316cbfad62ade0509f1a19a945a0c4605b8d541e0dcf7a863381e1ba103db2b6

Analysis

max time kernel
104s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 13:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Size 741KB
Sample260822-q962asfb95
SHA256 316cbfad62ade0509f1a19a945a0c4605b8d541e0dcf7a863381e1ba103db2b6
MD5 63cc08a28edc1ab2c6f44ce9656d2239
SHA1 b14ad967c9c3cd468062a264e50eb920ff3ffcf8
SHA512 a0dd582c49fbe3e5a2bc8907c6434e31fd5d917ab01c1cd5f9be77ab603bf6363a2331820b72e5275226f918fc975a0c176133047b3537f7baa6b58be3a2c94e
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9p:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9p
TLSH
T13CF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 48 IoCs

resource	yara_rule
behavioral2/memory/5588-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c540-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5588-40-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3184-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb5-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a83-208.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a86-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-276.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-445.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-532.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-606.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-631.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-722.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-899.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-957.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-958.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1013.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1056.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1143.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1189.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1227.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1349.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019929-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1408.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 45 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c540-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-39.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb5-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a83-208.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a86-257.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-276.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-445.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-495.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-532.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-606.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-631.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-722.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-741.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-790.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-803.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-846.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-871.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-878.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-897.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-899.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-913.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-932.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-957.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-958.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1013.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1056.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1081.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1130.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1143.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1174.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1182.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1189.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1227.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1330.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1349.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1374.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1381.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1388.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019929-1404.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1406.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1408.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3184	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5588	2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
3184	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_63cc08a28edc1ab2c6f44ce9656d2239_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5588

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 741KB
SHA256 316cbfad62ade0509f1a19a945a0c4605b8d541e0dcf7a863381e1ba103db2b6
MD5 63cc08a28edc1ab2c6f44ce9656d2239
SHA1 b14ad967c9c3cd468062a264e50eb920ff3ffcf8
SHA512 a0dd582c49fbe3e5a2bc8907c6434e31fd5d917ab01c1cd5f9be77ab603bf6363a2331820b72e5275226f918fc975a0c176133047b3537f7baa6b58be3a2c94e
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9p:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9p
TLSH
T13CF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 b0ef0df50bd19cfb6035760dc5fce2301fa6647601e42ee985f91a9e26c1b972
MD5 faeff2947af24386b57e577f784de716
SHA1 53c98ea6c5524357092242f6fd53be3f44f7fd76
SHA512 0eb1fe6bbbdd556019332915712f9912402344812478b0de5d4d880b0e1c710bc5bd4e267fa5287499ab7d00232a53c9e22ace89f0b92a637507f074db8d3b55
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9V0Le5ji0hmxNrM:A3IqJtb2ImPji0Aj
TLSH
T107551A25F6748731D073C0B9C5D2A69AEE7234825B308ACB1286D76C2F677E6C53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 755KB
SHA256 cfdaf11752a00c2e73f7ad47f66ae282492410badce005ecfc0156336ff42f07
MD5 885957fa647c8d6eaecd36127c353958
SHA1 c0eaf7211158ce79792380a8a033417f50161b51
SHA512 7648766c9aa2b5a1ac50d43348f37d1cdcdc6bd8593f9cfa979c16ab9b463454637df9c903908be6f771db46bf652eca71ab93b84df415310a34dd65a0f351cd
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ93a:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ93a
TLSH
T1F4F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 789KB
SHA256 8eaec1b5e32e07f0f8ea3c4df59b1a595b94338bec6c3e1cf543aa8e3e767876
MD5 7892b8c690e60177aa4d6284935522b8
SHA1 eab9680d0d8affe1db8de4d1fa8b423616e61a39
SHA512 153ca26502a3c870173eb7fcc2d1bd226947faea677a81e667edacdc6ea07b308542e1b8a1339933f32f32f6edd4426e00a67a9861dd37ac8319d87930cabe9c
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ90b:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ90b
TLSH
T106052A25F6748721D073C1B9C5D2A69AEE3234825B30CACB128AD76C2F277D6D536732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 764KB
SHA256 98fe78a7b72358a475aca3ff538bedd9548525c1e60b37d869765bcc321a8552
MD5 87de257bd9e69471cea83c5ad4d1de7a
SHA1 7551cefbccd77d3ade975afec666576651334e3f
SHA512 11dd62cd2a9076bad1404eb81298558ac2e6b53a6c8575206cb1ba4391e86d7fa0834e9623e231e0773ece218bd2ed34555cb381ba623dc7a81426c2db5d30c4
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9c1:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9c1
TLSH
T135F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 764KB
SHA256 221f93777ebeef904d178035f3e7052ae8f27893babddbf245d3fd1f19f373b4
MD5 c0e8d9000019703785c4f395d65786ce
SHA1 4d884a2f698c237366f2f54fa0002ff5f74da1a9
SHA512 0cc5bfb536a59285e02ab8f0ee1fa02c48d37e6eae656be03655aeee24e5d39f9bac1c9840affad813bd8dfe7e50148c25959f4dec73681141c508e338968726
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ926:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ926
TLSH
T1DBF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 764KB
SHA256 bbf82a40ef39273ba85f16f075c2209cf8816e7edf998a972a98250bdeeb4469
MD5 fe2ef154459a425d53a436142ac870ce
SHA1 3fd43a4de3c8c678a9d0bb2e99be711076c41bc2
SHA512 e119d26527e312a4cf21b26db13ef58962a4217b3a28873a4ee92fbbe9fe3fbf7ed699b13f0106177e8a44e9e71c6a7ab75a17a0c6e387bed2ad444a7114a41a
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9mN:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9mN
TLSH
T16DF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 764KB
SHA256 a3072dcb10052dc467719a641332e80c2f572055694d4a60e7ef2609ebad7cf5
MD5 3f2e24a1d9ae03f18d8b45b6384491ba
SHA1 8b0a522065c24ae6acdbb4a384894c6b3720c768
SHA512 a565536353cc5a76ede630cc8d815219a646e4b2ca06fb2f30afe2fca14682b095a9ee17d8dfd8e8f5458757621e365e0cc184615494ab2430efbb67928962e9
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9kf:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9kf
TLSH
T161F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 902KB
SHA256 1ef8bc8f283d78916c9f9db61fdf7b60979defaa51401e605c2e50182e7d77e2
MD5 69069ce3973f12b96d58796ee4fcc78a
SHA1 61e83bb5bdbcb804cafba56f33276be9d602d3f5
SHA512 a1a0fba15ccc66616024dd3e4f4d3d1a75b5e1a5141672a52b4e5102c0308d979d13b90fcdf1cde5a05a37b1d1b4a15cd57a7f938f26378a1f772976a0f3a337
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9Pzy7:A3IqJtb2IAs
TLSH
T1A5152A26F6748375D073C079C5D2AA9AFA3234425B308ACB1289D76C2F277D6D93A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 764KB
SHA256 66168752cc67f98b160641baaeaeecb2990d851a78a6e0fd0e7975a54d2bb0f6
MD5 03bfd6f141990de9e70d26ec3fc17b49
SHA1 25b2cff78b6c4d4137fd0f2c8259ef2e134165cc
SHA512 aa7dd5871ac104e22ccdd475abcd70b0b0de0b3bf3833cac562de421a40b26a7b7f34eb0914824d5877b181ce9e5c8b69f0a76b4b44a2d4fb1d63fe0d5c5531b
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9Oo:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9Oo
TLSH
T1C6F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 764KB
SHA256 1eb78d3cfefc6fdae76f550085ccf8c9cba5b01a81f5274fd3831855c0761e0f
MD5 d72e2f2ebb1a84a805e47892e4361c88
SHA1 3e88423e550bceffcbbd676a2d89f668fee79fde
SHA512 611ee660ce90e9a86f522e1ce8c733234d962037af7c0c0e1ee60bd7a6645634fa6fba470029d2b31db8e9bd9cfdd44f3b02d5f6d6432008f461e612adc158b6
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9iu:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9iu
TLSH
T1F0F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 902KB
SHA256 84b0178f70e0cb616f885be8cd8ebc9cca8eba27611a6c786b78edb4517c6420
MD5 ba98a1b967197a3f956b69f8ce78330a
SHA1 da63a03d68436a361a472f9cea1f262fa8b3ef78
SHA512 4e94b1de6b82b0c20146d005ede694fc9e3d4cc78aa154c823b165c7c25b5ba606a823723cc6e2f2d66bb7544a7569f632ccad61a2bcdc4559c8f72558ca9855
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9Czy8:A3IqJtb2IRT
TLSH
T1BD152A26F6748375D073C079C5D2AA9AFA3234425B308ACB1289D76C2F277D6D93A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 764KB
SHA256 063446a6c21ec7c364ec1ab1ba200c898ef99b50a3dc338d7545b8631cfda537
MD5 fb0835e1be4c57c6da14ba31235f5dad
SHA1 9cc8b91c1898b23f292049fd76940aa4843745b6
SHA512 f94abf7abd5de8042301725bee2aff06b047fb559e602966e94eb281efed8223931c412ed362286e12d89b6966ac1d306fd290a2dcdaf391b543b21735979f11
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ929:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ929
TLSH
T1BDF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 764KB
SHA256 5b188effc86b9427d635fdf14bd41561f089e1e8c4a4513004cc7960d37bd377
MD5 9fa1d95d59508b09d3f85c01a6594abe
SHA1 0b45e6e363d2d244c3d97df93a129f7301fadc4b
SHA512 578b83bc90c96ddb32e40d7e20a9f6c04688486eb7bd027e92f4c3cfd5714a323a43778c317770b9cc6335b387f202fc889f9b2bea7dddd0027ecaa836ed2e0c
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ92c:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ92c
TLSH
T113F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 764KB
SHA256 a2deddde9ff0a9f8c52a1d33deed9b75ada07caf8597a7f023648b67b1ae08d0
MD5 b14a70cf580e6cc5c55c02e81462ea35
SHA1 600897fa52691034daabbfe1e5f3e97ba4fbb426
SHA512 b05d508c95cc7f574944ea59a1f6fe129b0f92e335015553d28a730d4adc0ab4456f298a7411667747bf99442d6a85bc2e014bb5e1fb2287a5764af072671d34
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9vp:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9vp
TLSH
T144F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 764KB
SHA256 7aeb904579b9a9017e7958fbd3b51868c4cf6b6e720e1b72d6926194082c80ca
MD5 0a026473ba9328bd4b3870bc2abbf0f2
SHA1 10e35af5a5628ba4da0e331005fce8802d3ecdee
SHA512 7d2359f3aeb4b3fe7263a481a1169712db8c188018f0a48b3f5f34e7455f06dd94bb69f8c7ca0e90a8dacd18a529c13e3dea83f2cae3bedd04833ae7c6f434eb
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9Q0a:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9QN
TLSH
T17CF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 764KB
SHA256 ee200a6ede83fd421c5a26d4efaae5a9f144c50e01c7d27137b37ecb81ed2e03
MD5 1e7df4e64bdaf59b1a2123cfcf710779
SHA1 0ae0190ed1fc9123969f1a2a53704dad0d7c09fe
SHA512 2e6a486fba14c1970bc4ce0b01a581ddcc01cf9318a18bd8d9672abfd791811218868908eec091a235e83eabea2c29758f38fab44c64bd9ec3661abd64110b4c
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9YF:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9YF
TLSH
T10CF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 764KB
SHA256 c916f95bc150de857b774fea3d19dfe69c02126e1a45bd69f77bf84149c6cbd0
MD5 0938595d881b2e6fc661dc176e0ed3d0
SHA1 0c7f8a28ee4cf03ec5e32abd713c632bfa2415d5
SHA512 73a23346841a71ce46d3e661376c38a6bcec5a87211e86ca12a728424ce905af395df63433858384b3e7dc3b30f6d532d0e4cbd3664f087e23fb430fce4546dd
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9NC:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9NC
TLSH
T1FBF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 764KB
SHA256 3e536ef1d0df030f9c09d2b65b0e1d0dc6417f7da1df6217d8645bd67895c196
MD5 a395ee5f8768c451d9659b51dcb3888d
SHA1 176e107b4533d001a493127f4be5ec4116d32f09
SHA512 6a4c87fcfdaff9ca46e5274775c66fd9fee9da47b0bb6a88e7fd32121deb1646aba548225ca18896101543f4bd6824a41fc0033bdf39cece2a8cc0a2d9834e60
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ92w:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ92w
TLSH
T183F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 764KB
SHA256 776cd9aec6e6491559f915b22d5fe9efce3b30416c182ac41febb36e01cb118d
MD5 6641f191a03305e53f5108b4a23909fa
SHA1 62d9ca9e9ffd7733af48c0a6412a511f84196fe2
SHA512 cf21a3c12fb7fa4d3bfb76fc7ccdb91e45593f7d4cf21e095d1991787279595d27fb84ff980d9dbe56bea84dc76d27875240d83777a168d24cb7883d4f52368b
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9lT:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9lT
TLSH
T1C5F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 764KB
SHA256 6346a5acce44c8ea1574e0ab5b7bcd10c9fdd1581892de9b7821195fd51a0874
MD5 7d497975219d3f272f97d973643078c7
SHA1 2b0c85a05907c1a199b37ede4b17a1857fb49e45
SHA512 8351737548ac24e0bbe1aec1680aeca1507933065093e427ac4e0ee1963b52e369b248d01996579d04e39de55fe48052a280890def13d96769c91f8ebe4d4341
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ97u:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ97u
TLSH
T1CFF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 764KB
SHA256 82303fb46d8881b9ed88b4c4fc734928698c2b2951a01ad23bab4652d7e17265
MD5 e1ae2b404be0952c96c834ae910cc677
SHA1 7e7b4071db8402f1406173cac9ecc240a53c0f5d
SHA512 9e076c304c793bc78ac44e11a7e7b147e34f84148bdf093970a06a298ea8a57cba823f57c9877d401696781ed84c53d82243716cec76bc24cb009066380e3d32
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9fb:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9fb
TLSH
T106F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 764KB
SHA256 a6f4be7d5d67932c19b6728c9c8c75135d7255da93cc850f46ef4c10ca24e392
MD5 b64456edeb15b1ba4fd35f4d26e7af2c
SHA1 f351f285da8f4e4057f6697b1a99b7aa6b8cf76e
SHA512 3a34e998309d3824a0a51dd81a1f92da1555c08c6bd848ba1b1c1f509feaaf211424a813683270b6524856e5b8899b776ec62f1f5ce18c91414feb912f4896a8
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9bf:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9bf
TLSH
T1ABF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 764KB
SHA256 7501c837f5de2ce0fd5dfe5bce7cdb3126e4b4316196e9fafc9dd266e898d1c0
MD5 50ebe6db8d602a9c324f7e1afdd65231
SHA1 f61fb4ee38e1e19fe40a40bf92f2b0f2b8413e7a
SHA512 ee9d16c892858d65a1dd3f8313a1bc30340b424867ccc5bf40e0768f0e9909917f1c216eaf40a81c75c5951071da24b2e194d0c5e6004023b3b1b1c721502cef
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ90K:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ90K
TLSH
T122F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 764KB
SHA256 4af56132417e746bf3fae23fd57ce2cc6b5313abf9a1a3bbc4c263d459f1ac97
MD5 ba14e2ebf19cfe0de950fada0e43f8ce
SHA1 110ef37ad62eec24fa99fd4ef8a9bbb23322a40d
SHA512 8a8162fc3a5cf844eefc6f444e5aa89e3433c8bac87bbc6a92c7452b3cb13d9fa6ed48e3a5f1a1b95ef4ef98f598ae16541c762056c9f3622b23d3faa70fc337
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9pk:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9pk
TLSH
T16CF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 764KB
SHA256 4f68b5332ac6541c2a984a68c2a9d34131f5fab51150d21790180a81b61d4a08
MD5 024edc5abf25a3becb76aa801a27b340
SHA1 01bcbb43dcedd26d9e717765f0f5b381e79f6d04
SHA512 6ddd2b3262fba0f630ef4d64a72140779b003226b345f6ac652675327df6292439c2d4a7f0e52e4086ed2c96b7ee51e2d7ab2e48edacbaa5302c31b4d753e721
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9G0:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9G0
TLSH
T1B3F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 764KB
SHA256 f88665d906721ba77be4e5a0bfe0fd4b7be4026447b7f74534c4c7659fecb486
MD5 f59a40016eae4cb3fb8f3bd018621d40
SHA1 a7a84ce022841324622680c77d0026de0f28c48b
SHA512 9e2e29f4920f7aacfd1563c4251d1ff878b28081342e0d1f8b8ad132c7535bcef76e42931a7965c0e9d0d9bffcd240d98e533e08a8afa5f848fa1a4054d93cbe
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9V70:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9Vg
TLSH
T18EF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 764KB
SHA256 83fa6ae5a1c452c8c671fb8c2d426f8a46381af9105ce19f1920763591b2b3f5
MD5 82c78cb3b3bf3f5d75390c82e9802cd5
SHA1 a7d17aa2588049ed12999e68d86366c32d1b2bf8
SHA512 ff19ba6a54ca71d89570d72b785549dacb40c9b9130ddae97d4d0253e86b8c5f8f3c9cf5718429f6cf286d9769b943ebbe99b878ff9a959f1382eb7a95144c86
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9kr:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9kr
TLSH
T16CF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 764KB
SHA256 011e6a02f5d684c01adbab66ec0a104c2fc80d2b9d6d9027a755aeac8361c9cd
MD5 9853f532ba34888337fa1e09b4e00b20
SHA1 4cdeb97180682a2a5a28edc584aafce1901e9756
SHA512 5fab475015fdc8e7ab48aad5333e1775cafb1ccdb4505943d221da5efb6d8cb2e1117b6b6f54eaac9c6f9d4f88a9ecc436f6929c4ec4f890fcd6f6567ce08d12
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ96n:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ96n
TLSH
T1F5F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 764KB
SHA256 1f7af5e68b49fbc1733bb2921b8bf851a7c4681fe960d0ac8e6be29d500fd5a9
MD5 bc26a7dda72f20fb956bc7e3890a3f4f
SHA1 b031afb972f64a9aa8c73d20ab9d4c28e4d62de8
SHA512 9bd32f233a3395b9f038eb6528517876b28d090dfbff2d6984629e62e08673a517c911d25b670a5c92e83105b771ec779382c30b2a588f27f4bfc3119b771d03
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9Qx:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9Qx
TLSH
T1F8F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 764KB
SHA256 53fb11333e31ff69c5d782f0c40f72be035d84f452fef1253d555d7a9867d820
MD5 725689ee3564589671e083ebb8decb5f
SHA1 026a254d57a607a34c566bac0b8a65bc699010c2
SHA512 fe25055e71e4a47c948fd340a1b0872f6a1e7501eaab7f043fcf53791398ae66b2b5fdfbc23fd613a9d83ac41fcd83a2a6b47bfe397d1c50289ac0380abcbd08
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9SA:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9SA
TLSH
T170F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 764KB
SHA256 eb1ede3f111376670466d0084a7f933e6af6db0ae26524c680ca22753adfc6ee
MD5 aef09cbee49545928a80f4ec542cd2db
SHA1 65c76eb7a310ff8ecc8352509b88571b749df338
SHA512 c5608587237726dd1d14f368591fa90dd3bccec87d2f0b466c844f36a3b2730d3b9c96d4ba56e2a86350dfba194c9ba4a26db6fdad61570b387365b70f79cb0d
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9r9Q:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9r9Q
TLSH
T1F1F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 764KB
SHA256 25a64cc7537334861e7127f84233c68aa31c1f8bbfe0ba4ebc1d08a33ce9283d
MD5 7a5937f8b66dc4ec5542cf68c22dd716
SHA1 0eb956f345abff807a7ae80658bf89296243e3f8
SHA512 475000495a86911209c17b86482e3596daca399f724f2935276723052eed1022a162cfe5fae6a7e1f46c24c4d04de36b11b76f73638d29887db2db5fae79aa6b
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9a4:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9a4
TLSH
T1F9F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 764KB
SHA256 d4ddf5b6e5be5cececbad2b904b3a5cb8aa36c71511de5e0bc7d2a0678b5f61b
MD5 10cf7f81dd0c8286cf117c2b5df997d2
SHA1 c30db08010633253bc3fa70ee2157ac951b2f9ac
SHA512 901f594654e630b9423a196d331d1437e764dac5b7ed779998fcc66623b5dadd35dd145856e141451cd35b11f34fa1305a057127089ea6516f3ddeff4af30ed1
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9Bu:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9Bu
TLSH
T173F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 764KB
SHA256 16e039c7769071790c6db7e92c52e2fb04920f1212aed394f448c85bfe4e12b0
MD5 29142f526ffebbfb3701cf60fb1e1e2d
SHA1 561dd50ec5539f413eb6a8a5484eaeeb38f1069e
SHA512 42ea6cc6eb3cff279174ceb31b6fa54216ebb27e417752ccf1f216e7fc5be0a848117d2d6a605e911f86db0aa6af4ab9a8c36a38231ce4aa29b47a1d4e7a107a
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ90j:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ90j
TLSH
T19FF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 764KB
SHA256 3ee4d6e1d5b98fdf10c781c23a2a4e0efa67c3f6757bdcbd46346d2f42367dd3
MD5 057a4a57051418fdddd02ebe66975782
SHA1 8c543678bc7bd396b1f8c15fe9a5552d05972672
SHA512 c3ef492976c5ca762020c1cd1e8bb18e20052e0b5fd07568af20ab75402bc46911cb38215a399784cbbee6b1424bb63d5209b038355586d39f1d35edfdbe47e1
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ91g:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ91g
TLSH
T1EEF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 764KB
SHA256 80a69fc637be42bec5ba60545c7fcb206b499f5a708c0505907cea9ea81ed0e3
MD5 2e84899ba75184e4f9f91dc146ac8167
SHA1 c4ceba0343cb426760c9123a0b24b680d9092311
SHA512 e89dade4a6e662bca155a4a5d800a1106ab5fcdd32fe634989e4fd444d776bc1cf3e2033e069a11dae8436f7ebf0c8cd537ef4df8250575dc13b2b429091fc3d
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ90I:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ90I
TLSH
T158F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 764KB
SHA256 682117864e65278688fc2a26a5c695c3e3aa06716537c37ffdaf01108e83e2ad
MD5 a0a958b3cddcb2088a026edf6bbf4926
SHA1 924141f032ab31545b3fb7847a462c9fbb3d7e13
SHA512 a27e5c1f4b60e7e3f27116fe1ab60a47ec98a69d088b34ee5aa31a0a0e4be1b579de60d127478ab1301031297a451637bd9739aa10b5bfe5aef4c8255ead22f4
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9mo:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9mo
TLSH
T110F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 764KB
SHA256 6442e1c78c61c1b3944aa8340f07837d673e714d71fb0e82f26881b3e58b907e
MD5 e5b08771e1c04d94609df82f1a1f6e7f
SHA1 1d2b26fc620853c64fe5cab64628af5a4c39845c
SHA512 8c9542c9558565d94ae15408dc541815d6a09ea804471725dc80db81b861b0dab22aa21a7729b2b4e96862eb8f0dc4df153110d380d6124a6801701edaa580b0
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9N+:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9N+
TLSH
T177F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 764KB
SHA256 38b2405b923181c85f21195b5522a1f81ba35cacdf1f8479c983f890920c87d7
MD5 bef2bb2dbf69f9869a6abc045c64b0c1
SHA1 0fb57e87b1895bb66cceedbeb320968c68b252a8
SHA512 0cc0ea2ba056b6415e8ee571c7fb7da5cb1fd07c7439e434f6ea92ac11ae2b3de704291de12cfa6c1ac528b715d2313051a4f007658117cf3855e487e9d72a70
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ97Q:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ97Q
TLSH
T1DBF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 764KB
SHA256 703e841be7ee1810287f8c589c36b01bec78187fa423c6379b9e3a70256308b2
MD5 ad07d04f54d5568d8e26d8cf620c30a8
SHA1 6b5cec62ce9a3faaa7d5201e2427eac75632e9b9
SHA512 d263424d247c570942ac7193153715db31d2451dcf7edfd7e001f2d8181d91720a23eb45c1889cf9b11c6f083df07dd9c217f9943d4350355f10ce7471e91f08
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9wX:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9wX
TLSH
T1C9F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 961KB
SHA256 3b7f1a22dc7fc43e70503eaab180f202f08195070157fce3504a5dbb2e202e1c
MD5 3ad7ed6a28a85a315f664f1e98313b44
SHA1 61d25c2c0fa8c23b93a6b17af7327507e7edb405
SHA512 086d26976a7c8ef1330d91083ef4658f084772e8af5dfa9bf1062679f397cf8767d2ffbcfb0b15fe202103103f17397484fe1576038ccbc2b46d34287a4f1fcd
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9vjCXF7IwZ:A3IqJtb2IqC17IwZ
TLSH
T1FE254A25F6748771D073C0B9C5D2AA9AEE32384257308ACB128AD36C2F277D6D53A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 764KB
SHA256 0288e8c3c00e89bb56436b653a43c499822780677d3d99eeb143d6217334b83a
MD5 e3883fc562efcf506643e766aa70f468
SHA1 a0f72f2fd39673845d7d66d66ed7edfbc0a7deb5
SHA512 6589d9643ac6d5c50ea98f4f9f819478b9debae778858084e0dece93ebf4346e94d9b71be43eaef24f2840bd0a4414ff3f820c4a0ceba53104770e844d65439a
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9GL:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9GL
TLSH
T11DF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 764KB
SHA256 a223636cd62181491c7f469b53801d9ffbb458f57c2313a66db436f474f99f8a
MD5 4f5bbb57ebf237d73c51dc45b4931a21
SHA1 e4509de055f422fb3b0cc430415d0f5072f3651a
SHA512 8f68e55a4afdc76d392739f2bf36b605f3c32d3d4d694031d121642376d99d9bbb9b1ce68d7d5fe4285d31bfd8f42c386b44a6502f54d2d4fa1df7a9443ed532
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9aFC:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9aM
TLSH
T1FDF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 764KB
SHA256 caaa47842c89cdcd2f96ab3c3ca5c0f9dd65a691593de9c8f8176f1fd1e1e2ed
MD5 5eb1645ac387997944c44bf7617078ca
SHA1 450dc1acba89515efb4546fb21cb877ef1bf14a5
SHA512 57dccda57809fe12735b7214c9769402c28a1c0ba22f4a968b514f48163b7a2780bd91f0fbb00859086678dfc8a623b2c0863a5c52a8531b9815f8c471749682
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCZ9Lh:A3mMYTqMi8CtBd2QHCHmTBW5ETCZ9Lh
TLSH
T1EBF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3184-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5588-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5588-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads