b9ab8ef07a342538eb4c1ed87bdd0bc0a926a6c0964987e73e8d0fe0f3a76377

Analysis

max time kernel
95s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Size 939KB
Sample260802-1ff8wsxwhy
SHA256 b9ab8ef07a342538eb4c1ed87bdd0bc0a926a6c0964987e73e8d0fe0f3a76377
MD5 85e35f1f6771c3f74ee8c4312b0d6589
SHA1 3706b04bc555d3eb7d0db7cb477f841311546671
SHA512 f38424edb841c44c3db2a8d28b0deb7b6ba1db319e44225872684da2acebbad3ba8c4abe00e590cda13ea6e3415c4d992793cf6a3af45c39786fab67064c2ba4
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yC:A3kqPji0AjT
TLSH
T114156B16F6B44371D073C0B9C5E2A69AEA71348217308ACB4395D7283F67BE6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3460-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001b840-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000016cd1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3460-76-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5160-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a57-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-698.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-974.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1097.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000800000001b840-5.dat	aspack_v212_v242
behavioral2/files/0x0006000000016cd1-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a57-222.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-698.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-974.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1097.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1319.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5160	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{78329DD2-943A-47BA-B763-81DEA89FE76C}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3460	2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
5160	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_85e35f1f6771c3f74ee8c4312b0d6589_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3460

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 b9ab8ef07a342538eb4c1ed87bdd0bc0a926a6c0964987e73e8d0fe0f3a76377
MD5 85e35f1f6771c3f74ee8c4312b0d6589
SHA1 3706b04bc555d3eb7d0db7cb477f841311546671
SHA512 f38424edb841c44c3db2a8d28b0deb7b6ba1db319e44225872684da2acebbad3ba8c4abe00e590cda13ea6e3415c4d992793cf6a3af45c39786fab67064c2ba4
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yC:A3kqPji0AjT
TLSH
T114156B16F6B44371D073C0B9C5E2A69AEA71348217308ACB4395D7283F67BE6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 a6a7789d0f0e2b76fb61373edc902d41c7f4ce46208c1833975931e10d02336c
MD5 c23e0ba222db524cb7ae0d49fc85b3ab
SHA1 a88669db1b45e712f5b62ec7bd4cb241b13f63b3
SHA512 8a7e9f7a26cfa87a9b3129c6868e9e51a795dc6714b84d47fb73ab009a5b00e06547312ef96b944b3d85d0af1caa8666e8f590c340cf70b9efdb8cf8a61178d9
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yC0Le5ji0hmxNrM:A3kqPji0AjPPji0Aj
TLSH
T13E653A16F6B44371D073C0B9C5D2A69AEA7134821B308ACB4395D76C3F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 953KB
SHA256 d44f2a8ea91ec8a62d2d7d1b8368eb361637ee033aa7d7de06bf3878657d92fb
MD5 2513a7984c98fcc2486ee365f92a5710
SHA1 ce561a57457533fdc3cd66bc444f35218f2192c0
SHA512 703f9ad4ec1bd11614947695e0a239b3329cc6f668a4102321840973d7d768fda457cca1a9b4a93bb4af898e33dd63b0f70235f934188bc6df1ef39d678690d1
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yMa:A3kqPji0Aj
TLSH
T1F9256B16F6B44371D073C0B9C5E2A69AEA7138421B308ACB4395D7683F67BE1D63A331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 962KB
SHA256 6c9b34693e1d0d2bf4c2edb3f5a4850b685bdd03ce5c22e5e053a7f8f9221025
MD5 3c5dde01d9ad02ecc068e064ced845f7
SHA1 d61123b17525a7b28984c87091f080022e895dc0
SHA512 bd8a99fce221fce7e514655df9c63ad2143abba87e5a471f8d2014b011b1cf7f7f206770a7de5ca55242c0adf22d6e33f40a3a720a361557c13e7b393463fd6b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yl6:A3kqPji0AjX
TLSH
T1ED256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 962KB
SHA256 9648c1805d5236fba6010fed8dc04cac5aa5a2ffbb2b35a89da6e1277325dcfc
MD5 e439d3d8d29a37b1dc4987bb511685fa
SHA1 c5cef7d60fe4ffc957bbd783b69f54735099feb2
SHA512 de51ebdfc16f0db31c197492550316001921a42c23def181255ffdb6af1d6672a5e92c6bf471c75d1e6ed198cddbe9a882921ccf6f49f5d8e9796d50fa09809b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83y7N:A3kqPji0Ajq
TLSH
T105256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 962KB
SHA256 81c987ac8b3b5d385f868b4727421842a019b0866b8c349cfd7c223589b48169
MD5 c75cbcd3661e911c38fd6a0ac4c088a7
SHA1 acf69e3d9fe804b672d99f5035a22e6f953be552
SHA512 79f477285fd59fdc1cfdb1d688d10868df58ef28f5455aa99003af81c4883aaca052477a1df323b439f9b14da6232cf140a978e6d7cc8c51c0d0e35b5dc5386d
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yZf:A3kqPji0AjG
TLSH
T1ED256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 962KB
SHA256 b63f736d0c4c9d748e41055074dced3817ce3cd5d43d50e32a16c37c2a7e0191
MD5 8dedf5e334242eff9b3fb58b4f60436b
SHA1 4dc696d366fe59e71ff0197c9626e3bd4d1795d5
SHA512 fd0f34935de8acef4b5e33f272d55e1331048f2dbc46314255d773d7197050643d162e9544996f558e1d454825a9f184f58f1cc679e5d4778f675d483b2bd139
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83ybo:A3kqPji0Ajn
TLSH
T134256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 962KB
SHA256 bc109172b57ce142072ba99cf77d2b590e5a7c604231bd329cce623414e6036b
MD5 51661921e1c594ce208b551e36f001a6
SHA1 100d40643167fbedcd8f288badc0d5e1597e612a
SHA512 8048aa364886e9ad2e66da6dfb299db284d657abfc562314a2905405223e51a2f89e607d1c7fd1696a8e5458d475108cdd0df21f7e704673ec74eed13d13d464
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yPu:A3kqPji0AjJ
TLSH
T135256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 962KB
SHA256 d293db3fc6a3eae359f603a94058bebb514f30d0f1e2088815972835b7134e22
MD5 443d3547b8a8379d3f1530dc42454ed7
SHA1 9fff41073afaba3aceef8421bc7a6c71d8f43c2f
SHA512 b24c3d739a9beabe3f9afb60b6cf77a9e4d58af890a9f5f54d2e89b4ba747532d49315afa327c04c1fd74c9662003e00f025b916c6d8b5b4026343538d4fe852
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yd9:A3kqPji0Ajk
TLSH
T1EA256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 962KB
SHA256 0a558bf081e705a4e660ccf9763db78edd0db03a32115368e78fae803cd13739
MD5 5f838854f4b6ef9617518518fb3c39f8
SHA1 07f181845b9b7ede2588b383742bb72f4e1fbc98
SHA512 a3970d3573f21f10a43014e25bba4e48610bdec59b3e9f2aebe7c1453ede940b2b41ac81b4566fcfeb14ea1b2d46583ac10c44ca43ed751f070d928f59d73ea2
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83y5c:A3kqPji0AjN
TLSH
T1BB256B16F6B44371D073C0B9C5E2A69AEE7134421B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 962KB
SHA256 aafc16c5d74a6dc7869e77bb1e913c979d74da334bd3e17ac2f9a2ab0bdb35e2
MD5 5708977f90c77aea3ae1aa73bd5bf3e5
SHA1 5c1449375c0c25701b7b6bd587b6719f269fbb28
SHA512 ebb2473de5a60236ff62d98bdab16a9a08cd9ce57206e55222b997de994f8c4969c176fdb8e97734f9191f635fb527b85915e76e80da4e3f95a42388cc955579
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yyp:A3kqPji0AjT
TLSH
T199256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 962KB
SHA256 d04513a1e852400f29fd058be3b9c2e7a75a538405334d0585e67ac811256a32
MD5 0bdeeb5a08aaf4455d7c640d19f381e8
SHA1 f659cc5a31fbdfb402537f163076d85f9aeed6f7
SHA512 b75b169e3042b854cc21b3ebaa89b69872577416fbe7216fd6530d300a6907f6ebefc358550344b8c7f926a492d37670e156891f8afd83f968a54279fc56a263
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yFN:A3kqPji0Ajo
TLSH
T177256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 962KB
SHA256 630e29fe6902b8dcd4a5b696d4e2bd652165f912514730e191e78fdc3e2ef875
MD5 1dce6ad12225bf2fecfed6005143f6e3
SHA1 e173cd9b2ff8480fd7dbfc2825d3f4400012b983
SHA512 6429982676058b8e5aaa091c0aad7f00c9fb48239edd448a8598e42b5754c181c03d6bbdd7419b9690ce64030bca6bab1d300afd1d3917e2595462045b6bd826
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yXF:A3kqPji0Aj+
TLSH
T1A7256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 962KB
SHA256 54271945cfbed4edfa3ef8f2a30574b37b7cb8ad869bb765b35afca42b4934ae
MD5 f6b3107606cd0976fca6d25a5e5e4cc2
SHA1 d4a2c172be541fe738e8e8c67a468b22991407ad
SHA512 dd33a53861c499b851a7348a2b0a037ad7233ed5d658c96b44c166e49779727c6612d0c574229c05a721eef6cad7f37f6a323b2330e72bca410e847f036d3438
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yoC:A3kqPji0Aja
TLSH
T119256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 962KB
SHA256 d68806e6a42119163e3764a5c5b2ce4e3f8bb6cde20c56549bb33d53279537c6
MD5 07a83e913df905feddeb1c8e2ed71a81
SHA1 502a8a43a4294e74010d181021ab6615b70540d2
SHA512 25d60e2be712d613a0868dd6540976d6e2b7d882e8330561c3199fbcd9883b1042e64829bf265e6a8f5bb37f4c9a483fd61454e744779b6434c75b66eb500684
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83y7w:A3kqPji0Ajv
TLSH
T139256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 962KB
SHA256 ee9f065b2d2e01dc17cbde4adf3a5e6a434cec5106ba65bcd91bdb4cdf8ca2d8
MD5 7d8d90570611e991258b215da72a1893
SHA1 86fd27abfad2c6c1c79f27910b25d9b7da252104
SHA512 67b14420680ad179aeeff99d3c9aee49a6469aa21f20756308d50a8072099549162aab57ce98977386a385f03b2193c97cbc32f902b5e80c75a5d8ddaf640cbd
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yCT:A3kqPji0AjL
TLSH
T161256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 962KB
SHA256 34953754024c3d586bc9b363e4c2a636c0adeae81210f6257a0140a6d24ad9b8
MD5 dd5fe5bcb575d89d3c2ff43660c0e09b
SHA1 42ed0b13e78d78b0ce7bea451c9967328d656d29
SHA512 58198d5caa7913e0e83e4e190c35d58dbf02004541ae8a00e23b979d804e394c23b0acd0b1f99c0189e12527799a34620e47655304cad25de78be20713040c4e
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83ySu:A3kqPji0AjM
TLSH
T18F256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 962KB
SHA256 54fbabc155333ba73d166af2ecd4f14331a59321cfac2eb92af69c8d57365837
MD5 626f8cfe0e4c601aeca3b6a353e319a8
SHA1 7c71f109c85870756c69b0ff5a9bd46998adedf6
SHA512 da693e95370b0b26d4aa701e5c5c6a2c35fb968beb45033bfa33ff0dc952bc668614ad6a5613ca2a4a8f5fb631a506c6aa9c299c0dd25f963e1668e8da91172e
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yMb:A3kqPji0Ajl
TLSH
T127256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 962KB
SHA256 ceda8f9f55ac2d3f2566a80a51af772c2702d2346ef4eee4baed705ce303ea1d
MD5 858a9cf5d3a41352dbd6d887ceab5a18
SHA1 c4d964949df523f42e009846cffdb05d952d1d7e
SHA512 b5d79e8e72ee8ad40e379ccdbdd3a08a00fe45e6ce5b5e8a68854738b80b2374b541a94dd39b95832788c5cf100287e75d027182ad2513abdd4c1358f6156bb1
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yyf:A3kqPji0Ajl
TLSH
T17B256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 962KB
SHA256 059ded8fd81a1ade23fbda7a7bb738320dd3745ed8b753a2e29c3d604db1728c
MD5 080abe183dc49ac1c14ccdaa05fba8f9
SHA1 f9631c4c1c4da993e7ace4efb6e7c1735012edf6
SHA512 1d2037b7147da1d52b4a85fb5473c7472b7b4f4ea3da44567cc0bc467ba7372e81b3b479a603e310430f1235afd1baa0e625b4ffc25014bb9c9a4543ffc03b42
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yfK:A3kqPji0Ajd
TLSH
T164256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 962KB
SHA256 327a9bc99aa1797b79cf5028f151fcf961bade0de03c1990223d8054e446f4fd
MD5 571c33689f9c11ea5b62380654b7bbc5
SHA1 ce8a3c3c38bc6c486d083b40e859b71885697f65
SHA512 03fc3960c6aa448e784da5279a941f79fabd374e0c8039cba4cb04c144d81de00d9453d88d9866fb545e9e701039e08a47185a90787f09e03f159db94dfdff3d
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83y4k:A3kqPji0Aj0
TLSH
T142256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 962KB
SHA256 c1c58d984f852cf645613f9f7c88acbb7b47c1d07bf3d740c6152694506af96e
MD5 0d8e1ed529b47b5145b717910f95b75f
SHA1 01b7fa5781208f35e8d9b15ad1f7a748ba85a2ef
SHA512 d0da8c86b44f41c6831f700b357a311bcab08ae8a1a7f3b21c22cc9405daddd13d7ad31fdeef4e17ca039dd14b568f4ec01a8aeb2e330219173054a97c85ba36
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83y50:A3kqPji0Aj9
TLSH
T184256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 962KB
SHA256 29d9503fefdb03531c9285eac149857e60dc6b0b881f0f5f71c2b9fa013bc1d3
MD5 d06710b0bee1abddb3ffd22b96e63f0a
SHA1 24ddcadb1cfa33b698950c52c048aaf17d2f0082
SHA512 26f7c927da1e1af04c4bb22500df58685e0f94c1ed5ef3c5238193ebd531f1dcef6d9a25fb81f1f5a7c4f65b87e6e3779c6287e731f9ad47906d9f9ef081847d
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83ysg:A3kqPji0AjM
TLSH
T160256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 962KB
SHA256 a0bb71f8996d89af0f73bd60873f7533f08513df5db2b1bae7e68a342cfaad0d
MD5 5cc41355076344eb01a23d8b93fc486a
SHA1 e362336f49b4e6fd972aba4cd0dcce3fb193a5c3
SHA512 16ddd1d7febabd383a43e57b767b579b5114c71f2613a4aafad0cd73d070e17618ecc73f0c8b5e54a21576c0d1eb511b268b3aa44199bf85df6b53bfd3ee8c9b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yJr:A3kqPji0Aje
TLSH
T1F2256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 962KB
SHA256 8499d8cc25d5fbfa22b0595f0ac4c57732678bb0c342e5b0598ae231220e60aa
MD5 06294cd2090f8ea48d9a9a029d6717ad
SHA1 b7513e74afbf2903870512acf937d50a21c373c1
SHA512 30b4d00980fadb9d65c3b2d500b75d6c1486999ed06f3e6b4d01e0922f9eaa426ae23fa4dc33fc97884ef1739874f9d6f9c069832a1f23b6d9654b6bd0672022
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yrn:A3kqPji0Ajo
TLSH
T19B256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 962KB
SHA256 aa288a73d93fc9227f9646ed463ab76382b4abaa46ec002334deb976418c617e
MD5 f04960d79e325954427fe1eb674ceead
SHA1 e56a972fbfa7d742cf6d7a79b8cf4193cabeebc5
SHA512 aa5eb2ad43b2ec5acef8822389aefb39d44992ef9c50518ffba309b7d56197f983094284ccf6d71c70cf5ff12fc4086b28c5c36fcdcf14ce527eecd2a826a02b
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83y3x:A3kqPji0Aj+
TLSH
T16E256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 962KB
SHA256 55a7621c169c4275f4cef0c117b2086a268f8ca1275dab7bf6c530376d1503cc
MD5 6c3bf31101e315d1ff11d9cb8ca4f90c
SHA1 84597399ee2045433bf2d90ebacc729461418d86
SHA512 52684b9dd31839a50f7ed8f29a2fdf98b0a33688562a09186765014688cd1422fb1c808ae1d60f4af8dc933b95b85266172ad69fe81f77c01fe875817774074f
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83ytA:A3kqPji0Aj1
TLSH
T141256C16F6B44371D073C0B9C5E2A69AEE7134421B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 962KB
SHA256 aee95b20bf6def534bca3706489b63c6a4383428396e5b029b37ac365b6177bc
MD5 b8883b4843fc6b2b70567da2147a6deb
SHA1 272e81961e0b61b80b58c7138467d4777534a308
SHA512 8dc90d1598b6b52f61bfa8ff57ffb2092502be4e8ee400cc9e101aea89ead27d8930c1c6ef4a577cac66b7e50aa0d7fea856add57f8619e54729bbc9061207e6
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83ym9Q:A3kqPji0Aj0
TLSH
T12F256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 962KB
SHA256 b2e53815565a8fe2d651d9f01ec5c8ed53e87c5a6d089fa31a991df7e7f9a6d5
MD5 09efed3b6543a4029c9503a022583bdd
SHA1 1cda3439431a75d8fcc2595666ff6d9fc5396603
SHA512 50ce0b8df633fbfb30ec57df8acd42541ba19764934ac83ec447a3d03718722aaffd7515afd96f38e0cf810f5462da6c4a142e143010347d2214711be51cbaef
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yD4:A3kqPji0Aj/
TLSH
T1D5256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 962KB
SHA256 ca16d09219d8d9d56f17d530f8d843b460244ca22ae6fa09249751889c0e3042
MD5 bc563b29a9c7a9f76430cbe491996d23
SHA1 8159ab30dc9ad630fd46c140668a7eb461d26f47
SHA512 674872ff1a706dc18a9516e85031d5147deb0ac78747345784b18caa71941ddc46c56789b09922f13dea99b3077bfe2ad0d9f02d205b35a39b8e491933a78070
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yqu:A3kqPji0Ajy
TLSH
T1DC256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 962KB
SHA256 15a18009700de1fd204ab1dbf7d71b49d6f72d52687b5e5be56c234e9a58922c
MD5 82aa69a384fc6ff43f30454a0f6da334
SHA1 544ff49e5532909f81280ba45b6542f39b27e5c0
SHA512 d062b6b28fbda8812c932bd7c1720986941a4babea9321a922c0b850a2e29cc044ccc09c3d2966cf4a50bdd6465e6b3b58683219925501d536510dd14a40647f
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83y7j:A3kqPji0Ajs
TLSH
T112256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 962KB
SHA256 510a3107c78bac03010e67290e38f134b01eb27dffd309d35de1777b66875329
MD5 c687e2bd1ce317dd80cc97574dc21bae
SHA1 2a1a3afcb9cd05b722023ee9ae076c6e351ea49b
SHA512 9213946f9ebc5bef9600c5c189c3fafcfb6b936a7de2db1de60a0bc320ff12e4b0d450e4f3bb45f3bbef187f5ab32c47c0f21982deb50a563dbf6bf61ae07e7e
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yGg:A3kqPji0Ajk
TLSH
T16A256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 962KB
SHA256 2540ddb513135939e06324cafc1766db9862b5a9289e8825940e11dc5230b997
MD5 8010938f25fcdb8efbb2fcfd833b9ca6
SHA1 415529de573fc874906d7aea22bab43770bcaa66
SHA512 5c227a18b1b2dfe8d3d2716bc8e75e6053628c08df1591bbd84896d51997b1a9a05f552f82bdee4fefc2326cf60681f8d09ced14d9de172f7e8cb7ee2be9d1ae
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83ypI:A3kqPji0AjN
TLSH
T18B256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 962KB
SHA256 fa1b989172ad8e0c112075bfa92ea13626788d9e1a0f3d5cd4159fe31245f4cc
MD5 0f0687ac4594ebaca96a595c7d90b470
SHA1 c21abc3a7ef3ac8d9134775aa94084a84f22db6a
SHA512 1963e9dadcc73cf523465fd15d37cdae6f71bda92d6143897daccf0d4535734abaf1f869a771bbc4270b90351b78c374816f8d8b1eb63cbb9a4cd0c96509cf2e
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yLo:A3kqPji0Ajr
TLSH
T144256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 962KB
SHA256 68c74081a02671169351ed5c0748877496e064255ea8847f9f92e022f7f9fba1
MD5 2836e3e5021f7c5b522bf915236eba64
SHA1 97e052191dc4d8d67b9535f16c4d4c161fab13bc
SHA512 832ab97b991e34e77ed46e4a2ec76cf384a8526857a92cff882aa6991657efbb4a0ffe601a6a8595fb13a3c8da6aa683b88bd921c85e4e2fbbc216d62b587895
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yw+:A3kqPji0Aju
TLSH
T1CD256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB1395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 962KB
SHA256 cb97ea779c714980a0c3ca8a81258f139d5c039e435880399f8dada2a3dee4ba
MD5 9dbcb7d69395db7b3dc762b022459588
SHA1 3522ef40bd5657789a33b8b3fdc3424aecf3d1b6
SHA512 0ec0b60fa1623d3046cada780c58fa50171fc0b6a5787d7223ec495bf5dd539ba71010519074a1c787d09ab2e0277ad907bd4347c5f852eaa54642c87a1b1cfb
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yIQ:A3kqPji0Aja
TLSH
T192256C16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 962KB
SHA256 92fc49ca829f185ad3d8c7fc897d53628b77df5495e031d818d65cea9d471b19
MD5 3473a6c0434f07cf8d9d46411e09b638
SHA1 b292c432e217a9c9b2e67c7d091e8ebbf3280f8e
SHA512 b9cbf7d57aa0f08cacb1a5f663472a6fc87a0ec3829c4c90a86aa509e3a75efe620c33341365734d8e03f290e587a9f4802400923ae2ae7b412eda2b3ce32103
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yBX:A3kqPji0AjK
TLSH
T1FC256B16F6B44371D073C0B9C5D2A69AEE7134821B308ACB5395D7283F67BE2963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 962KB
SHA256 1c96aced9a215f055733868fac767dc778307b31d82f0e00bdc338a4b66d024a
MD5 629640f72767491689831f0503d494b7
SHA1 1efba54360e75d064271bf42810b04fe8718e872
SHA512 4bf6d0c35e35061761e3da43a2cd510ae6af24f98abe12b8980cb72e10645597c5098422e520d94fdb395445474f3ced8274afc5edc1162372e2750d96093c19
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83y7L:A3kqPji0Ajk
TLSH
T14E256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 962KB
SHA256 d8e115578db591283f18c1cf09a5a5aedbae2c99a868475215557968419ecbd1
MD5 83a0dc1fce859947f01141bc05cb8889
SHA1 4a51dcb261642a4545bf67bca6309b7a5ade6e09
SHA512 cd2db835883bf6ea8e587fb256ceb8bc62cdcd32dad9743900dad6209a8208ea7da2858081d596dd52287c65ac297001947b992f119fd5ffa6f12a835cb868ad
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yBM:A3kqPji0Ajl
TLSH
T132256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 962KB
SHA256 7f178c1af16c98632a9fb20e371d73151ae7e9badf277b54ecf469ad4791bc6e
MD5 cd9dd2a327317005773035cad431438f
SHA1 2b227878c79c787d4078394bd3f7e8a93d5402fb
SHA512 3f3a5a9a5ab3e9dfd190b058a570f735c1cc4c6b6659594d28195607e0e44dba6cdae3a245fbf15246588bdc09b3394a41e5c9c4af0defc8bc5359c3ef79fb82
SSDEEP 24576:A3mnXoZB0Le5ji0hmxNrMJaEoFpNa83yqh:A3kqPji0Aj/
TLSH
T1B1256B16F6B44371D073C0B9C5E2A69AEE7134821B308ACB5395D7283F67BE1963A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3460-76-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3460-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5160-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads