9cb3a53f0f7bb3d5fa70f3cbcb24b099234cfc030ee6cf78e033bc6f6effd2fd

Analysis

max time kernel
100s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 879KB
Sample260810-xa6ptaaa46
SHA256 9cb3a53f0f7bb3d5fa70f3cbcb24b099234cfc030ee6cf78e033bc6f6effd2fd
MD5 63a90c059b2e4e3882cfaac71e249c07
SHA1 11a4fd297735383bdc38fc178928538d4e328c56
SHA512 cae18d66db624d5435bc42d90fb4707f258cf059de78ee27ebf62d098311f2b47bd2068bb54eff31c668dd28c60f1e957c83371b222d847f14e505fa0488b323
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKo:A3kMm56rl
TLSH
T1F7157C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1996-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c523-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e5-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1996-94-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4956-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-556.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-637.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c523-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e5-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019840-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-489.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a52-556.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-605.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-637.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1080.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1129.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4956	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1996	2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4956	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_63a90c059b2e4e3882cfaac71e249c07_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1996

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 879KB
SHA256 9cb3a53f0f7bb3d5fa70f3cbcb24b099234cfc030ee6cf78e033bc6f6effd2fd
MD5 63a90c059b2e4e3882cfaac71e249c07
SHA1 11a4fd297735383bdc38fc178928538d4e328c56
SHA512 cae18d66db624d5435bc42d90fb4707f258cf059de78ee27ebf62d098311f2b47bd2068bb54eff31c668dd28c60f1e957c83371b222d847f14e505fa0488b323
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKo:A3kMm56rl
TLSH
T1F7157C03A6940FE5D11F813499A64A62E7737C125F6087DF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 e8b9e56dfb3c40f452e2215af2fefe67854e1527a5933c10b73d4ad70268921a
MD5 a9b5321d582caeba7067dade9169ab0d
SHA1 e4cc35a8c73303385c7fbd8f3e518c4555ca1e12
SHA512 6c317a23ba7f4d732404bc3d83c019fd4dc6fbe526a46b1591ae355fdbffe26040d50c1c91483761a31b64e264716ab640ad0fc4523eeabc69c6a67c86379009
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKw0Le5ji0hmxNrM:A3kMm56rhPji0Aj
TLSH
T153655A16F6A44BA5D02BC178C5D2569AEA733C425F308BCB13549E283F237D19A3A773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 894KB
SHA256 0cd2530ff30d244425614248a8e9f248e9786e549574cb3d1d1b56ec1a53b401
MD5 584dd04d713ba60ffb1acc32333c2769
SHA1 b3858e42431fdd5c95e3c1b0d0efa3203a06da7f
SHA512 a8677ae6cb53b8bc505bd7a98a933685195be193b23fbef73ba3c5dd604a8f45add83d29c22795b521dcd3eb57fde4bf4a1808ea775f542c1ccd5148ba315561
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKKa:A3kMm56r
TLSH
T177157C03A6940FE5E11F813499A64662E7737C125F6087DF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 903KB
SHA256 f17406df35bcc4e78e22251048fa6c4e8828fe6e8c3d1d3233fc5fe0eb6e6072
MD5 7c17434f165377bdfa03a2cf927484a1
SHA1 460f470bb88614709f9aeede9112a2176cc0eacf
SHA512 2ddacd76e568f3c69587984e7454f74123c72bc62d1b9bc912c0ff5efdaaa43d6248aa0ffc1d01c85af72661a9c9cad3be5addf63c2c1beec8b1b109689ae370
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoK76:A3kMm56rt
TLSH
T176157C03A6940FE5D11F813499A54662EB737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 903KB
SHA256 66beb9c424fc769abd042082762d07d958a20862b0cdc7cfc532211bc3d45895
MD5 d93eddfdbff09fd5872bb90c5088e34c
SHA1 497012166656a56b5bcfbbb0819415b5f64814eb
SHA512 60a6b4274bab5ed42e7c0456b6e3ebf4237f8e65865ba596b00ee379a6e08a44ebc7f1c93b541d59bfcddf9ed590ac4c4dabdc5c613faf69e8d3b5d2e770be5a
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKlN:A3kMm56rM
TLSH
T188157C03A6940FE5D11F813499964662EB737C125F6087DF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 903KB
SHA256 ae8953fc0aa04c448357c0ce231a958c36e72df7c92521d2165fdeb4d86ac319
MD5 82a0804ae09ba2f1e822de35f4b5d254
SHA1 ce0dca3c9ea1a3db72171ef4cdfbce1ff9f6f3c8
SHA512 2b0daa584c3c52d39fd0e1ec0d2513e43d398dd5b9dc65d20617b8ac3688fe819c7dc1fc5082515ee90401747b32ad8260d5abd7645f7f3de5bd0fd944ef0ea2
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKjf:A3kMm56rs
TLSH
T16C157C03A6940FE5D11F813499954662EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 903KB
SHA256 e702d8a9fa353e2851591338610413782bbc2fe327ba74fd0fda249308f1d15a
MD5 7a1a5a7062a6512184f43026ef344095
SHA1 26dfcefae5cc2bd0ae3e666eec0096f726334371
SHA512 47267ca709e01f5df5296fb18c0b0c7e9e28dd2e3a5981fed739c685370026034e2626d703c5d318c16b2fe24ba1ba903552ddfea27f5e24b96650c56338798f
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoK1o:A3kMm56rh
TLSH
T1A9157C03A6940FE5D11F813499964662EB737C125F6087DF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 903KB
SHA256 b85435d51c5ef7744a0dcc8a78eabfc1bb7a7dc4c6d36bc059c8f41a936b4999
MD5 81ecc1b587de33f6f96c74ad56f9171e
SHA1 602f6c33d8e090545885e11a20253d3a17d4c2bf
SHA512 c3299711deac5541aabed211f70fa56edab8a9a12d4edfb3a58e587c1dd213190b9b473c4f50a978c141b34f46fd03e56ac0e7f72ff46c3b3546b7243186e81d
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoK1u:A3kMm56rz
TLSH
T174157C03A6940FE5D11F813499A54662EB737C125F6087DF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 903KB
SHA256 e5af3a8e05b69a07dc15b2ffe0629a6117a51b546e6fecb9ef98cc643366eb30
MD5 79f9e6158b2d7525f67f19220ffb2ba3
SHA1 13ecafa355a246e09265501e1d9c4a8331894010
SHA512 c77dab7a403d6349bc60174e311c2a319c76628ee82085363a8619a5c963e2d5a4c1b37fbf232c8c4cef93d005feab98fb2674d234b1631705b118cdd57ab355
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKr9:A3kMm56ry
TLSH
T180157C03A6940FE5D11F813499A64662EB737C125F6087DF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 903KB
SHA256 2f73b039ba3ceb65b532bd494e1aeca1ed61601afd37b11718b7d1f5eef51b41
MD5 3a79eca2db6bd67cdaa9861a40f71247
SHA1 f7b4af730906f448778e899ae1749b2d56fbaaba
SHA512 b484c66e9ac58e4e07ff26c12c8506ada65dff014a724ef221aeacc1c587e0eba99c8b85177c5f29fc35802c5e96d39db90c66515f917c7462e1c4fa26909b37
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoK3c:A3kMm56rf
TLSH
T1B1158C03A6940FE5D11F813499A64662E7737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 903KB
SHA256 04bba4e8ee9bd7a1ee9fb2e56021a761aa2e06ff57826ccdc81c8b7003e049df
MD5 9bf65130e6973c667f91d0eaa17ee5a7
SHA1 cc229ecf991df69b1079be3d21f39d8b50483a1b
SHA512 80ba51997725fc877b900e968a484b62fef4a6395dbe13b53ef2c64ec416143362158f50f16c12ab87914d35af33d82f1e311ffcb184f5b79866279dfd92b436
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKAp:A3kMm56r1
TLSH
T185157C03A6940FE5D11F813499964662EB737C125F6087DF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 903KB
SHA256 ddb9e8ef262bae21acfc0244ea6f6311b2fca423638818a2302a5d7e3f088d36
MD5 4dac0114c41f7ac410b1e3505b5bd68f
SHA1 640472438091779e1a6432d54f89cc8a25add106
SHA512 43de8379c8597f90296ae5092c9a67a8026afe7caff50e800a3828eedb60ee68c5c740924f1993d3b92485fd056b37f32af5280ba4e1b6df9015a92191d3b1a3
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKHN:A3kMm56rO
TLSH
T166157C03A6940FE5D11F813499954662EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 903KB
SHA256 11e395609e803cb13b1d721fe05b564df1dc371764f2d635cf3c3b79d137e47a
MD5 1f0a01d14ea311c4b665505fbb524a52
SHA1 a9741c509406c3b6c39c3fffab1090b2fa546286
SHA512 1362762e3c1d0d8099df133f872dc1ee5a3537fe04aab93dce5b4003a09d96096fc0bd6d50ba98844fd05074d5133b68b97ca423974ff9205f3a6507a4ba23a0
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKlF:A3kMm56rM
TLSH
T1E7157C03A6940FE5D11F813499964662E7737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 903KB
SHA256 199f925a50d250bbe03ff181990aefbfc0261458eb062461d22a4582f5fffcdb
MD5 775a2ce221bf99beee6ba9125fe68ff9
SHA1 6927ef02f63dfb7897a7d4b5e4b86fa3bb68be57
SHA512 e6bb01c6c7806d63f016543c1477c88b1cec098282ca8562ef9f39535e79b62611d84cb39d45b125a862342366337cf5dffa53baae1f527adb7599b861a71668
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKGC:A3kMm56rY
TLSH
T184158C03A6940FE5D11F813499964662EB737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 903KB
SHA256 79e2e9c2fc9188e2be899799baf6ecf12af24e7e2eb77816b3736ce327079016
MD5 33050c2feb1cc6c1b19152a1f4776d77
SHA1 1b10f465e1d53563bc4c14206cf9e3c0963d78d7
SHA512 0ee133755bcee364dffc87eb54dd5cd6f4280c4ce654c3437be1cc01974996a686061b7eb12e055715ab0f09f291ca04c2c0789ec4fbcd1938fa43b7a979c4f2
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKJw:A3kMm56r1
TLSH
T1E4157C03A6940FE5D11F813499964662EB737C125F6087DF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 903KB
SHA256 4dda9fefa5bbe3940e519e11ef1fe2c23a02c032fa9c2f0e0a7b36c31bcbf10a
MD5 fa62234f720d4b46591a0741bd4b55f7
SHA1 52e477477a83624d85d1f0bfddf0d4bf90e02a8a
SHA512 66f79401f4b54e561cce10988344cdf38882803cacefab86fab6556e10280f3af83002b4d617f222d9572f5ee0b5806437a551043bdcd4fa5ff8f0312242cb8d
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKQT:A3kMm56rp
TLSH
T1EF158C03A6940FE5D11F813499954662EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 903KB
SHA256 d9918b864a39ce937e318bfb41ffe36dc3e43188ea98c41f64729ba6b4249ed6
MD5 5378f1115384d8c9403a61019ba14a8a
SHA1 b24bfb8d45547556445e2d6866efa5b56029609a
SHA512 902f28227a7062da19b4fe71372925b5cb98100fc8270d4817b6b6b059de403e4f15b227534fff503a0012f6d393aa6f47723d38d67f410f48cefdd23dda1292
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoK8u:A3kMm56ru
TLSH
T1EF157C03A6940FE5D11F813499964662EB737C125F6087DF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 903KB
SHA256 458b8a46eae16fdaaa49872936b6cd84b9ab0025efcedf73778eb4382bd129ce
MD5 2675a92bb188ad8c601c3cc476d9b619
SHA1 fbdd4b8d2886258e1d3f75e07081f3760e747115
SHA512 39e5233a9ba55682015787b891ba2b20324264617581f2bfa1915ff53abafef7992b5d8a857d097eb1f36d71b7e298d646e6f228701df2f1c954bf8faa6ab53b
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKab:A3kMm56rv
TLSH
T103157C03A6940FE5D11F813499A54662EB737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 903KB
SHA256 d6cfbb2b2ec24bd02688ffbe75173b12713bf1d7d3c9b5a17c55b66f6a8605c2
MD5 268c675a0330b46a80973e2a7f54bcc5
SHA1 dfc2c99754d4e8a737338fd4ae9259d1fff8e2d9
SHA512 7efb79a0b240b2c7fe51a39b2c7416aa35c4e5d74dfd4373fc2c6ec67e46fbc9b35b8b57746b0c8a141cc311be146344ecefa5347a7f6644dd61a7f86550ca6c
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKcf:A3kMm56rn
TLSH
T148157C03A6940FE5D11F813499A54662EB737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 903KB
SHA256 b894a4fea8bc92bdc32544b76b6fa3340b0fb72e0c8d51943efd40b95c24f5b4
MD5 80ef0a282d23e6ec6cda6233fc15304b
SHA1 010da286e78c555a6612bda867c590be0c107a41
SHA512 07997a9a22d16ed7b11fa253662be630c46d30162108ab2cce176b7d2b4d7a873e1ccb8324c73870b75e9ccaba457af25bf44c6acede07dfa4267aebf3eb3515
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoK5K:A3kMm56rn
TLSH
T1BA158C03A6940FE5D11F813499954662EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 903KB
SHA256 ba1195bb1a5a914693740349135f3784788a7465fe5bcb196ee37860bdd7bbcf
MD5 dbb7aaf72a164fe844ba7cc854233e69
SHA1 8493bf508910bd17525d7480c6edde94fdccd15b
SHA512 559d8a812bf9c99f480c94cc33d0a9bf43694a7b58e745a297fdfc5f90fd4b3f9e731c6508c75d290ddf0e27e5d6f12208bce5636cd7b2e5f7d32cbe71cb0fa7
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKik:A3kMm56rC
TLSH
T1E9157C03A6940FE5D11F813499964662EB737C125F6087DF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 903KB
SHA256 2e0bcc7b5fb0208563adb272e1321c8c135c8ba23a03f468380febb20606f18b
MD5 30a17c93df8a7b982fd33cce9f8da330
SHA1 9fdcfa6408a6bff9e9a8491b58b4c0678ca8feac
SHA512 14a09ab6f6ceefec0568590e4c483a5051a713b0717ea04eab6d789c7547c3373ea95734b380faa9a79e471571ce49db4ba22f1419a8b8630117512e43bf6930
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoK30:A3kMm56rn
TLSH
T10C157C03A6940FE5D11F813499964662EB737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 903KB
SHA256 8e15e9413dde0a307306a0863e544d16127f00ce2c68b6a1818835f1c3ceaea7
MD5 d9e0493804a131f3d018c378cc352d21
SHA1 a8d967ffcf719b663c346135194e316f9a1bed02
SHA512 7045a6a3b52963bf5309d4481efe4b4362c24b33f9f4a082e1295e17167ebc4e9069ad96619548816b4ba9f94e5cd03a18f32ef3f08d3a741d2a3e0b7b9a7302
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKmg:A3kMm56ra
TLSH
T1E7157C03A6940FE5D11F813499A64662EB737C125F6087DF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 903KB
SHA256 05755acad6bb511d3d9a63716730b70b189dfb6c1f6ad8587afad7bdd2403d0d
MD5 ba1b6423a47d4a4be5fe60d95f64aa89
SHA1 c1386bbb6b7053f2c699c5044d447d77faa96247
SHA512 9d930c59de64ba67b3420569354678aeaa7d1472b2a1f4dc1649147567222dfee6bf48825fedccebabc24226d68727be6789bb45fbd13e9566b3a862d32317e8
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKvr:A3kMm56rk
TLSH
T11A157C03A6940FE5D11F813499A64662E7737C125F6087DF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 903KB
SHA256 12a9b171506bcb34f3db18184626a17eebdcec3345cd8c0f37a051454ee49115
MD5 ab9c5cc8122abf03328337c9f8dd930b
SHA1 1021f6c96717986862f940996dbf6825ccf8a656
SHA512 7d071ce42ea733c1421e77625b8f74917c7ead01ba60ca592bf74923ce9ffc1c9ef3344b5850e195b7955ebe47545b567417241351205f1928166c6dc2b73889
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoK5n:A3kMm56r+
TLSH
T127157C03A6940FE5D11F813499A64662EB737C125F6087DF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 903KB
SHA256 d3db2cb474eac7d4852a291afba5f558989210d188c1ced914f8b5517669166f
MD5 94da28527e3e2e4317c29175fedcc174
SHA1 3074477a72ae6c2d68543087cec6b24eea7103fa
SHA512 55c1fba6afad0ab7a5cd0dfa3f2c5aa3c9f7b22950e9739155f56feada93e7e3dc32b53bae1a9f8a57e9f8c0eba4c9ac2c24c3c080eeb4cdae83efd5bb1e73d9
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKVx:A3kMm56rk
TLSH
T147157C03A6940FE5D11F813499964662EB737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 903KB
SHA256 45eeb94944fb0414dc70970009ad1f94f4ff733e6f2d587000481f51b2de3db0
MD5 f81ecf239d102edaf03f9e0f4674c25e
SHA1 d38cd94761448946286a6ac19525c1df0efd406f
SHA512 300b0a4c057bb9ab1977917bce594c9c67003dba7d13230631ff3b4201645dcc87d99ce26c95533a5a24e702b4170b7de4876df4a0e6bee23f40e2ec586aab4b
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKLA:A3kMm56rP
TLSH
T1F6157C03A6940FE5D11F813499A64662E7737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 903KB
SHA256 5e9e66059633305ed373f7844a279d183ef02d59ee7d21178a1125a1cf4f80d6
MD5 81948f5862c8dc44afdc0b022d674ac5
SHA1 9dca016fcdab628b563b7a023183877cf44d8239
SHA512 abfdf4c327f963c6fed1eccfefda182207db8381b34618701444621ec779a8304b54a9eacff63910fd6e372aeb361bdb2f06b9f11e208523f30b34ec639047e2
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKc9Q:A3kMm56rC
TLSH
T16A158C03A6940FE5D11F813499964662EB737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 903KB
SHA256 03458839a3d4d00613c549623e6b44c0f5f71767ff07fd03553024828c55f92f
MD5 e4a24f25d4a12f65b6518410b43e784a
SHA1 c882d1ae52a8575cb6bfafa0f6751960c13cac2a
SHA512 ca98887979488aa96538f27289cd3f36a803d6ae8732531d6001975d96bf5c67399bc227e4cc224152ccd30560889209e417e722b236248382dc42d5f8897090
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKF4:A3kMm56rx
TLSH
T137157C03A6940FE5D11F813499A54662EB737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 903KB
SHA256 810980380271b68e5f8e577f5a3117ff61840c768832a3ed9ec6f31b2a893d1f
MD5 97aa02a0d621799600d06d717bcfae7f
SHA1 3b2b49e074e9747784ce14a3c956ac839cb897a0
SHA512 aa1c82eab3c940117f907106debd32bdf5f0b0b3b2c562f590bfa8634119f6d7aa8ce280a6db456fa7f43dd5504309a68159ef22072528957da2268929278f4f
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKQu:A3kMm56rM
TLSH
T112157C03A6940FE5D11F813499954662EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 903KB
SHA256 60c71601dca2a41bb77da3fbd8b4ed48fdeb72b08f14a42ee9f8d2d1404e6538
MD5 d6e5c816f2a9201f1b5c4e2eeb4c9a24
SHA1 be14bd91bfe95480db23bd60072cb63fa9e6192e
SHA512 79ac7a51ec78f7a72e486c97d25e2841dd8b25d400f550b8dfc43b825a87950d3bedf2e196829132a7ccda21e450baad6b4b0c09591946d77c2877c1aa300441
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKRj:A3kMm56rO
TLSH
T168157C03A6940FE5D11F813499A64662E7737C125F6087DF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 903KB
SHA256 37dc41a6f7a4468ba280179cbb5a376d80004a7bdd1365ac24e74caf745f5888
MD5 e9e30de8f2cbafae87aaf4b0e10e36d3
SHA1 6911150818a5fc8bfa5f0a97d451b819654c48d6
SHA512 8de96b7bb6ff86cf48b41e3ff5952ea10cce8f6f9a43d7580781f022c639b6a8a6cc6fe79d73a8d0f74b2f0336b496eb235aabe1bc9b84c555f57d65e5e24f4d
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoK4g:A3kMm56rC
TLSH
T1A4157C03A6940FE5D11F813499A64662EB737C125F6087DF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 903KB
SHA256 436b5c4e06f3cd41a1ea9d6018e97ada361f2f79408dd30446c61abc53ddf0c4
MD5 82d2c53dcd8e9271a8bf90913896a2a0
SHA1 e07f33a816f7bac77c12bcc67cfe2a0b84d8b068
SHA512 e7824462135e0db9685232672009555fb5b1904c7b4e5c602db0cd47a38589f801bd7b0af42c7fc456ab79c05c02935e51da72705cf88624e87b0c39f3f7826b
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKXI:A3kMm56rz
TLSH
T1E2157C03A6940FE5D11F813499964662E7737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 903KB
SHA256 0350c6dbe97a7e68903a17b53f09e257342c23bc211f84ce5e2ca3d434d27d5c
MD5 f9ce93045c2ade90641e3e8da36a7b45
SHA1 9b0a9b96b740c8063cdf5ef3ef4b3481bef53c8a
SHA512 fbfe81d52aa6e2c861534e8233375afcf27bb3d1227b9f74154bdb8ded3f67d01c8ab600a218a5c059f73f2d02f47df70a04dd1f9e78d77c823cd727cb128328
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKdo:A3kMm56rN
TLSH
T1DC157C03A6940FE5D11F813499A54662EB737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 903KB
SHA256 71ae364536797d000b1ded29cff9438692f5320220a91cedc06c9d2785d2f648
MD5 534d68955e55509f59765a2576d74ec3
SHA1 de7bb3b107e6094e7d25f4e63002ed4dd400b8c2
SHA512 9648fc068c1e1e22e898666fc0c2fc5bb0090506d8a5776a5d4bb5a700bf10e0594651b7a801ba063350e05ee0a149a7dfcd9404dca1ad4ad2dc0ff05083b1c8
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKO+:A3kMm56ro
TLSH
T157157C03A6940FE5D11F813499A54662E7737C125F6087DF2364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 903KB
SHA256 5f2adaf9f09aedb8d918efe80e880700a0117b247584d1bb624dff0ac5f23283
MD5 65e897f9aa60a6c344ef36b2619ef1c4
SHA1 f42ed3d8ebbfceab3b665e70b8ab3d1797c70082
SHA512 1bd2a033c5c7789be37aa58de2c8dd2b34ea3bb812b7f200b478c4a316a67fd1378a2f8e3214768d1a2ce9e81a3a4b3bf1d1db800a111f6a6aea0a2bd8292267
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKOQ:A3kMm56ro
TLSH
T172157C03A6940FE5D11F813499A54662E7737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 903KB
SHA256 05ff98d3ecedd19bebbdc4c09a54376f03d0c0eaaeb7a36717fe51fc8ce3d1e7
MD5 abd9f639b170bce2aceb5e7cdd31e796
SHA1 0d822ffc07695d69a7685232395b09938f328e60
SHA512 248f5b4fad464fa38cd29e303726f0f0469ece86f7a4ab8a265d514ea7067d940276918fa7999125f328164599ecb35c9babba13832e039d233b3335919bf615
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKvX:A3kMm56rY
TLSH
T1DC158C03A6940FE5D11F813499954662EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 903KB
SHA256 10414fa65efe18ee54fb95b5a50185104a44b4d06ca5bc21b26b523c47f38f73
MD5 94359ddce3b02f812c5e22653335177e
SHA1 1cce2314ee125094facb4ed061ac6097587c17ee
SHA512 6a1fad09cf8478b65457989e7ad735072c9ff1ad157db886ef51013bb3bdc13137eb4acf2cdc460ba09f60b9ac3868146dc26250417a638b56a8301de1731fa3
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKlL:A3kMm56rq
TLSH
T1FA157C03A6940FE5D11F813499A64662EB737C125F6087DF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 903KB
SHA256 9407aced70fe57f61dd0eca6b9c38f0c5158232e1e074690c8cf74c48a55d7a7
MD5 2bc9f965dfaa5fb71ba99b8f54319ee6
SHA1 8c65b91d7df3765aef1c15ee30837be63a8a5b1d
SHA512 d9236fa51daca8212fed62de9a43ba30246754adaf7d9e63b1c7f70e7d4a1266483bbaf0fce05d7d477c0c3844d79d96e90b31e3861a95d1dd0ae729e71a4036
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKDM:A3kMm56rn
TLSH
T1AF157C03A6940FE5D11F813499954662EB737C125F6087DF2368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 903KB
SHA256 dd733a822fdcf66c93a08200b6f292346c55388293b6e1aa3a2844bcf7a6c631
MD5 bc8c0012bc0c6989035f3c53978736dd
SHA1 e2d1a9cd32e2e9ebb0b1444bb76a53af24209de3
SHA512 f56611338c3adbb029ca0cf2242c72588751725449ee513a3e5c366d896c22927f62c2c66d4f189716215f3b4e3a4a72fdf865e0889de8a9b762b592397c6442
SSDEEP 24576:A3mnXoZjzyaEFoe/YCD5TvinrmbotJMaWoKEh:A3kMm56rZ
TLSH
T1EF157C03A6940FE5D11F813499A64662EB737C125F6087DF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1996-94-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1996-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4956-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads