc88df76564626336ef
MD5 be32678fe451c6b7fd568d826e27b2c6
SHA1 a47ed017af83a13081fd538bda78a4dd1a2449ad
SHA512 41025cf4ab252a01f43ef732c70464ed58d24cec29a3e9a2864b90b8c4b12bc1c18b0777ac8bed82e03294eac9f66c712c2c0243b9b679e5db39ef14a707688e
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdgf:A3mnXoZjzyacNVOI/7PYaiOLHdfgf
TLSH
T16E059D03E7A500E5E126C23499E14616FBB5BC522760DBDF636882152F72BD0BF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 839KB
SHA256 f0a18d206e8f131bf303f2e2f036cd533411586b701055375c7aca222cb811bf
MD5 6d0947cfb51a0c8ca0e8bb7c0a06681d
SHA1 890ba53fa57e5d7ee608aa0398fad1983c0a7ead
SHA512 bf083f8a761698d2ab265a6f431f28e10abcf81d1838716705a56812493b09a165d136c88e8b92767e7a7407763194d9df8809ab63b80e71afd7cf1e2042719d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBddK:A3mnXoZjzyacNVOI/7PYaiOLHdfdK
TLSH
T190059D03E7A500E5E127C23499D54612FBB5BC522760DBDF636882152F72BD0AF3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 839KB
SHA256 ab3d65ae8d6af6151ca352c4944c62114c33d217e446ecb3c8d7992c07d73556
MD5 edfbb2f2d99cd5b18074bc6b4773420d
SHA1 83f52546e72699a2c7eaaf81eb32abca43e887c3
SHA512 226e0a52f5a101bb138a7fc8e740e919e2b1e6bdf2bba1db79dc1e1dc0c2b302b3f66fab590b91348557d7b15d75bb78a1b735537d9d64ee70cb2ea0f589932d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBduk:A3mnXoZjzyacNVOI/7PYaiOLHdfuk
TLSH
T1EA059D03E7A500E5E027C23499E54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 839KB
SHA256 88aadef44850d4fbc8d07d9e9ab5dfaceea970c49a1c4a80cdbb4e49e06b8d4b
MD5 b1f0631747711f47d15bddb62334fa12
SHA1 424fefde53b38b514062a0654f82cc30c3201114
SHA512 04e34d4d77c33e2f65aa429a76ab1d5a40d295f63b34545944b6c781e35bc7f8bd23aea7f19fe2f23234465cb9291ecf3352facbe4aa922ff336bf7c7985de17
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBd70:A3mnXoZjzyacNVOI/7PYaiOLHdf70
TLSH
T170059D03E7A500E5E027C23499E54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 839KB
SHA256 5aa81d94e9f4b80b410f7dae6ebb57839efbc102eb47cd4a4831c34273f35aea
MD5 6f5827a582bd26a60f473e355e8eb22d
SHA1 879d21eaef99e73d1f62d3e6931262e2ffd29143
SHA512 889a25d27d8cbcf48dc4be1e63bdc33faa55eb42bd238d3fef18958bfc85d6b9eaf8d612049ce667a81d8aef3e9a0aadcd159117ed56805ae5f3bd817f8c5323
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdK70:A3mnXoZjzyacNVOI/7PYaiOLHdfKg
TLSH
T127059D03E7A500E5E127C23499E14616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 839KB
SHA256 cd55552fc50e5f3bc9024ba5c3e485684f187e0935373c130cdb9c4cb092a249
MD5 28478eee670772a359c11e8e770167e3
SHA1 e138854d416e52ff4f362315cc10e9681809b61d
SHA512 7c91b89fb2fb678b4ee3df993122fa4b25b52e3fcdd0ea2690b9724e91bfd904e7370b324dfd0c163d709c2c83fbb4ff4c6f6698fede60acce90a44218d8a6f9
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdLr:A3mnXoZjzyacNVOI/7PYaiOLHdfLr
TLSH
T1C9059D03E7A500E5E026C234D9E54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 839KB
SHA256 859fae1597aadd9ca6ad9fe49baaf57892ad143d959832c4307fa16deace68ed
MD5 32e762589d69f77a621f576c580c43fe
SHA1 5c6960336bd5f6700778653da3f0fc909615b7b9
SHA512 2a8bcee28b670dc0336e9c0d48759abe3dfe723b80bc47882cad5f0c584440835f629a8a504b541c9e7170fbc939239bcb22dfe6defb01b7dda7391607036fe5
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdtn:A3mnXoZjzyacNVOI/7PYaiOLHdftn
TLSH
T13B059D03E7A500E5E027C23499E54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 839KB
SHA256 e77ef4a4fb96d322d47ce61e1638ee27034221a16f995d19dd3ba68a07fa8988
MD5 a4e733ddcbc9c83c57d5d1c8dc108775
SHA1 57705e3d4ff192df86a48ecfc4ab57c14a8f1e19
SHA512 25d317c50c9a584f8e8cc74ac5774e3e244e1d82d7895c6ccdc6390504c7bac0696b771b11edf54843c9972433d764f913c7d42be747daf60e902225c0528c38
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdJx:A3mnXoZjzyacNVOI/7PYaiOLHdfJx
TLSH
T109059E03E7A500E5E127C23499D54612FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 839KB
SHA256 eecc1f14ed6982a27d406975db53c6be698b2e80525bd07f420a9a9a738a345a
MD5 268c5379ce07e7260a93b7dcc4c181c5
SHA1 8669c64f566ad2f7659c81b4482764816e7e36ff
SHA512 cd0c3ab70f9e78ae84cb158ea0a6d540409cb8266eb5b7ca426cd4c433538b294aafca78a84aa91d96f53a877f511993e9eca8f17c2cd2023f15cdaf09085a17
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdHA:A3mnXoZjzyacNVOI/7PYaiOLHdfHA
TLSH
T123059D03E7A500E5E126C234D9E54616FBB5BC522760DBDF236882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 839KB
SHA256 682167b405f5ff2fd957d1f5c701a9b720588060a4c3188cdef6be1418f9ec18
MD5 482619e584efd6ad3f07aa2e4668316b
SHA1 edf2bc63bff338b8bc12440fa64299418cc758d8
SHA512 9f0806a5746eaeb44079f15f66ede911496e59f18610a451296402263874bb638668e3697766b59369a359dc36f3c07e98064c07bcee85d5181ccc16232a5ef4
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdY9Q:A3mnXoZjzyacNVOI/7PYaiOLHdfY9Q
TLSH
T1FF059D03E7A500E5E127C23499D54612FBB5BC522760DBDF636882152F72BD0AF3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 839KB
SHA256 465b266243e6a1aed3a46b3e79553603a47b8b3f83278ed46615e401266005fc
MD5 dc7a74c957ff5b24ce5708e6b66f376e
SHA1 3888b5ac2c6c32cab84c36345afc28ef4652a8d4
SHA512 7c9f017be1661bf797392d99b32c0948061d7ea636606e2766211493e888f8901ec745bbc17360037857776cc8239dcab0b4c7b603e98976d767ef2505ab3b10
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdJ4:A3mnXoZjzyacNVOI/7PYaiOLHdfJ4
TLSH
T1E7059D03E7A500E5E026C234D9E54616FBB5BC522760DBDF236882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 839KB
SHA256 e68c7acf207002dee6321b3ccb3fd9b5f903cc761a8246e79814e409b354fb4a
MD5 d810aa2975b03f354fb4d6c746325ff9
SHA1 222a75dfcbfdbe1d6529968822eabd9c59dfcd1c
SHA512 c978227a8044e9afdfe217f7766ffb947e532e22f2a05a8d15b631cbc4974f3e492efbfb3900e28a6b14712f60d8de037164ad61278b1c9e1923f678b685573d
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdcu:A3mnXoZjzyacNVOI/7PYaiOLHdfcu
TLSH
T196059D03E7A500E5E127C23499D54616FBB5BC522760DBDF236882152F72BD0AF3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 839KB
SHA256 2b1139d1eb00e34c327b9fb028cce8c51a0871440c3d7f060cb64f4ff84ac406
MD5 c693e1d4150dfbbcf0edbcf7bfa8c64a
SHA1 77525e9b4f5fc83b4674944ff0f94627a4940d9d
SHA512 a420d98ed22e6bb0a05ad28c7265de65e0bd84fd0aef27028d1cb8e3c075a65be42096c96b979d5ab92501c243939334e88ec26f642c12511907a94a970839ec
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdNj:A3mnXoZjzyacNVOI/7PYaiOLHdfNj
TLSH
T1BB059D03E7A500E5E126C234D9E14616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 839KB
SHA256 b2abe443f841caf345ee03060a269aea8851a061834aecdf0d690d5bd12e1417
MD5 ab650eb1e0ded50ca36c63e063bc4afe
SHA1 f7f104af68b8a367265e3ecc7078b780069a2774
SHA512 03255a3b4eeff3c61858a0be0ed29099cbf331a503895ad5fbd930f39ad53a755004850ab7071f04737c664ef32eea388d11c5b3b19843226ba05373a0a10ef5
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdUg:A3mnXoZjzyacNVOI/7PYaiOLHdfUg
TLSH
T1FE059D03E7A500E5E026C23499E54616FBB5BC522760DBDF636882152F72BD0BF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 839KB
SHA256 b8a41eb19ff3b5ff8997f33536f341e392c51819d36ade643f00bab21f05684b
MD5 8008e8037348c89167ee842246e11796
SHA1 bb4b8d8ce27fa5cb6f2bd0be59d7c75840d89df6
SHA512 dcdd8e570170ba71ee32901f3ecb00072bec92a299985826b46fdc26f5cebc8e09152bf93c0332fcafbf337b8e44d3783234e7a06f5c3bc9e57cfeed89543dbc
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdLI:A3mnXoZjzyacNVOI/7PYaiOLHdfLI
TLSH
T120059D03E7A500E5E126C234D9D54616FBB5BC522760DBDF236882152F72BD0AF3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 839KB
SHA256 3691706cc1fa525afbff31769cdedb5709f2fd80314d7219f46c069a5e947584
MD5 a50c43a3b8a7abe0c76f6c914849830d
SHA1 94ccfb9e45234778e0eb403c54022f988f3f4a06
SHA512 ef3d56e47cc5e94e6579a8accde4f449248fa0da061337a2583e350300524bd1c3bc05460db449a554b51cc4dab1657f03f43ccbb11ba7f48a84b48039c977d7
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdho:A3mnXoZjzyacNVOI/7PYaiOLHdfho
TLSH
T1C6059D03E7A500E5E127C23499E14616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 839KB
SHA256 889420cef4ae0fe4dd7a086ca223528e5707892f4f7f647bb03d7d3b6a2c5702
MD5 40a822a72e5b0d5d9bda880c7a766510
SHA1 563b41df281a84fc239b70c3c9294cd918120a59
SHA512 7da3092ec5e1d764322c5fbf59a5ac8a30611b2a97b7cdf4ae9e2b3650297302a32322a861ae11450d7cbfcc03a4eb9350417dcad2196a0edd892d2bbbc15831
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdy+:A3mnXoZjzyacNVOI/7PYaiOLHdfy+
TLSH
T18C059D03E7A500E5E127C23499E54616FBB5BC522760DBDF236882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 839KB
SHA256 f1eabad7d8cf3521d69aaa0925599d935bd9944c7891134a5bb879376f083bd8
MD5 6498323b295c744135672443ee40d143
SHA1 49d5ccf29687999051074d491132e0ad7f4b07b1
SHA512 a0b9f6c91f50819e2adf41aa7d5375241c4d9594ed1e4a3f5bea85c0941b583e590f0f648fc14f7b5a76c7a25192f03d43814b244449431befc9f44b44771370
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdyQ:A3mnXoZjzyacNVOI/7PYaiOLHdfyQ
TLSH
T135059D03E7A500E5E027C23499E54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 839KB
SHA256 83ea9e711e3514812649603081454aec3cdad7bdc0c0cbd3dbd2b1432859cc98
MD5 e2409cf4dd86450f10475d423211e6f4
SHA1 edba3d440647a74013e57166011dd8e5841a13f3
SHA512 8e207d84b4d120a7679f8b1dca42e8408b5644b776bd5a3b6b2877a503184a69477e1da5bc2d3c6001ece951f3b0370dd58813efa217d6ab8f1ee03bfe4e51c2
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdTX:A3mnXoZjzyacNVOI/7PYaiOLHdfTX
TLSH
T179059E03E7A500E5E127C23499D54612FBB5BC522760DBDF636882152F72BD0AF3EBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 839KB
SHA256 09a97ffb2ffc2b1caaf17e14e68722ba63c62ba7893a020d94ef930c82f6a3f6
MD5 8d853c50718ba8eeae2f596b9e9b221b
SHA1 ecafe7f9ba3aaa05aab02a9f5e223e5193176c4d
SHA512 70ce7b43cbd0f4f30ce4b61732d8dccea97d078b6b1342640c59e10d98590dab12eceb1828f11808f1aa32372945c2100d77af046695bcb92202618d23d703ec
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdBL:A3mnXoZjzyacNVOI/7PYaiOLHdfBL
TLSH
T1E3059D03E7A500E5E027C23499E54616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 839KB
SHA256 06186673fb8bce5c3cb271be7d6432895a722f7674bd993c3aa3759b187af92d
MD5 a42b680165e5671086f3012b0ba4b556
SHA1 195abd467d99c2e4733468c0bb3e8d23bbad997d
SHA512 5585b03a5c22e5ce6c40ff4ade0e803be2076726d29990594a32d3d71666b6046695cc9718e8bef49258a4da777732e410a496d6629abbb539b16e5a964cd20a
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdPFC:A3mnXoZjzyacNVOI/7PYaiOLHdfPM
TLSH
T171059D03E7A500E5E027C23499E54616FBB5BC522760DBDF236882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 839KB
SHA256 bdb3d90792980a6be335ea62fa2dac30000c8dbbeb1214a505a3c73aef6fb5ac
MD5 d3e2fc9ec143bd016bcd5b024bdd651a
SHA1 3b3e0f8e27c10cb1c95a6b7c19a80d0d0966e2ea
SHA512 18f39fc3da2afff5f6354c5366cb62a782d7a824c1fa98162f6217994bf8335540ca72477c122ecd826e7953dd9efd79d6dfc2fc3f73dc7f3f4ebe334f4bdc20
SSDEEP 12288:A3ZUnXoZ+yPz5L8acNVOIHf7PYaiOknc3/BHdBdYh:A3mnXoZjzyacNVOI/7PYaiOLHdfYh
TLSH
T1B0059D03E7A500E5E127C23499E14616FBB5BC522760DBDF636882152F72BD0AF3DBA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-203-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4116-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4116-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads