e9fc75b04baedf7d786a1fc3d1e9843050f6c21388b154585aec4e6ff61cd9e7

Analysis

max time kernel
87s
max time network
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 22:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 853KB
Sample260709-2mt9rsbw9s
SHA256 e9fc75b04baedf7d786a1fc3d1e9843050f6c21388b154585aec4e6ff61cd9e7
MD5 c3bd7f8065e3b4499576e64ff3bf0247
SHA1 ac79459172de88796f609d6db08badde454aee46
SHA512 f6e3aa1bab7961267082391f055ab117c6f18ad0078d2923dcae03935aa28359cf55f53aced9dd244f3aefbca2dfa51187ffa7778c9384fb474061010bb2524b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3w:A3k03kHRJO
TLSH
T10805AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4008-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c000000019cc9-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-45.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4008-184-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/400-246-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-253.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-434.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-483.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-520.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-618.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-715.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-777.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-814.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-879.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-943.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-992.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1035.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1097.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1160.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1213.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1316.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1360.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1391.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c000000019cc9-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-45.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-253.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-434.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-483.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-520.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-593.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-618.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-715.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-777.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-814.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-879.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-943.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-992.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1035.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1054.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1097.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1128.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1160.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1167.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1175.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1176.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1213.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1316.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1335.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1360.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1367.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1374.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1387.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1388.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1389.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1391.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
400	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4008	2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
400	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_c3bd7f8065e3b4499576e64ff3bf0247_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4008

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 853KB
SHA256 e9fc75b04baedf7d786a1fc3d1e9843050f6c21388b154585aec4e6ff61cd9e7
MD5 c3bd7f8065e3b4499576e64ff3bf0247
SHA1 ac79459172de88796f609d6db08badde454aee46
SHA512 f6e3aa1bab7961267082391f055ab117c6f18ad0078d2923dcae03935aa28359cf55f53aced9dd244f3aefbca2dfa51187ffa7778c9384fb474061010bb2524b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3w:A3k03kHRJO
TLSH
T10805AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 d00848edbf70ef9f5a42e55b725802f8be41dc40ff25b886cbbc43c636a9e1a2
MD5 5b2e5cdbb76b1b7c598860677a9804b5
SHA1 a5a053879c3fddff6361b675e2a676db0dab1f1e
SHA512 23ea6be5f571b81452855ce930c4bbe854f562fb6a1be4d241cd9a15b98930f489211ae6e45c34599976286212b7c96134824f20e54ddf240c631203c8a2881b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3I0Le5ji0hmxNrM:A3k03kHRJ+Pji0Aj
TLSH
T1C9658C17F6A402B5D067C0B9C5D6965AFA7138821B3086CF1359C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 868KB
SHA256 ab1e0a4ef68f130cce6353d6db7edbd0a85fb95bd99778d05bba8d3c66fb3ae0
MD5 9d0f6f8d6c20f87665171cc3aafd58de
SHA1 1ef94ccc81a9e808286512ac4a0396b7ad496947
SHA512 0aff56f7f6dd193d23193cef3e4ff8fe61b1ca59d532dfa30b68a6428c5e15a180fc9c169690517e4d489de1f0dd76c2b5653d66693e7263ae46d39dc3ff8119
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3ya:A3k03kHRJ
TLSH
T1B915AE03E79500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 877KB
SHA256 5b5fe4b0876dde9517f43507783140bda621d44c836ab353123c36c6f9deae01
MD5 8a534e75cfe01919226c23df3a4fda54
SHA1 765de2c02af8a31f8a25906dea24d4bfea3b738c
SHA512 b1868290b8e67844aa453d9f076b5f28caa32ae2a347897e1fb5bc145b1a6af9797aacbc4a63ac1d164be0b141d2d5fd50719e2431bcc4dc63e0ca2da4282a94
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3D6:A3k03kHRJo
TLSH
T19115AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 877KB
SHA256 43a08784039fa7ffbab0699224ca6f5f7e4062344c4e0cf7f2075bcfc96dbe7e
MD5 6fb2b7a2658dbd7234c9f0944e76d9be
SHA1 3b61eb8aa474d07827767eacecd8e0db92474fcc
SHA512 d4cb8a156bc9899feb084f3a7b19a13b3372afda8dbc37c2e7ce7232a48dd6b52f465e35c295d0441ca057a6d7c175a44bb88d3cab227078fef877c268addcb1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3tN:A3k03kHRJV
TLSH
T1F915AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 877KB
SHA256 2592ea1666a01fe2c90b57061dc738ac3d78515f52942b8780cfaa7e0f74b5f7
MD5 d5e047643f231746be9b1ff648d78495
SHA1 66128698d67cfb87c083cdc190e50fbbd9ac537e
SHA512 31e5a192d7b4ec7cc2bc13c70040b96cbccc639c5a70e50992d7b05af2d55fa2ef75ecd7d499adf5ec817db45287f5e9d76d757fdbc2274fe50ac532eacd8e87
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3bf:A3k03kHRJN
TLSH
T17E15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 877KB
SHA256 effa0d500a6f61e4b6de3e6d50c5e41cbe360252f28ece5b2236099da4cfc18c
MD5 a25d49d4256cd6e86ca57ee178fcbf07
SHA1 65be1c1dea599b0f63669006b3ca1e56f0ac8fbd
SHA512 e06b705172a4af75b79596c84026976fe2ca1c398708e61971309fddfbd3ccddd6e4a2ee6aca5581786d4a78311920c3a5c9d81657ba692537249fb78e7d5f91
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3No:A3k03kHRJ4
TLSH
T1E315AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 877KB
SHA256 0b1ed5050d9f6803ee18cf3041c4da434d1d6f15df62edb29827d06adb45f3ca
MD5 3caff750d983440bc12bb2ed6b44fdb7
SHA1 a0e1849716d8ba800ea3868ed8867131e8cb0f95
SHA512 2e6dfa5a8d080c0a18a113cd42589caaf589d7616eabb3a889f97ab3897cd801feebe6cb9a843ca2430b65664472f1dee666a216220e31d7cdfc69696b2432b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3Nu:A3k03kHRJK
TLSH
T15115AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 877KB
SHA256 c6e7996bc6f1cdc00c7f71e86ec0a07e3a4e8b59b579a5b9793992f3bf83ff6c
MD5 844d09093afbdc5225918b9ac9d8d79f
SHA1 d9953ae92570b5b964cb3b5eef9fc7630832870f
SHA512 7cff8f02958448276ed7ec66e3b399e13a4601da5837f91d81d3d47be6e7e79f041e33cf1846b602a9daf041fa52899362cdbb06317b7a847b4407fbd94e152a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3j9:A3k03kHRJr
TLSH
T17A15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 877KB
SHA256 ba0cb903d802f610167d7bb884c64b4de00641f3aed882969df6843b547b4828
MD5 660688b4913312d5d0f2bc9903d4db8f
SHA1 c976c7e71976407244c4b77774060e505dcafbe4
SHA512 e73ff1f5e3079f51c9519554a63014525d6949f5ffb5b950a0de2f71bb9c7b7e4e941025a4f90b8550db9c0abd493e2e600466776e117423921ab5c6c7d4cff9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3Pc:A3k03kHRJi
TLSH
T1C415AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 877KB
SHA256 2950e32ea1bf17b76f01651555854f8f19517ceee67e80e3032c3bace27d1229
MD5 7698ca4fe7e4ee649525b7a683d4885d
SHA1 935ebcb6e55ae8369e1d4f0e59cf6a60c4a0d0a5
SHA512 19b89d9c8c4cd4c4a4ecdb11cd300b6d25f0de3ae690927e1f2b786fd5b6e49673a4cbf5facfeef19ed419d488fa24e1f6caab0e9ae765406fe8b53a0938d5ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3Ip:A3k03kHRJI
TLSH
T10D15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 877KB
SHA256 07072aa8853edea4380d52948d1700867c40bb354a71effa7ecb8f7695e7ce50
MD5 4301b966b953e98f7044dc6fdca9365b
SHA1 969672ee0eadcab12ac90554673d6605d4faf401
SHA512 591cbfc1bb4685795ad875a56e24b3f93f1aee72257cacf0e34353ec8cffa67da85a59126afbdc9c77447c150092d7cf7a6ab38c8babb51751951dcad8cd1734
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3fN:A3k03kHRJX
TLSH
T1C015AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 877KB
SHA256 2bb6a223a7b648b6afacfad3b338a6be16c9a808f6109f5de8e034e8d1d47014
MD5 7e2eac0bf5faea72fc989d74674f2d1f
SHA1 24a948da1869e22afb76c0d27eb14cd0f2506216
SHA512 f9b9ce0e2efe3f33fc485624a924e07a2468aed3173443d21dd5673b40991fc7a3ca379889daf82ec6f6ba53bc9414423b2d21c4cd467e5ad485beb22b8022e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3dF:A3k03kHRJR
TLSH
T15D15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 877KB
SHA256 4c23d05ec07db8e543099dc25a43fdedb140f67077f88b0f101f114bd483f9f6
MD5 6c162218332f52acc51a5131c1601c86
SHA1 7e187d377f83c331205b62f7fc40feba59a23541
SHA512 4fb0c3c065533717f17e47f6e2ed287ee0a8ba79cc07b2ec91da90ec4e2cb03335986ad61e99592449909b5e2d41e52f72063ffa80fcf04980d64c37e0700286
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3uC:A3k03kHRJ9
TLSH
T15D15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 877KB
SHA256 e6177d0da4d2d93544e073200b7d440b48cec084bae3a81fd300ec75d1abb1ff
MD5 ccf9b8521249c8d3ed16ed6dd0863eff
SHA1 78264a02c132a76fe8de7a543ca3a2c10d3c90d5
SHA512 562fcda992a2f0206d109007af136c56ed75f5e9f08d11417c1fef4d2c9871c7e3277c52beb1a542b66743ed6131a186c44543bd3fda60c49bc94c5f4ff6d3c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3xw:A3k03kHRJA
TLSH
T18115AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 877KB
SHA256 6a540b3b4ce034d0a02429bea880aab4d5ede2a9976f76e5c66b1338bb262e91
MD5 101b7e264f58100e9a4ec802c5075903
SHA1 e0f8996f0c83936ed85ffdd7a9101edaf25c97af
SHA512 38784c281ff684b00c3d84a081ba7c9782b3260f23f84b513fa6e166b7c039d730939c5b8d7265e692cf996f10e1d6b282ef6caba50c592b6bea04bbd269c083
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3YT:A3k03kHRJY
TLSH
T19215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 877KB
SHA256 21bda016dafa7697a4e28f281a0318cf1bad6e045ac1c8d5b56e4a3616634e8b
MD5 f82012bdd03c5dd2b77c41e80640a6c9
SHA1 2131ebd2263b0fd993f1d81ea9bf7875d56b7bd7
SHA512 49fbb5c377373367d995a6df31d59841ecf691fd4d3758339b0545c3620b19d89cdfba80fedba03e5a7254ae9756d455dd60b4281650d261725694a26fc3f555
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm30u:A3k03kHRJn
TLSH
T10C15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 877KB
SHA256 9af7c95dca9c430e45463316bcb66dd7005a92ff38042794345593adafe94f3b
MD5 13e50731d8e1b4d19b91550281524644
SHA1 a804d2728fc6505176be63c4143e9d4e70e05a29
SHA512 543b57bef2d346000f96c63e62cd3be6d796ec7632cc0c06c37814e8face6ce735de441926164598d271b11abe150e053c38f6b95d3f9f51b4ab613a31e7a6d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3ib:A3k03kHRJe
TLSH
T1ED15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 877KB
SHA256 1ad9b313f0878544529dfbb32969caa823a51a7db928770fbdc0460f609a2535
MD5 478af5d159a45a13561972a817e57d90
SHA1 a4ff0aba24acefbf08af5b39fb9eaf3896cb65c1
SHA512 4148c98ba2c2b30b41f2769d33dc78cdd407a0f5cdce28ac41d25c4d6d09c3e31e203c67cc3d64c715a272c0cca6b14d198ad760fdcecf9ae5625bc623fb7bb0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3kf:A3k03kHRJ+
TLSH
T18A15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 877KB
SHA256 a07e3567755b8a2ef70e18579606995b194451da5377bc5767bb6baaee4ac80f
MD5 3f7f985440accd7b8a24a0a190237c0c
SHA1 32109bae226dc751d51a487797b40b254933e2af
SHA512 1b82942cd13072a8c56b3f2148473787c43457f5f702220d47519435fd24d9d8c002f197593e372250f89709820d93d80ea04fd7c5ddd0b189b1306d53f30644
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3BK:A3k03kHRJe
TLSH
T17815AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 877KB
SHA256 924c95b50f6b4cd91b257428100a08c5b666b79bf01c36f25d04c39ab89c7489
MD5 6b280abf92d119ed0fcd15495ca4693b
SHA1 fd4bde0e4df0608ba4aa409f31a492df56d7eadb
SHA512 2fea3c6083b0adb1ed3fb5ffce167fb997a6116cb6acb6d403c67055c00561bea412db317ddb2cfd61a3d29cc8df6352d30ae9caeef0b838d13710f1aefdd980
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm36k:A3k03kHRJD
TLSH
T1A415AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 877KB
SHA256 9047a2cf027e22e1e5b3078eee4bbe4116db8c06f080ce797861e96c582fce80
MD5 6bb1fc7836827f062408fff376428650
SHA1 0ef58328baee21226eb14726dd1d6770557b39d9
SHA512 c54bd417ed5c8961fea8def8df721532b018f0e68326107aae6e72772df078254c3ce954450f5ea83686375fc8e4aea7c6d131b28027f450f18a897a807fcf13
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3f0:A3k03kHRJC
TLSH
T12415AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 877KB
SHA256 3faa3543cc78d6af6063fd77780ae12aa4fe27cc980652e39f99fbd4c4ea221a
MD5 d3ae57620f061778a0830e22fa151259
SHA1 bcd9479654c08e724f27359762088a63e4c98e42
SHA512 2f1456a5b75e4c7f4d47589bc3b20fa4808a3be7ef3b1d4f8907d8150802091544c95bd1d31799d1de3c0a41667f9608f03b803312ecee8df87ff042d04feed3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3ug:A3k03kHRJ7
TLSH
T17D15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 877KB
SHA256 b7daea698c5b56e3c3cec3eca283c6f984e07de5b4ba287b4b58300473ba4dd8
MD5 04ca0a1bf880a0b56c4f19e8c2b0e119
SHA1 2c3ba5f37b32f408cafd1d5e4bab6609871d3a93
SHA512 d93ddf3e10b9a26568588fefb0b50b5e4bec8424e9b19a8ed74f6320eca9dd4ef18bb7833e536569accbf20b8b9ba0d6c4cf80a5c7a125dbda65477071c9dd1c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm33r:A3k03kHRJt
TLSH
T19415AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 877KB
SHA256 49691c7e637a2cc703ea70e7b43322eac1b73f1b9ca5e94363b0895a406632d1
MD5 ee9c7718b7783e2c31812e92e9eb4001
SHA1 9a581c392def2b472ad767ec198d780c3576eb6e
SHA512 887586a636c3dc372b37900a936e91ffdcd1562647e34a59e787bbd5200a0293b4fed5d515f7953cf475695b76cfe9aff08ba2e724d20ef692438393c324d528
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3Bn:A3k03kHRJv
TLSH
T1DD15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 877KB
SHA256 75d4a2222b499fa53d5956e4ca9c7e289e131cac5c5f4603ed544454fead38eb
MD5 1f81228b61382f69c738dad4781ce062
SHA1 edcdc581f9cc7ef94de8f5a6066cc62bcf743273
SHA512 f512d1bff87301c9f210718c99d612acef3ecb8ec5f90649271cbb063d20cda5e6038be042533bf699a54f98e86c445de2e841d1be8d4b7daf9aeb90a43092b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3tx:A3k03kHRJV
TLSH
T15215AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 877KB
SHA256 86bd4e2c8c76f8b34fc214a3533878ccaa2d4dd074df37313a5e0ed9c1095150
MD5 06474ccff8308049cc289a05a6356f2e
SHA1 16da7ae7d808c2e514cda67b93710619a94b4a33
SHA512 818b4e4b683c9ae23d3f1cf4ab6f37fa850d51767cb864569e2d2a1912e0ae99905394dedae0b456408bd46a98e0f22ddf15d767da48a5a955b86d0c653f1fe8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3zA:A3k03kHRJa
TLSH
T13515AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 877KB
SHA256 6a3701dac8a4714b287969d1ffa6819afd0e8137caa26f65a4d2d6fba75067f0
MD5 63e06201b4c98fb45a71c84ab1801a70
SHA1 387384fc2e2f4966eb5fcb8ff214dce145a71951
SHA512 7557969d9cb46832c57b9d25d1740d277b4c452076e46878289ff64dcb399207f2670c24110ac32796221ce88470f24cf804271695a753d0907a35dd08813e70
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3E9Q:A3k03kHRJn
TLSH
T18415AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 877KB
SHA256 02e626cc142c2a10291376b38d2d30c730091eecbff12ba76ae026643d01a810
MD5 eb33e68f414d95e1f2d8e665e314a081
SHA1 1450e673aa87a26df88ffeba0c65eb4e69a67b59
SHA512 49ee36f056c8d9ddc0f8b98fecb0a826bf002e4c340eda0eba5086131042e4283d7a642ffb70c060683643634b6b8323d7579bfd3417d2f2e761caa4fd9170ea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3d4:A3k03kHRJ4
TLSH
T11B15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 877KB
SHA256 010874aa7b46834fd14fc06de20a37479c804a5633edf65663addf6a7da2e053
MD5 b72fdec7c1bcd5de88f91963644925ad
SHA1 5a083a182863e31c9e7fe6e601324f7b983a9bbb
SHA512 1001e5e704bbf77112a7cf6b0c63971021d3cc99cfd271879410b960602edc2fdf4ad107478ec4ef1e520075458e63d942163d4086442d25d50783f83c496f71
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm34u:A3k03kHRJJ
TLSH
T14315AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 877KB
SHA256 4030ce5dd2c218e4cf08bb664f91f77514b6672be5e3aad13914e325c6e5dbb0
MD5 b94b338759d3f9f295560511b06928b6
SHA1 d6f15d7476a3a0ee11966a4d1b978d76c1408bb5
SHA512 40c32861106ed1f50e50ede1b0a94c4f990a7960197d14faaad8b727808143a5bdc6f6f7ca21b4ba4c451d76424a01c1360e8c33c08c56b326786808a2cad526
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3Zj:A3k03kHRJT
TLSH
T1FC15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 877KB
SHA256 a5a56b2e22006d821d0aa63f9f20758544f62b5cab1b8784c6a557b5aede384c
MD5 a38b45072534c541ef935e92a3254c8b
SHA1 4fc85ca6816bd1649e4f1223ef5a457dc0fd675c
SHA512 5f3fcccfc897028a5c2348aca494c1d54aa76ad076907bfd786ee15648bb23bded3485539fcd0cbbe0bc3cb267e6e8a7ca2e8dba6292bb80fa8907651f18cf2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3Ag:A3k03kHRJ7
TLSH
T18515AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 877KB
SHA256 359a5e32fbac45df06d4586cdbdc0ac79f2268745d94d0bc1ab5632aadc42cd9
MD5 4db12eb5168a532e75c7c43dd37cf329
SHA1 a2ff14db8ebf0bc770ffa91d28bf68a649578280
SHA512 b04dc57b3d5adf0ca395c772be6e06481568fe0b1ab862484f66db2fb420444e037a7898737932dded89f81994d954b99a8c94fe313037c25f90b3c40e30110f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3vI:A3k03kHRJy
TLSH
T15D15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 877KB
SHA256 8f5eb19717d317737318089bb5c2ba36379813ffaec3bce37961d2300bbcb438
MD5 557238f4b069ef9ebffba7c71cc54188
SHA1 a2f1cbdee5d427cf3ce0b7be0ac3fea453d1d9a5
SHA512 791ac4f248bc0a0d095107da51985bddf775f65fd250ca31e71ee13c338a68a7531c01b83b857a016ddf062687c4b30082c7e142debe6e56cc43d3d27de0e298
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3Vo:A3k03kHRJQ
TLSH
T16315AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 877KB
SHA256 426d1644d8ae06431154ef68e276edf12c8b9bb9d50df10937278a7b98f29ce0
MD5 1acd07df0a527f01cdca2f78f0682723
SHA1 1e93d8770768e5a376fccc24a33476d378d3ec3a
SHA512 bc57d5303cc2a4517791f8f4b3928cdeabe48f4cfadb7dd72fdea5c075df07c1e6b96e6bb6558f5267ff4af369dfe1453cb04ba222ff5794a76e009a81952ab9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3G+:A3k03kHRJd
TLSH
T16515AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 877KB
SHA256 1918dc7661980247c8a1f043f9ec4795d928fc2e9e38eb830ce19295c5ebceab
MD5 57518229f79a2e5ef487998b4745bb04
SHA1 9cb04d90094f062dd304ab57d367b0876a5bd959
SHA512 cc82af414763d2c15d9e8cc9abfafe166ef88800915eaa2565f189533554f1922dfe0283b436d1be9c182adae002fd2b113280dc594a76c87ff484d56f0b9890
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3GQ:A3k03kHRJV
TLSH
T18F15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 877KB
SHA256 c5823fcb990109ac7edaac3ab61bf78545ab323baa4a8ebe65a96b8e8781baf6
MD5 9520fb633a69f1ee62903c6db88b2e79
SHA1 a463d8c7c3a1b92abe900ed6e728db4c1a2a1951
SHA512 ef43c2fed981153ad26072bd4b622f6c9e1327c2675f3bb726ed21141311f71ead447fe4f1661e94cd1ce8a722d6737407f1095163190c0b406c22b3e51cca5c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3XX:A3k03kHRJB
TLSH
T18E15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 877KB
SHA256 3509f2d960fbc80b6fabe5c24b8d3e21f27fda988b7c70345843ae0be2a650cf
MD5 68182b8a514c1861d589126d8986f5ec
SHA1 f6eb9c4f78dc7c854156053971f3c125d28968fd
SHA512 0c377f2e8b823937b46bfa4b9acb2f93eb515cd29bd5ccad8028c48c246d8aa1514d0fb4f2e2227e45382e887188b1e23d717f2e21fc857d99cf82668d6aebc9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3NL:A3k03kHRJL
TLSH
T13E15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 877KB
SHA256 4c68e2d4420647c58c61a98d135fcf7880f3fcce1e0dc18e37fccd8f0e20474b
MD5 b4081effaca3f1b30f7bdb13e0061e69
SHA1 31f9d8a51f7f6a060405e21e0e16ee79009e6a82
SHA512 b6907695b461b8abc5be50b9a75251e7c63b1978cb6fbed242822d45bd96fa0b074e4533ad3950bd5435f442376ed9f341a2ac049440bbc730a766f25a8b48b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3LM:A3k03kHRJG
TLSH
T1C815AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 877KB
SHA256 9aa0b2ab68b0de94a73ada4a723013486ebcb7edbe978c700d56f5e44e8e3b32
MD5 d90fb3cc28bcbc409fccfa8d9566d212
SHA1 f4a90fe60093325073e56a380653dbba93bf44ad
SHA512 0fa74373375cc50c84454d569772569d22c97c0c7e4dd9d817c5399f841d13fe6c3f64b4550181934d5d3b6cc7d322f51e4eb859980228853b070cada76a6837
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQm3Mh:A3k03kHRJY
TLSH
T15A15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-246-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4008-184-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4008-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads