e627675195d611c92e8a9691c76523e83e0e30610e355d92dffa10fc844e9d20

Analysis

max time kernel
88s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 20:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
Size 779KB
Sample261104-zfk2eaef69
SHA256 e627675195d611c92e8a9691c76523e83e0e30610e355d92dffa10fc844e9d20
MD5 524ae75d7982b5f91bc706129d07407a
SHA1 8f4626ece3d8c0cfbe09b777b2e5d44aef065f78
SHA512 5826f4b2e6531015ef1e16b581b626738791374f31f27102f9f99a118d5a98afb821deaafd23595ec9b1ede8f99bbed3b084db44d42fd4212dcd3bed6c311266
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaB:9GqFq9oJdXN0Bn
TLSH
T179059D5D129548B9C36B423084A64E39D3B1B8322A25E75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/2468-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c49d-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001b872-10.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c94-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2228-167-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2468-166-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a64-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019853-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-483.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-587.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a61-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-685.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1131.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c49d-5.dat	aspack_v212_v242
behavioral2/files/0x000b00000001b872-10.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c94-57.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a64-222.dat	aspack_v212_v242
behavioral2/files/0x0004000000019853-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-404.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-483.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-587.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a61-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-685.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1081.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1131.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1150.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1169.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1323.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1342.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1367.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1374.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1381.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2228	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2468	2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
2228	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_524ae75d7982b5f91bc706129d07407a_conti_elex.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2468

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 779KB
SHA256 e627675195d611c92e8a9691c76523e83e0e30610e355d92dffa10fc844e9d20
MD5 524ae75d7982b5f91bc706129d07407a
SHA1 8f4626ece3d8c0cfbe09b777b2e5d44aef065f78
SHA512 5826f4b2e6531015ef1e16b581b626738791374f31f27102f9f99a118d5a98afb821deaafd23595ec9b1ede8f99bbed3b084db44d42fd4212dcd3bed6c311266
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaB:9GqFq9oJdXN0Bn
TLSH
T179059D5D129548B9C36B423084A64E39D3B1B8322A25E75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.3MB
SHA256 30f14c41a09db1d958093d54ce4e2a41d5634c50ba28446b66af31d20ade4278
MD5 bf6051ff2c2a41b7c39506064a18f83d
SHA1 4a8ee9e68f479bf9a0d642ad3d3ac596c71610e8
SHA512 3e018c8f0772c17c6b0692e8670d820912dabee33c96aff84bb2c907768ec38208c553ed9ca3f5d207b182ea29ef6f46acd86c16e2d5670a3812a582e3adb5e2
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaB90Le5ji0hmxNrM:9GqFq9oJdXN0BnDPji0Aj
TLSH
T14A557C19B2A44675C177C074C4D29A6AEB7134521B30C7CF378DD6A82F63BD28A3B762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 827KB
SHA256 02e9e49a4e34be273dde770f2283fa94e0ece8357d1e7f3e19bcad0df7b2bce9
MD5 72abf4edae6929688e3c22c9c562b73d
SHA1 c3244e98ec5b6184a48cde5ceea3cf514db2c2b0
SHA512 06e0f9d9467d114d32c9c58c169756624a4a6551696f36220ee0366d5a403496a633aa3f369222b8347e5a921954244f1337e92ed0130cdf1c7174d48d6dacd9
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaB8b:9GqFq9oJdXN0BnGb
TLSH
T1EE059E5D129548BAC36B4230C4A64E3997B1B8322A35D75E3F5CE1E01FB2FC15A2B793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 802KB
SHA256 6cf8e99c87dcae6a2aa93f494f918212820828a8ff1a9644b30a69c304a6b1df
MD5 18be9faac749b0be6a12b8c63088a200
SHA1 51bc70ec78a3efe459853ba2f64f306d3e1f45f9
SHA512 5a6856433c7c96f989efccb1e1c8197b2741aabefd7b5251ccb7b0c6afa68e4833b554a3985d6b5094651d4b42a7d0709e7ccb9acc5a3c6561599d2bce785c67
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBu6:9GqFq9oJdXN0Bnr
TLSH
T1AE059D5D129548BAC36B423084A64E39D3B1B8322A25D75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 802KB
SHA256 7fe6d2b51afbee85a602357044fd457fa0526f374cd3dac9a4ffabfc941c2471
MD5 6ee83a2d48da9abc8bbf32dc7cfdaff9
SHA1 400dc4ad10189cd07edcbe3bac2f6623c141759c
SHA512 5c0d3fba742c7cafadb1e37935dae78297de902acaff05f24c525a3a7e344971f471687b19155e4cdc4f142dc10d4173cdb0c510d208c265e3e50ad191a1ad85
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaB+N:9GqFq9oJdXN0BnW
TLSH
T1DC059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 802KB
SHA256 e5d9c669baa5f32525eb75291405e840366aed0112c77cf60040e3e14f8cfed2
MD5 9f2b9689f65f7887e57ced9c5cb12e23
SHA1 611be913c9c4be95dae32000ecc880fa020ff3a9
SHA512 ee79f37007583088502146c757e64b24cec0ad69add48a2d3cb40ff34ffc0d7068cd6114af36f5ff3fdedfe917149b98298ef51f6a1aaf6f445b61947b3f92c7
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBMf:9GqFq9oJdXN0Bnq
TLSH
T112059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 940KB
SHA256 616446b684214e457fcd99ed543ff66f50e84acf7c0a96d36487e932661dccba
MD5 14847bf3f647e3f5bcaa7aaf164e1f05
SHA1 4364aedc44b3655246a892a6ceaa72d97b9f75fc
SHA512 6cacd06fb5e15a318ee764f2a620927107440be4600fa74537bf0994d5a45f02465d28f7bd1ccca0ee1ca184bbf1401fb3a9da510825bbdea12ded37632c9e82
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaB3zy7:9GqFq9oJdXN0BnNs
TLSH
T1DC259E5E229554F9C36B423084A64E39E3B1B8322A21D75F3B5CE1A11F72BC15E3B793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 802KB
SHA256 13799b0fee2f4cd675bf1f9eadbe7b65a1451edbc1ee2e495e4669b898a17c49
MD5 29f2796149d87306d6abb0a96354df82
SHA1 437bef68b8fbbb14aa7a212f291f88f0eef533da
SHA512 2cf810f27d72fcbe38aa4a7686eae2856a0354531c22a00b972af834c7605e51bbb331a46b9e333c246b70a13dbb5812b04560ba13f4454b0768b628d4984b18
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBWo:9GqFq9oJdXN0Bnz
TLSH
T1F8059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 802KB
SHA256 e06a0f867c834bf2d0488a0ed6836e9009242888699999f68bd3292a6ff652fa
MD5 d6707fee33fd1fc38fe9ddd8b2ed1f89
SHA1 2d50c009777cd25e53062f57ca6543919bd0ebd6
SHA512 a58a5a61dd3935cf6f6f8f223fd5d9a2e1e64f78e1c9ae226aa68853115c4207887dd9a93377aaceb132d05be8ac927639429f88bf5cae4370e00830d2237f60
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBKu:9GqFq9oJdXN0Bnl
TLSH
T104059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 940KB
SHA256 35acd7e87cf098f68cd27e046af1ad30017794cad55115a4d2c82143fe90c14b
MD5 d899eb027f9fe4468b71a86aa7d20cbe
SHA1 c1101b18675d31cedd7b79e8908219b0a8037c2b
SHA512 94eb0c67e6b63ca8cc8e48b0133cf6523aa40cd03e552fe044f56737922896950639fff12fe10d7f320b19d55cb4378cec9652fcc53fe004250987476c8db841
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBKzy8:9GqFq9oJdXN0BncT
TLSH
T1B9259E5E229554F9C36B423084A64E39E3B1B8322A21D79F3B5CD1A11F72BC15E3B793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 802KB
SHA256 9d1229227abc0218626e332c2dcfe13c19a183ca6579175f648ece9a70fa22a1
MD5 1a2cb350a2ab97e715ead6083e92425b
SHA1 bd28f57455f793dd5317960cb4a514cc7a54c0c9
SHA512 44dc7f0c49fe2f0ea4e48b8becaee7a69dec5c13ebb8b00f03d6461b5aebc5cad2a506bd2cc67e45d6a00b8d82932811e69785c4a900ed0747d0ab48c313c306
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBe9:9GqFq9oJdXN0BnQ
TLSH
T1E7059D5D129548BAC36A423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 802KB
SHA256 d9fa16d364508f8c87dfa773fe3c9b07c8dcfd5ebe900ea0cfef9452294a068e
MD5 83e503b38d0a020013abe8a61ac9fc41
SHA1 00d647c18bfdeeaf3544520f33c86326b48bb7f5
SHA512 c52b04e0fc7a1759f5acd4a998f409675c9dc566155311f2671f67fcd5514013a41a6e647f44288f70cf14c32b283c13002d15fd1028f2178c1dbb97c35235a5
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBec:9GqFq9oJdXN0BnB
TLSH
T121059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 802KB
SHA256 0104a7574836e7ccce9fccdda2c76f03a1fe5be3c29a67981751af4db610e30a
MD5 4de695c2ab0c3870c66ac12924706b85
SHA1 40c4a82b2e26903b9303e52d1f2084021eee441e
SHA512 674f3a92ce08b3613b772d31c084e59d0bf22951dfe741050e8856e4354c550e2eb6af6ff7c43d13360dc29912a66ee586709344203d84bf10a027d5d6f551c8
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBnp:9GqFq9oJdXN0Bn/
TLSH
T1A8059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 802KB
SHA256 f1628f5bc8ee153d6bbea4823bd1e26e03efc96ed8cec7db6dd8ee3e52d19058
MD5 cb857cd2dfa59f85e7e9b88d05ed054f
SHA1 2ce6c59850fa0dee725d0d77dd93567ef8a8d9ed
SHA512 f32368b5b17ee7a8425a0a2eaeee3cf05f9e32491a6aaa4721b406e73389b8df6328eab45d0f3d3664e0055a5c3b8290c11ae428dc4f544b4917a8e9e0ab15d4
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBYN:9GqFq9oJdXN0BnU
TLSH
T1C9059D5D129548BAC36B423084A64E39D3B1B8322A25D75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 802KB
SHA256 58876662f7f5369d60a7d3616233d7aa5774317b5f265aa06ae1e07204cc062b
MD5 d72ab779bc5d65950342d243460163c2
SHA1 8f11d5df782ddca46fe8f0fd399e97ebfe1d87fe
SHA512 a9405f242e76debc479988b192f3caa9dbed90a48927a4759ee3da5bf9df67b9c217617b8ac2b87bc34d4514552750a5971cc09ec3d21b5ce567d660fb5e75a0
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBgF:9GqFq9oJdXN0BnC
TLSH
T106059D5D129548BAC36B423084A64E39D3B1B8322A25D75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 802KB
SHA256 671bc8d86433f54319d122ba4e33dae225342c22b191ba3e1f8abc292260509a
MD5 99d6bf356ae87f6dea930a133829deed
SHA1 338bcd05c8454d20be9b7a9d41c6e4892bb11fdc
SHA512 15dc5abb161a21d96032f7d77c904038178e6feba009d5b9e50ee49eab0facf582b4b28f5f7d45f5be8e41d886f324c219b69a6772884ddc386a91ee2ee4df97
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBFC:9GqFq9oJdXN0BnW
TLSH
T136059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 802KB
SHA256 e127c9161a981d1621825562379843bb5e50d161f7ac96a28e10e5defbc3128f
MD5 d5d07687f19f60f85eeb9548462996fe
SHA1 9a37983deea981616ef5b11e8b5a6a3d32d7bff6
SHA512 4d2fdcdc933dca6429ca649c8f5b82b6857598c16309460f2efbdeafb248ad3e626961273d1b62dd887c1bc18b38a49ac700c4e15523ca283ceab94145dba912
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBuw:9GqFq9oJdXN0BnD
TLSH
T1B6059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 802KB
SHA256 0d56cefe78c0a4f4b4a29627442e6908e07ebb8c286d8c5fd42a0a65e6ad0cdb
MD5 e086b89849802db2e1a2bee3221787e0
SHA1 a1daffd3d55a3bae2595cd1d81c52a0e4fe10cbb
SHA512 324359b2a09adb224f4d0d171450082b2fc298fb1d999e1a1395f5acb10395610ce3b131ab85af9b88e00e40244cb2655c8b3165bf0c43fe39fdd881371fbe72
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBdT:9GqFq9oJdXN0BnP
TLSH
T114059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 802KB
SHA256 76459054d4490793d7027ee6f8220c44a3b3198370983670b142631a1b67949b
MD5 d748266072f4cada793334d57d9d4279
SHA1 2693c226b01c3f42941281280ac278956186a57b
SHA512 e541cdcdddb39e3c4c6ff606d603f880fb285984252250a2911b4fee25accf76dadc18d9e1f244139529966176e87d6bdff4ada50fdca83e4e825f00e6187f37
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBju:9GqFq9oJdXN0Bng
TLSH
T1B9059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 802KB
SHA256 2f22cc03649722aedea4e0a1547d5748aefe8e802508809ae8db8f3c065e63ad
MD5 280f3e51f2022c1328cb0a7b499d6e02
SHA1 6b7eb72bf5890c8d044eeca0681c7c545e8de2aa
SHA512 0f83aa89645a3e631ea53b0d95c60169032677b18c51c6fc6e869da9b8f2a57714154974abb9b1297c71c352b6ec85ec47df3bc82e7dbc5de107af88c4de36a4
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBXb:9GqFq9oJdXN0BnZ
TLSH
T13E059D5D129548BAC36B423084A64E39D3B1B8322A25D75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 802KB
SHA256 6df279242b3a395910243be4de3ea85f9acae5f156e1eed00a29d484cb4a94b6
MD5 c08d323f0b8acb40c6ee8649758e7116
SHA1 2475986501a7aa6e3e2d543fbc898cc1630a5df9
SHA512 dcda3852bd03dd39a094cd6b94545bc9a2c0a5b62ccfa3ee3469964063314b6ad20d410bbb7e9935ea0e6389801c4f9994379097461a0aefe387bc0a2ebf5c7a
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBTf:9GqFq9oJdXN0Bnp
TLSH
T126059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 802KB
SHA256 f89022b5ef48e987513050f51337286eadd8d76246023ab51faac32d4c4774d7
MD5 58bef9885ae18063d1fbda54d951363b
SHA1 37f2a3605e8257a5d7a8aa3df359fe7aa32c874c
SHA512 8fafc6a8e634b2131c2fc94661008ef931ba85c8b093802bf7b689f2b108b37c09cf89668ee72298dd897092d7ca974b0ce746985f943e01afbf9834a96a13e0
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBsK:9GqFq9oJdXN0BnB
TLSH
T1CD059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 802KB
SHA256 e53fbded4eb0a20e1299d82e5a174d62ad2bc22ffe574d34fbd9405bdf049153
MD5 913ecd0ed8ae3b29424c2217c0a03fe8
SHA1 ec448c956feb10bbe9200d83c6b01ef8f4b1e8cd
SHA512 cf4cd10019dfae6e1d12e350bb46b2a21ea97e866802407cee8ca7348fc4f0b5171202656f68d5ec7e96c178cefa0cd4339ab22ca06ce899d02a6e6c83b0f136
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBxk:9GqFq9oJdXN0Bno
TLSH
T1D3059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 802KB
SHA256 63dc10c9e9b2e3b984ccb96bfc7158fa9ab3bf70176f807f754619a962b8c333
MD5 a4354331c6b1f37a65c2c6231c12784d
SHA1 23bcba5126eaf05b562ba37d7c8d9bb497890dfc
SHA512 aba2657de5f9c5886e96700a1ccb6fffdcb13b84f2fb518c4e751fc6343feb9e0bf6120e95d6ff581617ee0746d71ff9b6805859c96a807ddcaef86bc5d1fd84
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBe0:9GqFq9oJdXN0BnB
TLSH
T19F059D5D129548BAC36B423084A64E39D3B1B8322A25D75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 802KB
SHA256 aada1c7f52c60a1eacc86365a41b911daa348ed438768d937e83c81111162dc4
MD5 e8fd306fd5c101fe403718dd620b1fba
SHA1 ed6cc9b5de9fa1afd6ddc3e7ae0db45d96729e20
SHA512 b9afbf678dabaf60ef2154cd1fab7f993fc27e6cada74f689761e05d4338733c37b2683f498f7d1f2790b629fe57f5aeebefef0ef34c13ba76dec992228a9901
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBtg:9GqFq9oJdXN0BnA
TLSH
T119059D5D129548BAC36B423084A64E39D3B1B8322A25D75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 802KB
SHA256 e173d102ff1866d4b17ed78416a293aacc9354713c67b21e277c4edcb91ed62c
MD5 727bba947b3fe971b934d4b475ea86df
SHA1 7aa76b02e51d39de7a8dde7b17bdabc016543246
SHA512 fcad4667a609a746831652675806d65e80aa5cc1c590056b4d8bd999ca084358393d8f55de72fbcb32c3f8ee49274597258461202f2e792bfe88fd7940e92bcf
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBcr:9GqFq9oJdXN0BnK
TLSH
T149059D5D129548BAC36B423084A64E39D3B1B8322A25D75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 802KB
SHA256 810bdb6e2b95564de98f604e1101cc08e0e5a95af3955526929ea52b9a06c90e
MD5 19e3243bab9541a6154974857428d8a0
SHA1 45e962f4f82fa78fbdea92501a02c689f3598310
SHA512 778cd5dcacae3588420db84b55c4d5b002f6cd1968b70d475d34e06c435b5a6bd5d85b7d63f0105c1ec6a283e4567bc9f32fd4e6b125dbff8e49ef5860f37ffc
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBSn:9GqFq9oJdXN0BnM
TLSH
T10F059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 802KB
SHA256 e411f213cdf52ac159b878ef78b6e95494af4e7f02ddb51d7ebf3797e38f48a9
MD5 a3b0cc115b0e03865e63d260a594f90d
SHA1 07c395eac24fd7c28f4bd628865beb11a49baf8a
SHA512 4245f32834645916f29c25c9daf9caa52e7e57b9a439c8aacd422aa5ea34bbda94a31e9538baa009136f9d4de0feee43c59fdf255139d9ad98a4371f927ac1e5
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBYx:9GqFq9oJdXN0Bna
TLSH
T186059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 802KB
SHA256 207e4605cb8ea9c876552d558bb3b8a1e315586e9443382f89ace0ffb6a025f7
MD5 f9023cf02acd51eb86125b27d30914ae
SHA1 ba791e54e681067b59e15a51c2d34503692db746
SHA512 2ed577f612f82e3a09f41909853f50736814d1dded47b745dc50946b7479b2dae05471c493ea9075ca7d8d2e333eb39d2ee7334141700f707f7b940787c214e5
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBKA:9GqFq9oJdXN0BnZ
TLSH
T18C059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 802KB
SHA256 030c1abae69578d6940c580f2216b42e0b90e80adc7126bad89449d65243e990
MD5 7659a0fb4965dcbba737e2f619c06a0b
SHA1 2f439721fb5daa3f56f44e0cd73df0a23a059b09
SHA512 94fc488fbb326509c731cf7776f749a3d758c62071a0139c8de461b4894b8dae36437d8f09c08c9a98b18fcc4cb989c1afe41df323ebd2dc502e978bb067812c
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBj9Q:9GqFq9oJdXN0BnA
TLSH
T12D059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 802KB
SHA256 7012e51d59d7368d5fabec3cd151d3078a1a863af6cc4b3cc5c3137026a78814
MD5 b9ac07ff30cfbd935188307ddc94bbb5
SHA1 2d1a0410cde08cb99fc9f561df8b0a4b630d0df7
SHA512 9852d81bb0996821ad5e19a46b77cffdbf2eac0b17c08f392e0020d26bc68d63fd1c2a5934a51660915e0e7c9f4b4dfa462ec6c6cc162128b7e45868f026dd04
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBC4:9GqFq9oJdXN0Bnb
TLSH
T1C3059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 802KB
SHA256 5e1e53bce0733a52205a4f4971aa83364ff0800720a450f55e6e892f9f634955
MD5 f0fcfa4d55032a34fff7000aa3adb7f5
SHA1 2054d69ad361e1ce8bf7ba1011ec016d7a158c5b
SHA512 30610e371f97da6f44d2b5e5b30aa754170fc6ac20f9eafd84f45335c19c580b498ee7cd4c94f27b17119177511fa52c45019ac55240f997588b513b2e0485d5
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBZu:9GqFq9oJdXN0BnO
TLSH
T1C0059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 802KB
SHA256 ac1a535f907bd199cfd86ef2ef08e6ed50ec054c1404da61948c6c1885634189
MD5 d4267326c1c544a1e6bb70bdbf2bcdea
SHA1 75cf31b97177861475423c998c8b31499b7d8df8
SHA512 7935fc78cba6eda731ef56a48d2c6601c51df2328a6e4a3cb96dedf4a4034e076d1f675fcc2a94d1498caf1530e1349ebcec9689924332f948c029141c2a3d2a
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBsj:9GqFq9oJdXN0Bng
TLSH
T17C059D5D129548BAC36B423084A64E39D3B1B8322A25D75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 802KB
SHA256 2c65d0286d63bf6bb990862e73df20b815ff12557f8f915004fe33db7b03b92c
MD5 16f208ed35639a73cb04d5fcace517dd
SHA1 83ae5c92e0accab5f9c61b4891fe97b7eb170bbe
SHA512 5121fee562587882722e2fb9cb56c9eac9224e13b8869011be9631f0cbe8d20bd150bfb1e3f423defc25bd1678e0c2ae14418befca4139bbdc382cbc09b3b303
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBtg:9GqFq9oJdXN0Bn4
TLSH
T1D2059D5D129548BAC36A423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A3B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 802KB
SHA256 c483047d8b7967078095ab9848b6124464910ef3ec04f768d8ece8cecf33986e
MD5 5740a58a53ec9cfc833f8e98528c20c8
SHA1 595ee79c21891621b4829b40b9eb639706778dfa
SHA512 aec2aa3af4ccdbe4bdb880da7ccf8453c1f56658fefb414c2ee62fec47f9fb7d5fa73db5b7b1ac36a0d701d3f73a6e337c8f3c08011ef30d719d41e8e9f7573c
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBcI:9GqFq9oJdXN0BnJ
TLSH
T1B4059D5D129548BAC36B423084A65E39D3B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 802KB
SHA256 d1580e10b28bae907fc10d72aad1e473c2357f745117c1a6219c883095cd35b4
MD5 c425a52c948d69d6f4eb63fe121bd6de
SHA1 55fa2d552e8abee3304f3c9b781ab67758495972
SHA512 a63c43a18bb9d6fe13873719bc3d3c354838fc2988ebb543438d8969907c36cf69492034492a5f7387b817c7bb9e501b1ba2f9a344d6758cf24d681afc5050a0
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBOo:9GqFq9oJdXN0Bn3
TLSH
T12D059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 802KB
SHA256 e584933d9839e3c140cd5dc15fe4dee63ca570bd9e17853706bafb391058e48d
MD5 317f491edbc9aace6e92635f4ca9e52b
SHA1 4aed3d409bed8c0faf30745a622b58b4d8c1290e
SHA512 2e2527b0bd99e48649e879eef46e6f828f83370e8a1bfb63b6a9c052dd7019d6add6fd6ed539fb54273ad37cf80d4f77bbcb7c72bfbfa43d7fc6ad7f39a06c1c
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBV+:9GqFq9oJdXN0BnC
TLSH
T1B5059D5D129548BAC36B423084A64E39D3B1B8322A25D75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 802KB
SHA256 a1961875bcd8e6c568191a317b3a41872c7474ee0e24f12c6b1d2ce6fbefad6a
MD5 d3f10c8014268aa994cbfcf6e7af2f5e
SHA1 3642e37368185cc2ae9a30b00520d8c88941ae03
SHA512 022824e389407a6c4bae933b3be29fb218b2d870c5a36b23a3855cf01f67282eeb1a8b57996a52115f80738c253999ead5f06d7d670f2c3d095daab24d100911
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBjQ:9GqFq9oJdXN0Bn2
TLSH
T163059D5D129548BAC36B423084A64E39D3B1B8322A25D75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 802KB
SHA256 d5651d314c4313c8e8534b83a8fc52b7e2a0552683c2163bbd9f96716155b890
MD5 7ea0e2eb4644d6f74cfbf61a2da74f85
SHA1 767d1fbf50344b2ec00a259e2f6f8ae269151773
SHA512 1926721f2186d92014c483af174e8adeeade54aeac9735fff3368def43f5e48625269beb12c29913d3dfdc51d173f67ad2e97bd766e470875140915a079a9e1a
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBIX:9GqFq9oJdXN0Bn2
TLSH
T188059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 802KB
SHA256 2be33ee975c5919ed18bb501ffd3a8ab88cd50c310f5a4ae0954471654200408
MD5 1de74b188d09adda3c605fdfb23693bc
SHA1 408ed92cb653dfa0b53b340bbd90042f3640ca50
SHA512 cc7a6c4dedd40e9bf593ad8a057524170dc6e80c558dcab37838b34bef6b92d77ed815206fa6c590abf1217fca34be406a9f3b07516be73d9228abf44bd01689
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBeL:9GqFq9oJdXN0Bn4
TLSH
T1F1059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 802KB
SHA256 fb72a1602e90deedd32430c254c69179c910f33b85c07debc310f2e9042aaacd
MD5 a84839f06992493d87c330940dd0c22e
SHA1 5f8d66697e199aa085bda341136cc7e1f335f905
SHA512 35ae2d6607b66fcff7b149efc903d8aca2f6c677b021e7d65dcbe357be597c325a5280524b5bef8ebbb25efcd80b5ba7cc4a53ce7a86cdfaeab3580536666734
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBSM:9GqFq9oJdXN0BnZ
TLSH
T175059D5D129548BAC36B423084A64E39D3B1B8322A25D75E3F9CE1E01FB1FD15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 802KB
SHA256 ad378aadcc91597625ad954974449334afc6767f41f618f1cd8f0248e86e5032
MD5 2ae6b6b40d3daa83e152ab619ba0cfea
SHA1 317c903f9a55d9ba4709a3b52dd68c29ef0e2578
SHA512 cb5a5b4a57ab11126836d0f6ab635d434d188098165ecee1e2d80dccfaad0870298a265aab1347e8afed5fe3d250356f01f298473ad14a8be060c225b34cfaa2
SSDEEP 24576:cIUUlnt1yIifqFurt1FoJdXN0BAa0ynSHaBjh:9GqFq9oJdXN0BnL
TLSH
T168059D5D129548BAC36B423084A64E39D7B1B8322A25D75E3F9CE1E01FB1FC15A2B7D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2228-167-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2468-166-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2468-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads