09d7f33f054341970e3ed89b13ceb63d8cbcee858da165b2e06f31ff0838a9b9

Analysis

max time kernel
97s
max time network
94s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 897KB
Sample260716-hy1fdaft4n
SHA256 09d7f33f054341970e3ed89b13ceb63d8cbcee858da165b2e06f31ff0838a9b9
MD5 0174440ae375e515fa99a1238c1ad83a
SHA1 12201cb57f7833dada79107795cc869b6d9c7e76
SHA512 b544f54bd5356d588c5190e5f8e1a777ba5e0fed236c5b4f77aa989823376da86b8a5c202ec1c1d000f4ab666597d1c94237b544450af2073b387b34d0f26593
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8SGoOaRaidm+:A3mnXoZjzyaEFyKUluzySGoOaRaidm+
TLSH
T12015AF03E7A410F5E56B823499E54A12FB75BC621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4148-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c68c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4148-160-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1960-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-434.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-538.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1092.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1313.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1332.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1352.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c68c-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-57.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-222.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-434.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-538.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-605.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1092.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1313.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1332.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1352.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1960	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{CDB16BBD-CB19-4D7F-84F7-16B278A1D844}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4148	2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
1960	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_0174440ae375e515fa99a1238c1ad83a_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4148

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 897KB
SHA256 09d7f33f054341970e3ed89b13ceb63d8cbcee858da165b2e06f31ff0838a9b9
MD5 0174440ae375e515fa99a1238c1ad83a
SHA1 12201cb57f7833dada79107795cc869b6d9c7e76
SHA512 b544f54bd5356d588c5190e5f8e1a777ba5e0fed236c5b4f77aa989823376da86b8a5c202ec1c1d000f4ab666597d1c94237b544450af2073b387b34d0f26593
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8SGoOaRaidm+:A3mnXoZjzyaEFyKUluzySGoOaRaidm+
TLSH
T12015AF03E7A410F5E56B823499E54A12FB75BC621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 fa044b036dcae299d7065ee8d10ef805721d5d4e28342e8057811de39ba4642f
MD5 2074f4bef03028854991178d49ee4e98
SHA1 9d6bce7ec56b5ffff36cee43d9cdc892ec282d86
SHA512 b0fa4b1c8dc4f809321437dfdb097cbc341ee6b200b35036d1a352c9e0e3943a312592d5be7683f6df2c2b563a5d4e97be5296590324f6193cfe03080922dd49
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+P0Le5ji0hmxNrM:A3kMjKJlPji0Aj
TLSH
T104657B17F6A442B5E077C178C9E29A5AEB7138521B308ACF1394C7692F237D19E3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 911KB
SHA256 d7766797ad0aadefab0224c41dddca668f3600579dd33522e4da886182337b85
MD5 af00d497d8fd4444354f3ae2a721a6ee
SHA1 77f97f5ca1ee6343476efdc6a757926862660ab5
SHA512 272e6d09abf3f2a12ecebcaac6b6e24d23b2cae846b38f09191ba467b38305fad90915d4551d12588d2c0e32bef9aafbe705d56b46e9f545ff5e2116191325b8
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+Ra:A3kMjKJ
TLSH
T1E115AF03E7A410F5E56B823099E54A12FB75BC621B60CBDF136896252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 920KB
SHA256 36ee1c84857207fc4664f455f5f7d7244ed0827ee044442b4355d2fef9e75df9
MD5 6f24ab0daf9304678159e9f4c83ab249
SHA1 47e229c8f12d18a54ecf020db894223c8b2248ac
SHA512 b16a32d189c16b57d53a2bb89f4975143903e9130041d40032f3f65d50088df432a2239ac41d8b5d370e9702ddb7bef7aba6e602fe50b2b5c7929b58f0f3856f
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+o6:A3kMjKJh
TLSH
T13D15AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 920KB
SHA256 ebf4a15af05cc2b16f829b3bb392c63530e8534136b6d57b850fa43f6eec4117
MD5 e2ff8d0d5a6b01af15229adbe0964151
SHA1 ca617414f8faf66474240d7511de163386125197
SHA512 aca2f22649d53187a3f5e6d136c9d523487e9be3105bec43f5771f1980c3e5ce83f304e856a91cc816b8fc91fce485fb275943c12254521dc8a0089d8fba9d96
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+sN:A3kMjKJ4
TLSH
T1EA15AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 920KB
SHA256 5a1b43a28a1522bdc9451fc72bbc66ba212d756396c00da6dbb0726e1ab3fa8a
MD5 024dcbadf8f96fdda3bb97c50b0e9404
SHA1 d9cb0aec9cbc9c59dd06e44b13ca787d5a2ff6ee
SHA512 3880956bdf9a84e334bdc05981ffb2a96fdebdbe6f29885b672b64df937a45f3389ce0cec1a63d29e85822a13729168e1e2c43b17d4e5f25a9c0802a03eaff6e
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+if:A3kMjKJw
TLSH
T17C15AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 920KB
SHA256 c5e52625564cb4eb0a44f62737ba524ff37a9b597e0e9da0d482492f15067218
MD5 db06ec7a5bcfae24755e84c1701cbf49
SHA1 326bf7d7d4a8e4177721d8a90527e5749cdab228
SHA512 ab6de41dc9d182eeaa17f9f1dc85da0c83a09dc1306f6639bac9f9958ee05b95c09d84bed3832fdd430593935a33945ed6c2f5516d09ae4f5507f666c6899612
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+8o:A3kMjKJ9
TLSH
T11415AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 920KB
SHA256 76988b95a1526bb195a9159f44a5ebd78534c5fcfca254709ab5b06503ef17dd
MD5 e651afb27f37e6f89cf6c3093dffb6f4
SHA1 589d09889b5d819ff5b3eb02ec4cdfe3477e0a7f
SHA512 29cdd6d53da0844343fe116fc74dec2e5b263b6730bd52b0b56ba328ac8945733e664183e5993dbf1f6396ae96f6013b76016ae908d724a82f68ae1fa2dfcc87
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+cu:A3kMjKJP
TLSH
T16D15AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 920KB
SHA256 16574b51407e2613168e076f4c42218503e1f756446ae0c2aa4d0daf6517bf32
MD5 f60cf3aa6e984a9592c14daeb2c1e77a
SHA1 213376abe8792b82b0a696338e0d4583a1029290
SHA512 540aa8c5f45301772a27b6db985e26f10a701fa878b45d27846e395008796cf7e16035ba2e065239806431ead6291325215d1f82736fd6f562c35b2b25c92c1c
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+g9:A3kMjKJu
TLSH
T11A15AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 920KB
SHA256 7a9fef9134dd0efc0829db6edd49085265d04536b5cc35f18aab61e6a989c3b0
MD5 84f0683648b2e878ae9f79ec4a274635
SHA1 453eb5561630c9c2592944069aeb5eb2219d9fd1
SHA512 a06902ba735c5847b90e92bc8cff211fc9641fbf897a6743d253388657b9d0edc8f0dca41e20878eb649865da9445f1269ace58360875ecb26350109ecdadaf7
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+oc:A3kMjKJD
TLSH
T14015AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136886252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 920KB
SHA256 c1281c51f1488397e7dcd59070131f1e389ff3b5a9e26e562243a7d6c48ff950
MD5 8e68286bdcd1cfd66c31ef37b6844e5c
SHA1 3d7edd55bb887ac4cc0cad875869085440c47670
SHA512 1fe689448e136ff63ad2128dcbbc0b05ba3f40655a379d3f6774e9e5033dcf6cb028781c14380699498e2e25a2f21aaaf08f56fe47a2726bed1ba7e8895e6b72
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+Bp:A3kMjKJB
TLSH
T19C15AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 920KB
SHA256 2802e77fcc64367a296a294b82b4d778847c2019d4ac20c902a19e809a903650
MD5 2b4b71c3ad1093f4765400df96f81ce1
SHA1 2290f6a6e2d593f63f3594a2bf10321fad82908b
SHA512 483d052346cea7f672e3980bf68373487cebc88263dbf520ab74abc77a9209119ed1f1aed67a2360aa3e7871425e9887f2c556b2e55a737afc84864bf57c81c6
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+WN:A3kMjKJa
TLSH
T1CB15AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 920KB
SHA256 9d86cbe61272708df9c4c54b36265293186ea9d43ee6aef21c3e2ed75ba20eed
MD5 25241a3d6e685979d31575fa68ce9c37
SHA1 3ea909aa544a9acee759b7245ae3045a03a20474
SHA512 5b5a5e51746fbde71c79dafc4c356a0dc2f633c1969d4c3a265f142951325c63b5529b9c8d49c6d48dd1073369fc494998f969a07999a013d7e9f875694ca55f
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+aF:A3kMjKJg
TLSH
T11B15AF03E7A410F5E56B823499E54A12FB75BC621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 920KB
SHA256 7b8c7fb6876fa194fc58413b753b89265ddc03caff73d7e1dfb242377e709366
MD5 382e3f9ec3d405e8376f52dfefd34d05
SHA1 29d20a5506e2d70583272afee269f23ac231b221
SHA512 9884b4146c0e2e8e552d98b58fefc58168dee0bc297df2b8971f118c6a450fc82801df0f0e8acc345495a63790fd749dcec6d3afb55d89f10be110c46153ea1d
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+vC:A3kMjKJ0
TLSH
T11715AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 920KB
SHA256 dfa1a5ed1ccb76c5da5c9a4414a90e3b33dc2f7bd845c0afc1f4cadf9ec20a71
MD5 47a9102423b479388a624075e90191ab
SHA1 24292fbbfd46d1cbe371e4e55b3ea7cc9cdb904a
SHA512 85401fb4f2e62d6c5bac77b34593420dd9d6bf4d77d56e9d6d1931f46befe13030a80ec857cc836121b0bd0c4da4eb2defc9691c36a04c3fcbf1b1983bfb3ef4
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+Qw:A3kMjKJJ
TLSH
T15C15AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 920KB
SHA256 11c6e1d25f5c4eab1c56bf07ff3ef9f97b868f3e6b25377e945f26b5355d36b9
MD5 d37fd0781b11ab18650009ec48b2ac8a
SHA1 f91d6610e878fa9038ebebb298ef2e884c31d9ec
SHA512 a08c35493f6b6995ceba5d083861d155b92d1cd52154415b3d6cc686e76043f430e69b85b287d8f68a33094a78d45662f362f64df54643c9f832684919bd3570
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+vT:A3kMjKJ9
TLSH
T15B15AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 920KB
SHA256 b2904b0fdc83e95d19305a6f5290c234d75533974441ceb3f2c3535885470583
MD5 aa9465b47d35f4642f47e74b03b4c444
SHA1 aa2f6d77403932e2512c3965ab612c35284b559f
SHA512 1b100dbae0a08eaa14e970871a26c84898eba60183f1c6028234fe7c10c862dc5214305bc2ec066c89ef922ef92f122c21264273d25be6ce288ed14f04c20f14
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+pu:A3kMjKJC
TLSH
T13715AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 920KB
SHA256 d7ce51c86fdd2731adc867af56fbb35d86b3abaf5d2d6b8ee84b1757ebb7bd7e
MD5 fb32ede14eee782ef5041506792a0cc0
SHA1 d03ea0fd855df25bd74100d5cc20f7d7ec83a20d
SHA512 fcfd7f5885c476daa29a2eb3b023087f8cab5324c83b7b6eb8f1f664f52798aeae35950906d760099d869885257d5179170e6618871cf875228ce680db2c0a90
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+hb:A3kMjKJz
TLSH
T18A15AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 920KB
SHA256 5f9dde6011acb1d1622b9ddab4d0da536ce0c0d23b4681076662aa8261ea9b83
MD5 ff21d3918b5849d4287b8f0f31937aa8
SHA1 7e221b0a287b4a773a9994852b975c1492a30500
SHA512 7a558427ef07e69c161526c98e3608ff96b2cbdb8e75a1749e568455059d3a1e93b026f02581f0cb14ab13ce221f26bbe5ac5f9bda88d764e52e52219d4eb120
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+pf:A3kMjKJr
TLSH
T1D615AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 920KB
SHA256 53718872328d08aeed02e3a6bb93644eca0668bf15afd0ecf0b832eaef9ddab9
MD5 33719f8c8ba9ab0a930390327d46b8a4
SHA1 dd99d59f06720496aca388a500dab8e345dd55c9
SHA512 587d7b0983e5f44661bfb4de89af8f9be530fe8dba411da372ef74ae0c8cf60f5f9af441bc1ea8750494e6da9340235b46266fe815cff8338e9764aa7ffcdbb1
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+SK:A3kMjKJb
TLSH
T10C15AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 920KB
SHA256 632848b9bb43cf9ea9fffd9be537a4a0f1f20a60d868266481839119458abad8
MD5 a2cd1b8982dc76a5fd9b24136be30396
SHA1 a779260f1b7b11a8c8c55c8f05e7713aa8880bab
SHA512 7349d81478d3b8dd58d52c10e2806eb4f4b8f2aec3f4001c61c74bdc43cc61b157702ea48d2ab4d72b0c47ed89fcf0cda29cd93219e47649131f04592eb1698b
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+3k:A3kMjKJW
TLSH
T1B015AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 920KB
SHA256 14ccf4222c784e3b681f73d835b9c428b30b8283b279e1198937929302f770d5
MD5 63c0ee746d3756b5de7d3db632ce30a7
SHA1 f2c8a103c4e9f3d0321f171b7e10b78c0e3f6a84
SHA512 df510a429fde4a0bb1f1feeead1fe2062643063c134e6a547ce2e57ad34e0da283291986458a0c91d3ea37f9abb85a8c2e6b44fe79a52a99b9d7a982c4697080
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+A0:A3kMjKJr
TLSH
T14A15AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136886252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 920KB
SHA256 520f77923fa44379ff295804bd73aed0c637bbeba76a04cb65f202fc0580d557
MD5 7f9cd501bd9cbf17b0e89b773ecf44da
SHA1 45a1c2d94421fbbeebb3c698bf2cc257c90fc07b
SHA512 88fce06cced3235236f9f6aec5b372d884f83c5173a961a85bcdd36dbfcc63a7151b276d04fdb3b31576536fc410596127532e14ae30cb05d43f1da51565d34e
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+bg:A3kMjKJe
TLSH
T11A15AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 920KB
SHA256 d3f74d581c9e65578213c40bd50b78a5c683e1c1b6b3965e81816776b177eeb3
MD5 7bac90dfbe8d11a854f0bf46057ccb46
SHA1 68250f5dc21e45f38906e885b3d0e20d93908fe6
SHA512 8872f3c55b6b7d3061e435b04d6f9ffc3bd1a008dd94b99c8fe5c7f6e9eed2c60ee9e45dd373c088a76ef804b41f5057126f817caf44ba3b62c855314baf631b
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+Wr:A3kMjKJg
TLSH
T1A115AF03E7A410F5E56B823499E54A12FB75BC621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 920KB
SHA256 af3116b977085438010604531f0dd75c7b777d705ad6ec9e7449ae8959810afd
MD5 7e64745a8a9e7596392c1368d87052b3
SHA1 1315e3936b2c8cce618f02ad8616667e6e16a559
SHA512 83a5d07ef376d5665500ad054329ba3a1e16cd3bc90e29f8618337c041d095fd9872c226951222143c5a152c3d89f745cfda26376bbd5d555b57abb08116d911
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+8n:A3kMjKJy
TLSH
T1CB15AF03E7A410F5E56B823499E54A12FB75BC621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 920KB
SHA256 a564f9dec11df24cfbe78716b313e05d8f9732564022d8720783fc8ac0778281
MD5 03963890ad10f40b1534ff10647302aa
SHA1 fe06c9086a18543776ee9c0e8ed8bcb77e700634
SHA512 bd817fb25a2fe988c1b3e098c2fac6b7358967a7079a9fb4a0627b45040335b7534789edc3d4ab80df4814f67a89bd550f789f7c464a246005466e8a08b2242f
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+6x:A3kMjKJA
TLSH
T16615AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 920KB
SHA256 3b7c07b9586a01e7464602bd1964304b831b219a42360234e7a59ea782c01c5b
MD5 917bd4344ca31a028581a9d772be9e2d
SHA1 0e5fd1319feb2397a43eef3c8b32917e4669672a
SHA512 f3a1a8d8f56823a9987fa5a0079607b71c600a908ecf91cf530c8c04ac9a6945793e9f71a5fc54c6695ca42c6ec1e7f04d4925fde40a2533d54eeb397dae7a58
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+8A:A3kMjKJj
TLSH
T19415AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 920KB
SHA256 662087d31562f708d99dc60ca5b55ac6998310caf5b1a9a51a70dff1afaf49aa
MD5 03b3f03e0966831e86d4960b19a92868
SHA1 00518565fc45365d1928af801de65ee9c939cf38
SHA512 9a6e013aeb372bb29c1d753886312bc1c3297c08826e8fe68420e3ab03c8477ec87722f20bca7590f54a882e9a40c12799e2154cc6061ac975ea4551203e7758
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+l9Q:A3kMjKJu
TLSH
T1DB15AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 920KB
SHA256 210b31b47fadecbaf316e48d67a0689d4d5d9078a2c042fe444abe2c97ba2304
MD5 205e50c123782c99a6812a2369fb05ac
SHA1 63ed5249a71f552349e3dd1139da280aa8c636a2
SHA512 152297adb47afb8bd6a73db9b5b8231242ec2e89bcfe4618525ca7f95eefa2586649e8f8190899db70e0d611b842a3116faff0cb6bac0337a8cb07875b59ce92
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+Q4:A3kMjKJN
TLSH
T15515AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 920KB
SHA256 89e0c2f7c39ebf407d80bfc772425d00f745c70e8d1120def5cdfa8bcce41746
MD5 26d6cac06229a791fc4aeccea8c75edd
SHA1 2d360af659e5287e40df1a6e7fdb745592659bed
SHA512 7a72eb2653e1e1f1a468307b41d4a17c89c59c4caed8984da7f5c6cf3d52b32cddbc33c55b1166b666cadaaf855ae0fbd91e04aeba48c628845dbe4c1e953587
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+Tu:A3kMjKJo
TLSH
T19D15AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 920KB
SHA256 deeb91ea57c39090a0d82cd0a3e5e3ec70269307a4b0ff95d5b2b08d21eb7c57
MD5 2b0fc6ec0219a6484e977ab59c4ac0f4
SHA1 264977e4f4d526bc935883f0610e3e3922e031f4
SHA512 24940b1fd51ea3b317e65c9419f68ead0b55759a2f3c5de67ba9412b17ae3af16b907a3934fe6c5b9369e789a02e2855eec860e056e1497f4d71108094de5cc9
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+Oj:A3kMjKJi
TLSH
T11D15AF03E7A410F5E56B823499E54A12FB75BC621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 920KB
SHA256 01871fda35e950f381bc391bb5255fb517d8b8f0a05f577b2f355ae813e8c169
MD5 1e8b6dcbcb490303ebea50f8ffa73d46
SHA1 e9a9c41edd028f39c3ab3d5729d2e26a448184b9
SHA512 b565dabb2e2e63bd0a752ece79ffeb2bebe7effe8a0b0314a1206dce556c3973c84afc6b07c50f9c6ddeb5e684cdfa6e9b448e1d28c871da3d1f1a74b107235f
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+7g:A3kMjKJm
TLSH
T1B715AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 920KB
SHA256 c7cb45722b30992b2af43b4340ad7190c9ea0a6fb5440ba999f68f24169d903f
MD5 cf9a664ed0abf1793b8080d9c01dc2c0
SHA1 9e0a727ea5265906ee2aa4a4a3787069dd7a5d14
SHA512 cc28f435574621fa8bcdb8aacd730aa2b61b8cc1043c61fad8949b3dc78e77f895eba78365daaab54d36113ff91425844a69f6c143dc644c65d2b9bdf6a64693
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+mI:A3kMjKJv
TLSH
T16615AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 920KB
SHA256 13879d0ded5ffe3b464b92546c4daa652d1ce66924d5f244898dfc11639a4cc2
MD5 2d27aec8c029f2288803d7f1c96f6bf8
SHA1 a7d8276fbe5c30ada44afaa1836988b7a7ef3d54
SHA512 8a38f72aac5ca9dab650eb108ff53dc34fafac3d10d129158cbfc295629370ea8d73a61e48fb9b8c87f51394b1c802b3d8f49187744f31bb54fadc4b83fb1863
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+Uo:A3kMjKJZ
TLSH
T11815AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 920KB
SHA256 7a1853b1e5507c6e575028fa8cece0f5d37d91b604b2ab4b12c69e42ee799da7
MD5 85bc7e3c1a2ca182441a8dffea0296aa
SHA1 b5817db8ffbce20f32d8fb7d8fc52ccfec0aeaa9
SHA512 2d83b9e71561a283de116231b1d8e4bda26f5e893a209d8a8ea04a94585e12af79f1c101ef8ae1cd0228de83500390de27d0cac838f3056c43bc10e54da38ab5
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+3+:A3kMjKJc
TLSH
T10C15AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 920KB
SHA256 3f2269c60636d814bc3a6f6327add70e631857c9010fbe0780e475bed9426f8d
MD5 1a87eb58f80b9d4af8e37f1ce34e40d6
SHA1 db151340620bc09135f26e592c5bfe95e7a48e1b
SHA512 2fceb3adcc4dcf8ea9b923448122f25be3f37c51ed5f5e2e89ce6a9609159e4a691230e6a4b2a3c1ffb1323ac57301becae2137bd3397822cb22fcdfb1e5b7e0
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+NQ:A3kMjKJ0
TLSH
T12915AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 920KB
SHA256 ae63cc0112ad4d5d963b889ea7804cb09b56decdacf78b125dff7994582e28d7
MD5 6a4826d1fe95545056ac2e7bc2cc4b9d
SHA1 47b436bca16460fbca159a735ffff169e177838d
SHA512 33ec053a8aabf583e44cc2c184c6ff3a69c38d5d013fcbd01e2b775332991091a02dd59add5d0bdf4f67beae5ac55912b686853b4e3304031f2ae7b246df6644
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+CX:A3kMjKJ0
TLSH
T19B15AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 920KB
SHA256 a096baaea051b80033fc47914b46734e6df3f9b4d2c51ca57033603285396852
MD5 96c27575bf73eabad6b7ec8992e35f86
SHA1 6501a933140af3694e97b2428610b109d125bfa9
SHA512 668705d3cd650f76d5c4757b229cf700c37c34ce643bcf646138ece9a982a1c98bc3c5c8bb01d92ce9ab19ec0c722dfa3de1bf04e390a0637f17336ce701b4a6
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+kL:A3kMjKJO
TLSH
T13615AF03E7A410F5E56B823499E54A12FB75BD621B60CBDF136882252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 920KB
SHA256 28853181049daa01d9623d8d1e2cdc3f32278de91337dca8e63f7b8ee8849bdf
MD5 abd89b71c49bd292e963718b71acfa5a
SHA1 3e8ce2a6be33be9ac0c2df7fad87892928b3c926
SHA512 2b0de5dcb6dc66b743e416696b9c19c7286521ec5bc2d29e2489263be639a0878038c16e432a5a92a1c2848ada153d9c317aedfa19050a332b18de31bd45c1a0
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+AM:A3kMjKJ7
TLSH
T1BA15AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 920KB
SHA256 9a6cfc623a3817f1cb0a5bf174f5923b52268c33ad62cef0ef858d3dea0f6856
MD5 62862a353686c1e8e4f3fcacc68f80c1
SHA1 31b5380aaf614e6a8e69b7258501f2a58cd74d5a
SHA512 37883e1a938606477b460fdfb009deab2a8b0f8246df7a3f623df6c98acc969ecedd61fbbf3b88dea10b86625b9f32716f3f965530df389e28ce4bae0c32b699
SSDEEP 24576:A3mnXoZjzyaEFyKUluzySGoOaRaidm+hh:A3kMjKJ1
TLSH
T10915AF03E7A410F5E56B823099E54A12FB75BD621B60CBDF136892252F337C0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1960-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4148-160-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4148-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads