e1a71e8454c1d67d0688d34b9da7e25904cf47e2008cda7e9dfd2f1a62266491

Analysis

max time kernel
100s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 914KB
Sample260808-ct5lmsybna
SHA256 e1a71e8454c1d67d0688d34b9da7e25904cf47e2008cda7e9dfd2f1a62266491
MD5 f6e885ea906ca26495a007162c76dcf9
SHA1 2608da9436bd977095b52281e7b2f918c19e723f
SHA512 0c8694d655ed8772c4627b6a4f27cc5e5953c4faaca12b4ba7fbad484e304a63ed7f2fb7604f961db541a2f92c5d48971848c9b09c69f86701fdc953776dcb8a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYahXvMagsF:A3mnXoZjzyaEFyKUluzyAZYahXvMagsF
TLSH
T1F915AF03E7A410F5E56B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/6812-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c6ea-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6812-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2576-77-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-428.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-545.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-606.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b00000001c6ea-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-39.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-222.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-428.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-545.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-606.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-911.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1079.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1128.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1147.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1385.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2576	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6812	2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
2576	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f6e885ea906ca26495a007162c76dcf9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6812

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 914KB
SHA256 e1a71e8454c1d67d0688d34b9da7e25904cf47e2008cda7e9dfd2f1a62266491
MD5 f6e885ea906ca26495a007162c76dcf9
SHA1 2608da9436bd977095b52281e7b2f918c19e723f
SHA512 0c8694d655ed8772c4627b6a4f27cc5e5953c4faaca12b4ba7fbad484e304a63ed7f2fb7604f961db541a2f92c5d48971848c9b09c69f86701fdc953776dcb8a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYahXvMagsF:A3mnXoZjzyaEFyKUluzyAZYahXvMagsF
TLSH
T1F915AF03E7A410F5E56B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 396f0a19b8a7495dca72a393d738de2cad0c11b189bde44dee35dfcde41f6d17
MD5 f686baeababb91c35089969292d0b589
SHA1 ada65565312e4d371693bc06142d14b0225dac00
SHA512 0d7e06ebdbc79f54a4e60df5ba6c8773b56ce8209fd281be20d902a49cc92cb907c003e1bfb0d8cdb332686cac85d7f047db2b2c07298349929bed5910cb1bbe
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsB0Le5ji0hmxNrM:A3kMjKJ/Pji0Aj
TLSH
T182657B17F6A402B5E077C174C9E2965AEB7138921B308ACF1399C7292F237D19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 928KB
SHA256 93aafef15151c88bd55319bf97c0b444d4f9b2c7b9a9e89e92688a5e10728aa9
MD5 a142d11b1468fbe9a25fd85ca8dca51e
SHA1 bcad9e2cce41e31b711a608dd02b0a1c009c92d7
SHA512 294e03356c683875573171b5246e8e121a674f09f272146cc4963a61f3ac66bf5764030e59b762f00846bc75d11550e9442abde058c2b9c03326a6e086305f1a
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsDa:A3kMjKJ
TLSH
T148159F03E7A410F5E56B823499E54A12FB75BD621B60C6DF236882252F337C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 937KB
SHA256 a060d370feca174d0eba97d23aa02d458c2c08ce68b675a90f42329dd79cefc4
MD5 c97652033f2efa8d544322b8a2d3b517
SHA1 3ac56088bb19535af9a77fc31bccb999843800ed
SHA512 4f69f4aa3cd9db403d12d394ce61ccc8b01ad8c4cd5eaf05ed02591dd448bd32b86beab4480ea1c2803fc3457bcfa2d5b073df95452c5b447203afd4a3c33204
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsi6:A3kMjKJH
TLSH
T11115AF03E7A410F5E51B823499E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 937KB
SHA256 5afd0f6c32d149be533e7fa2b6af926b045a865f012c595c2cdb604572d5ed40
MD5 26a61d29b831a7cdc000d4f1d38d398d
SHA1 76307fec9182bdff2276388fceb8adfcfff1f2d1
SHA512 417bbd6d66ca05f1e463f589a59a7bea668c6472536ec3c5c85fc8c4700d4c0c709a1402263e1fd5d5a9379a5f0b445beaae3dd2c9b4284d692781f9e36283ec
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMags6N:A3kMjKJa
TLSH
T1F815AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 937KB
SHA256 2d85b6bc73d9fd901769e19649040887b227fa29b6f6c714f55ff3f4a3bf162a
MD5 4d96ec1dcf4abbfd2168be5289799a0d
SHA1 04d0e01e0331b3f4d24bc9d58df75faa0e836266
SHA512 88ac2445dbddf09ddb6ab440565c28f215aeebfb296d81f7ad838d146673922dd975d7f0ce50d678b5dc1e4eae7e818fb72f700e45a07b2f7f95ab6c7e375f62
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsgf:A3kMjKJW
TLSH
T1D315AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 937KB
SHA256 9d56264f5238b339777716db357cdc747dabb993bcd633c45776d9649bb99d35
MD5 91ca0be333a682d11e47f59965addfc6
SHA1 f8827bfe35db99b2ca2d9a8d3da0a7ff1ab53728
SHA512 4b331571223c4b2930cd0487a79fbb95630b3319b7e46571d7813d6e4f52de520117663d99692796a5888c54a1c3c9eb1d6b74dc1a40e2a098377ea99dbb4f30
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMags6o:A3kMjKJ3
TLSH
T1DD15AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 937KB
SHA256 25829e97ebfbc75264bd2bae1f0df5cfa34d4216e7fea775af95ef514ed1ceb4
MD5 c28f1eefdfb5c92fbdc931e6505cb064
SHA1 92a9b5ec1a1230f974f7f78cc10d6e8f96c2ff02
SHA512 6ebcba2b6e767a2bddb3fbf7745fea71f6b01ceda23df122fa330757fa4d441a8ead5c5e11611e3460386a277e2e6126d3ba5e94573667fa2da5787b4e8c2323
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsOu:A3kMjKJ5
TLSH
T1C115AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 937KB
SHA256 bf549f63ca6f71bdbee671047f0c9d0b965222e141330bb0435943b73fc17609
MD5 72a17fb79632ca55a29ffb3b103b9117
SHA1 e2081b77d0ae9a3c58ba0f4d3e86b7f3381a9cae
SHA512 cc5b3cc1a7d0cbdbf2e5b0c5deef7b3bfd4308c47ed80bda0a7538dfad36bb259b6ff88697459571d54eb0ce5a9f182839cd65aac7b885e949d485a09ee5e5fa
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsC9:A3kMjKJ0
TLSH
T14515AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 937KB
SHA256 ce6f55a889c4bd20363a8edab6f0defdce3c556ad1d181b76f550eacbdd4b0ff
MD5 9f3acf81a458207fefd21980f13b3870
SHA1 9c9a6e05e16e35c3e777a0174e39e0c24a411e3e
SHA512 8c6924996746d0359424ddf617b350ec9dae46de4c8afd8e794370f2ef12ba813d069a870e283af74ff040aef85e559562a976e7248e92d9ecde439356f141f6
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsCc:A3kMjKJd
TLSH
T15515AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 937KB
SHA256 e0fc8979c57e65e47dfe2abdd2aa898d350f9dc31e83d445e90569a097639e21
MD5 02c72d98c430bd1316823da1d4a36145
SHA1 bbe0ee25d12bc0efa2946f1e11b874342122530a
SHA512 3a58f68e2289fac5db72d884da408c0f40f7ccb51ccfe82f310cefe275c0a474e3b1dce75c49ac141ea7a1c563ef1e990ee1b1fb46048c2ae15b35a866e4e966
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsLp:A3kMjKJD
TLSH
T17B15AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 937KB
SHA256 16b3c8ed0fd438e717e026790ffa736f8c4b25c5889627f0f42f550afd1406e2
MD5 a828088ee9a1cca8ade0106bcd6cb56d
SHA1 275f686f0044abf50f4063bf1a8f849481042351
SHA512 83046724975935a52ba9e8df89121c0496c5fd3c728541d8115ea81ad1bd660ba294392182ee3baeb062c951fd0d8bb8eab49df61584dfe3ce2353d662473c2c
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagscN:A3kMjKJ4
TLSH
T1AD15AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 937KB
SHA256 e0573787bd3870e656c18e88956a18bd248f949e7fd6627d92a9d51dce6f18a4
MD5 f535b8ce5e04211288f01eb4a0773caf
SHA1 de746b0630cdefa97e543900af825591dc797d89
SHA512 5a41b94883927e2375301e0b97e1035e2579919a35cdffb53c84230426761732646c0cb6d0e0fcd009282261148d17a9a3358426f2b9c5f0b4960c520e8943ea
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsEF:A3kMjKJO
TLSH
T13915AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 937KB
SHA256 996a372f3940293c3ed27e3e93d44615163950289fec4d38afbb63136b199271
MD5 3484b8db97a62af289d43e125a0b312f
SHA1 47de6bfd1bef8950551ac57c8422390d810ac5a0
SHA512 feeb065ef36795e48a665942bad40e931381b4951f68e8db3bb344e80c7bf22e7189ccfc7e44cdf22e8fe6654fee32679b15e45996abf83943dbe952becf7e13
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagshC:A3kMjKJq
TLSH
T1B415AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 937KB
SHA256 282b55539fbaddb1905d0cd2fd9f7bd0bdab1754a8d493099816d7fe5327fc61
MD5 c2da5a5d1c13db1d27cdd815d60f4ab6
SHA1 2bf76618c44a0235ecd7cf4b1daf046d8b131ffb
SHA512 b31d885e982a86701cfc2a9de698c0f10a194df7ef93d38a2af02d499365b014b577b6ac6c27f607d94627b1258918e31107fe79bfea15d25bcee24a006f5c66
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsiw:A3kMjKJ/
TLSH
T12615AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 937KB
SHA256 d50b2653b813436e7112b0e19a7e7d2f52ebcec704c43800b70545f0dba834cd
MD5 7e67172cc1a65bf047881a23e10107ed
SHA1 749179ccff66a6c92e1aafe77020904946c4356b
SHA512 cd0891f362828a72bc36747b31f618ca0afcc2442eff3a5513f183534e9b7e6c28a9a5f97298c118a84d784e6ac220ce9d087278c6920e0f7a9924ad23eccfc3
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagspT:A3kMjKJb
TLSH
T15E15AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 937KB
SHA256 4077f4a9bc08033747de6979a35d3e0fb5aeaea1b3bdf4b227cfaa644b1b68fa
MD5 45215c41fac8d38b0a676eec792d5aa2
SHA1 5ed8c45826577d5bc72f4e0e592533f6bd138d32
SHA512 68f585d9c1ef342934c401a070f9f923819dd762c5f504fe0d20d9d078410e73f7399a677f0551b8450f03cb99316e50e7992ffca65b88c37e5209819a9dbcf4
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsHu:A3kMjKJc
TLSH
T16615AF03E7A410F9E55B823099E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 937KB
SHA256 1c0575181077f48e14a76844fda55be03d3c3677655510b134b6bcd29edda3ad
MD5 0e65e53b64b0c31802dff4f43726872b
SHA1 9ef806d6cc28bb179b7771aa18cc61f125edf9ab
SHA512 dd8210c25a5c24f8c69a6927e664c805570a4aa88cbb82be3d3df440ba488f5cc394b03ee3c509663a2d713c54cb125714af1602cff2e3c22446079be6da1dd0
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsbb:A3kMjKJ1
TLSH
T1D615AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 937KB
SHA256 24df744eef12bec999fe2973415b3d3e5e890bccf422d23c7b843fb42c78c48a
MD5 da7346e0cce2a88469cbcba000f2ae4e
SHA1 a8d7d5bf79170a0264fe15a4a56fd52ff019d96c
SHA512 1635a453182f8e269dd8c91af81a03b62ed35fedbe707bb6fb54350f27198a328305bda0bfab56ffcb3d038a9ce52aaf30e1cc493732d80d658f241cd4331cc4
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsvf:A3kMjKJ1
TLSH
T1F315AF03E7A410F5E51B823499E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 937KB
SHA256 838cc605cf7105564122e47a43c945b1c58b4341ba811259ae8bcdc2bcd91e82
MD5 8e200014a30eefe616d9954c59c4f4b9
SHA1 bea7226ff55ba047952a5d28fdc6a197e5e91f69
SHA512 a5acafb77856c3f7af0d1a0d214d5ae18bc24c0b26a045c6fbbc93f4176e70f91d9afd5c3d0a455413158dde644d73fc869021f3bc115a6924dffc0c16834dd1
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMags4K:A3kMjKJt
TLSH
T17315AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 937KB
SHA256 9e3546cb82f94ff36fae6466151f33369adc9b0b1875c6db3b898ade5c42422e
MD5 0a530e1c4b465b3c80947cfea458e83d
SHA1 e6a2c09bd1f8a0d20e0ae525cd81a64dd76c55f7
SHA512 8ac24f6c99e51e5c4f46c0d320154e332bc116bc21cecfe30552b7fda634fcd18f502ad057d4ee23fb15f3c755d5447f4577d380602244cf0f296fb6c46cce1f
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagslk:A3kMjKJE
TLSH
T19115AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 937KB
SHA256 417c3be6903538a3a9ee583e96204491dbd3cf1bd25b900b4f1010594b43ed84
MD5 2fadf5b5fc12200fddaf0ecb7ae762ae
SHA1 6376bcd027540d8f152317ed9438c6b9990f0b3e
SHA512 cfd65c319f3ee8b836acbb9aa9076eb7fdd72d3a677ffcdbbdd81a9ad08361ae6b19cd936dd668c4e950189df1bc949fd6b3e24ba856a4d4351814b307dd7d43
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMags60:A3kMjKJt
TLSH
T1AE15AF03E7A410F5E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 937KB
SHA256 52c3aeecdade3955fd201ba67cb2a8d1d1f2409b5d2b35b96dfa5d431f2c8e05
MD5 accaec1ddede2da98365626f77de98ba
SHA1 6a3863f8b6fd8ba0978345cf1daa685fa66a99fc
SHA512 17565382e4c883676ac1648cf667bf88675ecff27476be797e09d2fbe2172e46589de855d74ae6f299440444da0cf8b4fe990b127f33bb2afdd9bb88eb476676
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagspg:A3kMjKJc
TLSH
T15615AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 937KB
SHA256 c21c04c25c8af797e3cf124953f01a4e74815babff5a8df443544d478a869e99
MD5 17c88d03a25d45516ce8afed39213af4
SHA1 5775de9628c84ba81cf80b4bd5c60dd23be8b724
SHA512 a7534f7ed101a5c3c5eb5d228bdc54cbca5f209b389af22aa9e88fda4aaca9d9a429fe59f066037b6f1ec65bc2bb73eda413136f6e680de8bfb5a037a9bf8f1e
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsQr:A3kMjKJu
TLSH
T1E015AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 937KB
SHA256 c044de67ef8b6f7832af6bd8ff1fc28684f807b5924a63cbac24f71e0f796a74
MD5 169a1327a2bb52823b1182438495d870
SHA1 e11e05eb6e93d0aeeb1cd6295849dd718f2d30ec
SHA512 f6f28c7d0648f5d225d88d6ff931de2f1573825cc4fdaccc4c51f9817a9ce0c05f627169da1005da920c717859d04f01fc4fdee7931f1f213f2b3bfd3d278851
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsOn:A3kMjKJY
TLSH
T12C15AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 937KB
SHA256 32d5290ea57367ba78f28a3689bb60a4c380a65c646ddc7fe11095a50089480c
MD5 a0afd012d49ccf129572044634317060
SHA1 aa7a0be19dc450bf6c595ac1d0654ac6ee32ff97
SHA512 cf8d86cc6df352e9371f8a4ba3c590fb687b468ed62355e9941bd1de606d2971165bd512c31503026057974e09841cecc2ab86b1a186e2b866852ede82b84e1a
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsEx:A3kMjKJO
TLSH
T17D15AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 937KB
SHA256 73d56f002583bdbf5b302b3b7ecafce5a127dedaf73fac46ddab33fb602bfbe4
MD5 3626f2f7026ee4d3b2048836876e93c0
SHA1 8897699a38a512e6cbd8429370f8589dc081952b
SHA512 0bd7624f14090d891882f902a0b39da64874004763e3f6494f38eb93c964847ce4150ae74cf0602d391bda3e22d6186da92fd68c2e5ab001d909a893a2e02fc3
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsOA:A3kMjKJF
TLSH
T1D915AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 937KB
SHA256 153ee5ea17a6ae250ff0af5520ab7479983193f34c7d3c38b2e072a3246e2bed
MD5 624794a1facdf02110153e7ca71c35d0
SHA1 f7d3a751666a26bb85ed79a6ed38bffa6ef7d68a
SHA512 6e578e4111fbe84045e75dc4acc4fe169feec5cf6067b63d12255c87c591b1a7a9e7481191fb972192834f4743d226b892595bfd1ad3ecd562baaa2d4a7e4272
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsH9Q:A3kMjKJk
TLSH
T10F15AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 937KB
SHA256 e6e1df54d297e0a1412577639d91fc53d477efe9fd14d647f959419ff2b9d85c
MD5 aa544cdc1a6632cc2b9fd918dd304699
SHA1 901818ce2fd72d0bc86627369147bd8d58b2b040
SHA512 1450148808184a020d802403bf929fa653eb0f1882a9e1170e5b933cee6c48a6b7848e782d9b2a42a41f085c6896968d1915cec3d71223973d3a840e790c6a70
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsO4:A3kMjKJP
TLSH
T12215AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 937KB
SHA256 a952e13bc874d24d1bc77015b6110e8350e752d00feed7137fd5abc94593bf11
MD5 5d85bf47c29f0922e87ca6bb057def08
SHA1 107485cf421be408e0e59fbe517c427fa1b36e3f
SHA512 5776ee33b5af98a814d56038c37bbf039e94435c47df60c05f0ffd5c262972c40aee0d309ff82ea332b7834ae9c63afdb7c91d7223fe04a77fcbbd471ef34d2a
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagstu:A3kMjKJC
TLSH
T1EC15AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 937KB
SHA256 b98301b92376a9b90a3a980294c294c0f764e08570be246f85b0b4eb2368def0
MD5 cde50adf7588d9e533325d24f5d4a6d4
SHA1 41491f112f5a7a2169d11cad2bc730b7c12a71d3
SHA512 719424ca384466669db22ecc39f450cc47d6742acba9c36ed4d4ec64cbe711d59bb527c1334f1535af0acee0c791ddf76878dc4527b602854211117e3ec3277a
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsgj:A3kMjKJc
TLSH
T18715AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 937KB
SHA256 0060abdd31b52691e680c80149d01b9ba23662e30b69bf0b3febe0cd455510d1
MD5 c4a89f8deeadadd56af7b98825585118
SHA1 8a3508b0d3f535cca53611bbc94349720a299244
SHA512 be857268bdf148ec9d1a033a2a0c00a13a1903072b1346588044e1d490021d2b34c2a116b5b1a02f203f79dd539c247cff92d79b6574b5e19ec6dfb22befa712
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsRg:A3kMjKJU
TLSH
T1D615AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 937KB
SHA256 26a3d8f467964589514d9ffaa61d4ce0fb87b5c79913e7869757cf4d87c41fa5
MD5 8a1fa0b4a0d97a5fd6188282ffacbfa2
SHA1 7893fce7d5c782466c1e446bbf56e343eea012b4
SHA512 c5f3bbc77ddf0fe9b5fd3f9c0c2cbace15f8953b4a99d48f390abc5dd5f7dd9863886c74029b778ed50706075358cb06423084474742a50f3bc48a9c2048ec3a
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsII:A3kMjKJd
TLSH
T19E15AF03E7A410F9E55B823099E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 937KB
SHA256 a8843544db86b905b9a904bf22a94ff1723f8f17da090bfd2f105d3582450fe7
MD5 d0d3329a788b0dcda158a2cdeba82c3a
SHA1 ecc31d9de7ac2a023099fb6b69f93e46a858a8a7
SHA512 4fb4d9fe5cf04e197c060d57fd437160169895bd56798323ef291f36c0f7f4dcd8986e03d003403dcc9da2d93e60b0da8b4218e5068d43d81b114492e97f0512
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsqo:A3kMjKJ7
TLSH
T1A615AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 937KB
SHA256 4f62c6854c629591e06a7a010470b5d9d21b781345979df6ff20059ba3fc920c
MD5 da9c2ed048ff6720a4404ebd7e9276ee
SHA1 23524fcda6fbf8485240053c722e32e84b06a086
SHA512 8aecbe5fba1e07e7ef3b1bb79cd7cfbaac6502880eecb0ec664458926af7f2fc8215d7a25816e64de60776ea74e78bcc33b1312a771a7fa1b34d8b10c061632d
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsB+:A3kMjKJe
TLSH
T10D15AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 937KB
SHA256 6bd937fd6f56a41861a72ccf4bbc0b5f0e8a33b999036f495256334f923a564d
MD5 55639da5f5ee0ee9d18eba7d6690cbaa
SHA1 262f0c1f53618c7b7aacdfa897b7cab28ea39920
SHA512 b5d6a2da5c6e3803bfd6fe04af9cb8358e166c67dadf28cbbd9b3bbdf4131fdff28f494699e6cb32804e18fb5b5e2b485aa810dd757b2f7ca8f4a91160ca2727
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsPQ:A3kMjKJK
TLSH
T18B15AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 937KB
SHA256 cd42690e5f27d381ba3ba3114cc257a34e3f6d86898d833a81cbd4b2acc360a5
MD5 0ba2eec6460cf17abb6a05d3915cf7ec
SHA1 edac3916dd97641726b7f9da588a37788c1b8235
SHA512 2222c0d111a169f378bbe9fa6772aab8e4625bedd67c4994df4b5cb8327481e37e4fe6f4129ac2631d8c976a3e54ba274ca5a64b0a56a487d8b694424934ab95
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsUX:A3kMjKJa
TLSH
T12615AF03E7A410F5E51B823499E54A12FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 937KB
SHA256 20ed7fa461d59553e28ee57eeea7227c3c9d91997bef5c2bfd37fac14baf51a4
MD5 7d53d9be3244ed23350d4b5031cebd24
SHA1 4a530a66e93da53bf4ddc919025ad995b9a92f5f
SHA512 7ae396945b212fbe195fa69a3c014e5a98b55d4f687a8645c93f042eac3ac3637491146a1069a9c5c2c5e76500df85c4997629fccb51b0d0a1935b4f6326d1c5
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsyL:A3kMjKJ0
TLSH
T1A115AF03E7A410F9E55B823499E54612FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 937KB
SHA256 f36ce69db58741fa2bb1f50845e10a90343e6b1fdeb721ef824ae88493d25627
MD5 81683f3243b6cea70735737b752c3985
SHA1 bf533ae05fefc28dcc04c77fc85230cdc8086781
SHA512 e8e8cbe1d170ed8ed345d2db6d60c631a7074b38ba51e8837948d45c731b049611124287c7b7d6d1d4a28106fbd3e619ec308deb8db0b6567d2c64f03343ba99
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsWM:A3kMjKJV
TLSH
T1B315AF03E7A410F5E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 937KB
SHA256 467c98f86135d6c8a6b2a51ff6e3af98919fc56d8bbcad3624e6f18d1d0c2248
MD5 c65ce199dd9b16f1739666422ad599c5
SHA1 f7c245d2d4d14ca3e6c73eddcaacce6c95a3f9fb
SHA512 958dc4774e67fbd702808d9386964f5f3cc6b451ea463e79803650165a1404d5f7a843cc3b1db24ddc75da426be3662120f63714bc65db0646ee9d8ef29c9082
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvMagsfh:A3kMjKJv
TLSH
T10515AF03E7A410F5E55B823499E54A12FB75BD621B60C7DF236882252F237C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-77-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6812-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6812-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads