2a615239621712060458800fa9239f90a1fa2a2987d84865b925dbd8032f7a8d

Analysis

max time kernel
92s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 835KB
Sample260712-l4dekshz61
SHA256 2a615239621712060458800fa9239f90a1fa2a2987d84865b925dbd8032f7a8d
MD5 051222731d8af3984099f7d176c812ce
SHA1 46fe8d4822f935a16de1475c9edd8849a3c9ad0d
SHA512 d202d42f5a054fa242857ae69cab32274ee81e6d48c71aa2a4865ee08d2373225202d01b927ffa57b843325b055b9345eb34e0f412e18adc5e21c19ce0158d51
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Ta:A3k03kHRJ
TLSH
T10205AD03E79400E8D10AC1749AEA9A23FB75BC561760A7DF2358D6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4292-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c522-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e5-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4292-202-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019840-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2168-252-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-410.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-478.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-496.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-697.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-759.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-866.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1212.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c522-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e5-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019840-221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-410.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-478.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a52-496.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-593.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-697.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-759.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-790.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-866.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1079.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1122.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1212.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1359.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2168	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{3776D576-0A64-4D44-BF96-63E8D160091B}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4292	2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2168	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_051222731d8af3984099f7d176c812ce_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4292

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 835KB
SHA256 2a615239621712060458800fa9239f90a1fa2a2987d84865b925dbd8032f7a8d
MD5 051222731d8af3984099f7d176c812ce
SHA1 46fe8d4822f935a16de1475c9edd8849a3c9ad0d
SHA512 d202d42f5a054fa242857ae69cab32274ee81e6d48c71aa2a4865ee08d2373225202d01b927ffa57b843325b055b9345eb34e0f412e18adc5e21c19ce0158d51
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Ta:A3k03kHRJ
TLSH
T10205AD03E79400E8D10AC1749AEA9A23FB75BC561760A7DF2358D6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 61ff9369f72552b53a985d7e5760dcde23ee39102905385d4c44adacd4ab5246
MD5 5fa7fad3e173e4db8b1afac95636b801
SHA1 a34f1b473f7ac47d774f6165de7697040c3ee581
SHA512 598055e7587c81f57ff79b57f740dca09903b9fe2c661ae6750e54cf9d39d96acbefdacfabaf14d4f76540a4d92037b47a653caf2392ca4c9c9e97bf4c79158e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaP0Le5ji0hmxNrM:A3k03kHRJnPji0Aj
TLSH
T1B2658D17F6A402B5D067C0B9C6D6AA5AFA71384217309ACF1354C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 850KB
SHA256 455797d450c6c16f7c4a2576305755561cfacbeb2c67ac29c3f1b27b76b4b565
MD5 81235947a54943a5009585cfba107082
SHA1 7c5f6933addf2d10100d2fb8937ee2aabe8ad2a1
SHA512 01faf158f3b0f7910b60c5c9774bcfde68f967820ac9fc659c4324b6ff72fb6298f6c901eda44c505882327746678e5060092d52c15e6f97971984b50787ced9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaRa:A3k03kHRJ
TLSH
T1AD05AE03E79400E8D10AC1749AEA9A23FB75BC521760A7DF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 859KB
SHA256 4ab24757ff42985874cbfd4d3565b10a6c4f8b42a5a39eafef0d5e62f8843ae0
MD5 a4f2118a0de5d92d2ec8483f7773a5ea
SHA1 d219cd155436b28e514b264d7bdc30f0f793c62f
SHA512 2eddaba8c9d8dccf143413eeae5cfc01de52e1cb307bf9e0dd810f5b9518a685e74a29cfc9fcd7afb49d1c426478fb3da17f7a0ff0d7a4b1063f1258d5517191
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Tao6:A3k03kHRJv
TLSH
T11C15AE13E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 859KB
SHA256 a0359f1fae6c658265bde34a0a23484f4369ea079a1b0418502ae5360f6752b5
MD5 185ce8638131629a63b07fbbb815bbfc
SHA1 0d50d294b083bdaa3154a98fd015237515b37527
SHA512 43b0094d3d8c5d3e68126d5e524952cb0d53d6fc059d2a8a668f4a3c06f217dd961b2ad91813676d53f6d56c107d296ac796a8594c48ab51556424f4d616164f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TasN:A3k03kHRJS
TLSH
T1CB15AE13E79400E8D10AC1749AEA9A23FB75BC56176097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 859KB
SHA256 1f48e5b19ce4e66cf5a74be4a4629340e4f691786161a9969add56bb78fc8350
MD5 a1612777d00e4a49aa06029719ce07ad
SHA1 0aa7300812d2907d3a936b83ff64106554aacb7e
SHA512 295a19d3f0b2fbd4554a46a0254940e2946b7de32f876e0cc76ea70aa33c9fc2eb2e8e41413d6106a0e106a465f339a69787902f3babbe74c4ae56f29fdcef6b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Taif:A3k03kHRJu
TLSH
T15E15AE13E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 859KB
SHA256 00265107fc4b05ae616ba33fcd60d8067d2facb8e884467497067a5005b65dce
MD5 ceb616fba0a1c9d8e1eceb2c68e6414d
SHA1 14b6541f66336be4978c80cc804d4a615812ebde
SHA512 9ba5b1bc70e394472b550aaa5e1e795d7d44de9d83a76219000076248c3c868bf154f27c75101dcb0c288264c045fdf076cb438b8d5af8d92ed71ac175ef785c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Ta8o:A3k03kHRJP
TLSH
T11815AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 859KB
SHA256 26c1c7abe225927fbd786f47905b07ac122dd75d40881fea0181dc9b93d163dc
MD5 69180392d456a51e1b29b22f9e201a19
SHA1 c39e1516e14e5a13e25564a0a7f36d7d754767a8
SHA512 a7d617222b7f73086ed5b36b98659721adb6fae3eb9c3e19f2af4c48e1653bdd5ff14a293f12aab9042d09d60953cc8dfb359eea787bb7c06bc79e5801cd4e98
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Tacu:A3k03kHRJB
TLSH
T17215AE03E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 859KB
SHA256 33694d2a842280defeeb7d689c61ecb5eda2abab6d32176502871ea2537e7c11
MD5 aa502703ccaa1a9ace2521ec81e8683f
SHA1 ea5fd17f150d92703c1565b51f3589dafb065831
SHA512 89acb67789106dba9ccceee3326640df11cbb447a1e1a4d6d8b64982293c87d183e4adbe5889431d9b47a266b9230753e23e18d17de5f5860af89aafbac6d0c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Tag9:A3k03kHRJ8
TLSH
T1B915AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 859KB
SHA256 0f53b4cb9281a18accb9f6bf6b40dbe5a8edd512d5185dc9d26d00b2f5aec06a
MD5 aca9c06f87d217391f57dde9eea782c3
SHA1 46f4f8c4c0fb752ee1071cae15b4b0e9d86bdf58
SHA512 4131878c92cc0d31f71bad341472f30cb2baaf9c4b25444ac6b429cd2feb95cdc8c6f80bd03fd5baf95ae16567694d0969c88d50dd2c7338c2d8cba151b35286
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Taoc:A3k03kHRJ1
TLSH
T1F615AE13E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 859KB
SHA256 2ff5c8cc445247505fdb86da474c5f5d81a5b0314322bc5090fbbc64ab795fb6
MD5 32f39feac450181a0b86156e01594896
SHA1 2201a0311ae9ae96604a9c22ad3589abfc32ddfa
SHA512 c77dfef5d2f64c8fe6d17db5ccacecaf0053e87e2fa0e577afe56146702536668377fa7e9cd7ad65c12bd358dd803177935ad07ca415cfc2184433fb10417fdd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaBp:A3k03kHRJ7
TLSH
T11915AE13E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 859KB
SHA256 219a1111d393c7c2e2b45387a9f0f8a0b2247b7e797a84c0befde0f521d7b429
MD5 c8badfaf57e8ab0d3a45d3ea74fbcfc1
SHA1 bc59ed30ece2635b761398123213c930e2dfda3d
SHA512 8dbe99f09ec93bf98bcfbc8a8a8cb69f6031bd2f04ae3ca5e954edf9606efa2eec6aea7ea6ceb8c9144a9c16ced210ba1e43a16ecea022086a95b24793f34860
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaWN:A3k03kHRJA
TLSH
T1BD15AE13E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 859KB
SHA256 0957e5e25419bb93d67561e21c72b52113acc597f87a42e8e519b97e33607db2
MD5 68c92b2662a728191aaa66edce59b390
SHA1 041ca5ee4ee9b2e8178699348250877238e23bc7
SHA512 836ebacd51f7b33b8965f0fc886cfa1f60ce8532656f999eb1b57017e3c941d1feb1589d6f180b2f1babe9678aaf186159e3c46b526b9515a062d3893f9c3550
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaaF:A3k03kHRJ2
TLSH
T1BD15AE03E79400E9D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 859KB
SHA256 b3c4cfae3b3c65562cdc053816cfdaf17627de9fa15c77fbb2cde558d5c3d7e9
MD5 ed38d4725c0a0a698926c1e3d8615e4e
SHA1 f01da5bd70aecf90c345c7f5aa057bc26996b673
SHA512 1b4c16b86a45cd797b9f5182637810c0c78dcaffe374aeb98f22868417679c5a928137850e30e7130894d941945e5ea118dda802b42a22bab859ff32edb0f9ce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TavC:A3k03kHRJy
TLSH
T1BF15AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 859KB
SHA256 1dec65bb9e6bb55ef8550de3e5ac7292cd0af40933e04a01e05885c8d16ce294
MD5 6f094456686c99e0d9408ca5609ec91a
SHA1 3762912d1ea56dcfe82f1649d08c2efae37bd20a
SHA512 86265b3d3d2661cbdbd2bbed74b8da6b801a3bae9e1cf88e2ab80c526d14a92da30c5c51c9628456d4f3d217fb28f7586181bfc6394ccc6462b467bdb237f64a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaQw:A3k03kHRJH
TLSH
T1C015AE03E79400E8D10AC1749AEA9A23FB75BC56176097DF2368D6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 859KB
SHA256 85dea52d5bd1dcceeedffbcb40977a347efcff69b5e54272bca2592bbf60100f
MD5 9fa8dde5f9a5bc8ea4a9bf88a5090242
SHA1 a5bcc1b14d474c041240aea277f4077fcf78510e
SHA512 13d97036bd4d1ba92a105e095508ca6a79e08c1a3cb7dff1a6af5eb9e59c6a2e161c18b19bcc738cbad40b6d120afb1f79d3c403383aca2028f2eb468280949a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TavT:A3k03kHRJD
TLSH
T14615AE13E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 859KB
SHA256 287dd2550dd1c1367663a443cdfc9ce794b91643df6bbcdada335fac52fb0182
MD5 2157fda6dfe7c35c5dc04cd8e7265ef5
SHA1 66b85f769fa4a0215919f54bcdfc5d712bba4b01
SHA512 de86fdc248be96af4fde53c22036ba3a0986352c8e95d78943ede50d360e1ccae73541b867bb335fcfd6a0c3507ffddaacd9286933877aa6cb44dc4a9c3bbdc2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Tapu:A3k03kHRJ0
TLSH
T18415AE03E79400E8D10AC1749AEA9A23FB75BC56176097DF2358D6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 859KB
SHA256 13b21aa657bf7c7389110ade8ee007a3e0870c596fb6aa315f552481fdb8e3c4
MD5 40827a7f5eef67bc056baa2a8780e554
SHA1 e7c4b97e74410de8e483e9ba70d5e9749ab658d8
SHA512 4780d5199e65aa26dde64647e01f6eb0d7947859a2ecea3657b68743d88c88952fe137861e79b1d6f2009629a25f22cd712682e62cbf265666eaed10781a2ebb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Tahb:A3k03kHRJd
TLSH
T1BB15AE03E79400E9D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 859KB
SHA256 620a821c78b5a31680b8fafcd9046dd8ab65408dc1a2a900b2564dc2e7dec0ac
MD5 0905832e1203471b324ded6300b6ceb8
SHA1 8e52bec7c931135d2d6ac013c9184f5bf28eadf0
SHA512 bf5243b88e0d6131c1b00720b62fb769631642f7a043fcfbb3ca7a4153d8bde673cf4cd0a70bc717de4cda6d85faa4e740207110fa37d7886e7b297a84c44a67
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Tapf:A3k03kHRJN
TLSH
T17815AE13E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 859KB
SHA256 f609f777ae17019f936fa5ed156da8c97d7ccca84e47abaceca0a7e6a02f51dc
MD5 44d1c0092b9302caa25ad9ecbd937a1d
SHA1 3473c0b9918f0de85feffd6fcdc2d4cb364a37ab
SHA512 43633c8ec8d00c796add462fa77e54661f58fa33579ab48b071cb459dd994f4693f3952eb093dd32ccf3db5fc0ddce5167367544b69211a687b114047ccfed9b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaSK:A3k03kHRJF
TLSH
T15115AE03E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 859KB
SHA256 df998d114cbfb8329a6010b8ced1b455ee0a55b4fdf35245e0146a2175c3e5c4
MD5 8b9791400d2e4df9db2a81b4beee1809
SHA1 e739f26fff325485b66628f1bae67c039e9d3397
SHA512 4e924c71c372349e8e7a0f3a6b981e9edd55fdb0607f22644b064bdcfed2271fb2e69801a6660d0c00cd45c5f2adcfd734305f6b1a47116fc9b6cafceac03dd1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Ta3k:A3k03kHRJs
TLSH
T1DF15AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 859KB
SHA256 7e4404f0064c912461c4e28bbfc1a8763b62cdaf988c6ffb54f0e66204216a66
MD5 316f00b3adc8427f97e3a14a3369b597
SHA1 da02cfd5fa1632ae69fc65ab6f95055cc6e224be
SHA512 b855e512b96a5c0ad2537dcd5338027e5dd59cd911d5eb5237e604b89850a6208c1add74f062cd5f0cac9dc5e75c86dbf82c38906da765f5de323259829ceca0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaA0:A3k03kHRJF
TLSH
T1CD15AE03E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 859KB
SHA256 6dc24cd97e66881765d6fa472c8fec45169f2c5d44fd34c0f839df68312e5745
MD5 ab23f86cd0c48952d82524104bc80484
SHA1 aa580a17d018002f40abf18ec8302b45780f7a37
SHA512 d3f1cf72cf9e576c0d513144c958b6b12806099a7232311f5350fbe296f3fc2459f77a7d2945802303ee1d653b9f57562cad78c8f4fbe4bbc78bafa82ad3038c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Tabg:A3k03kHRJk
TLSH
T18415AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 859KB
SHA256 d4137d7b5786f5b1bff4ff252250d23b750413ca93eabc917ff7ad206c0784d8
MD5 a79ddc55b8e970635c30d5654484d3a3
SHA1 0b2151dfcc0067cb4ecb9f9effa195a7e97cef2a
SHA512 ffdb8b43ac571d6528ccfc4ea02e49164ba77f0485e761d702c6818be94ff22d4be4991145d21ebee4134bbe1fcffadcc561842e70c83c65fc82cc8c7520093b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaWr:A3k03kHRJ2
TLSH
T1E715AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 859KB
SHA256 00867c25ce4a4869af8790a4578abee9ecc87836557f5493da305d5710c6725f
MD5 bae2931d419b39b3c82327de28dff03c
SHA1 1050d58f6193c81a9f82a7a95b6cd4c36f373876
SHA512 c1c21d5cedbff3464b5e7ae5f178cb307a5eb45fca9b450a6ca25ac59f2dde67f7fd6720b93cd3b91cbb42df898486cd31841523fef0dc4322339044c7b21bed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Ta8n:A3k03kHRJw
TLSH
T17015AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 859KB
SHA256 1ed2d00ae32633bee2f435e8210feda90d99abaaf673e4e32f065eb2a70d7182
MD5 2233f811b435eaaaf1b5e36300453db4
SHA1 cffdeb020f19626a4c3440d2a8bc18fa4c706e66
SHA512 84372450260b9240b0f817336e8c2ec7d32bac6d2cc940f5313a1bb5d30fae3c4f3f47fe883954a8768e10146249c9cc4a9e180aaa9f8822b20e9c6f030451ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Ta6x:A3k03kHRJW
TLSH
T14515AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 859KB
SHA256 aa83f844f9a21c027cd3a27b227154f2a7136ccc5690a736eea23f8d76373197
MD5 de868d6ebd2870ec07bc2d2bdad61803
SHA1 76f156d10dc2af70c8975762265b450f1e137951
SHA512 b72d0b740ea702fc1288e6cdb9e599dbc454ea72971b90cae96531faf4336f18b2953a6309fed4309c8b91d094cfae0ad2585d0229e510dda9db32c98786a07c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Ta8A:A3k03kHRJN
TLSH
T16D15AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 859KB
SHA256 a78d74eb39485260bdd9b01608915fdbb680782ddbcd59901b472ba06d1f55db
MD5 9d052fb91bddf454bf7ae448e795e77a
SHA1 bc9744f68f04e037316f9daa73ac7b6281b871c3
SHA512 2b701aea07b3044ae7660232ef8b2ea37a14e153276d5b4984366dc55eb0b211d8035730c15d7c2c6fd121ebdf26f99375db88b722dd66d0d259e636da5d7814
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Tal9Q:A3k03kHRJc
TLSH
T18615AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 859KB
SHA256 bec50efb6b0db13c78817a3ee190fedbcd2ac2340e368718b1576f17a8c7c593
MD5 c6d167ded5b5cb66811eda5b0e567b08
SHA1 5707cf50cc1b1ee20c4437eb2da4ff3ac4ff4678
SHA512 1a04e8111f53027c6f29df3ebcd7cf6e9d3b22d907ca7557a7094581a5aca24c2413b7e5e96a2f395ca1bbc12a2f9d2d31184e69d0cf5252c906d1229dac4195
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaQ4:A3k03kHRJ3
TLSH
T19315AE03E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 859KB
SHA256 17f44c43d62a1d83a54d9d21c05179939ff787522655d7448cfa5ae6cd63f66d
MD5 4bdf5316ed378853c36cd1c88c930aa4
SHA1 1657d99d0340603cc398c4705bafc1e778c10b5e
SHA512 7ecf973a8f2f8b8f0ba62d91b3829e69bffd6927740024e56f5db90fbbdfa0e079295bf7ce8c77e31d4649773e4bfee45db67fb7bf529bab09e67f295d580644
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaTu:A3k03kHRJ6
TLSH
T15015AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 859KB
SHA256 4f0b4114ee26244eb191afb27a8a49ed47338a0f744efaf223f5b2b3d2ed5304
MD5 870730cee38c03df0c11640fe74c8d73
SHA1 3a1277eb62a19ea307c89f0937fc5c548a75fa94
SHA512 1e60afb60644f628f982ccdc844899c4323d2b7b568152728ee1a4580b3071c7a89ee49e576d9feda22a80f2ef62d7febea75fb0d531f3507862f2497d0dfff9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaOj:A3k03kHRJU
TLSH
T17515AE03E79400E8D10AC1749AEA9A23FB75BC56176097DF2358D6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 859KB
SHA256 6d1c61805804cdadf06d702246dee1090a4b7e92aa04540fa5faccaec5926979
MD5 68aaeabe43f4f4fa2410e2d928b482f0
SHA1 1c018ea23ceaaa6218dbefb382d33ae39991f3c7
SHA512 007dacebb3b23dd0560dadb28adfd12001341db71c27b1df97f1af36fb9c1c353336e98abce4ee14ae298c89f03ba0279522a266130a51d19571b66f2797a507
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Ta7g:A3k03kHRJc
TLSH
T1D815AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 859KB
SHA256 2253b7274f823c68724a4c461df89e7c6d872b77d72636d31836b6b299af01c9
MD5 386435cdd94a5e41c9781deba5db24d2
SHA1 ad604f11c69e4a3c01602be11ff49a25adbdf45d
SHA512 13d9950baf7742a7441f7dd4134b8841d069245369abe5a6b93b345b0b551652cdb47fea3e4015b31896bdfd5ba94ac984dc704e246bac44971b204cc12bf15d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TamI:A3k03kHRJ1
TLSH
T17915AE03E79400E9D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 859KB
SHA256 40d254ce2022a078240d8fc0570df305dfd76bddadac030f15c9aeb91b7e26ea
MD5 1934211a2df3cfe7e7cb60c670e98218
SHA1 b2db73777c5832b62ca234e28014eb9b1f7030bd
SHA512 ab933422e57156f8c306e1227aabf35d1a74f8e69c8291fc7407a06d9cbdd7168d3616dbae54ed1de8d662d8f698241f2820acf1ecc9335c964512a0a53a1a06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaUo:A3k03kHRJj
TLSH
T18515AE03E79400E9D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 859KB
SHA256 c969503d1c62e3426bf45a894815b48d6de71e405ec176e0e975b1e2eb524e55
MD5 fedc440da6a5b7236184e039ebcd9614
SHA1 f4ad56f95693903cdbe612a48a13fd592d9a98e2
SHA512 e4f2646c435d2487b81475ed51dd27cbb8f5ce0ceb1ed9ee84a32ab6e3e6a5a359c2cc49803aba831f27070e8b21d16c6822325e0f8f5bbeec6ab6ba3e37fd23
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Ta3+:A3k03kHRJm
TLSH
T1C915AE13E79400E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 859KB
SHA256 e16ee2d6a845216779c9995f2a9be7a10b49d617e9a6c2156bc1acd6159bd2ec
MD5 f7eb016186081cfb4eaaeee11d2a29a5
SHA1 09fa3ac6ddeac61b548e2a50c7f137249912485f
SHA512 8625e329297c7f4252a72283f37aab165d0294728d626a3c49870a9ae50586366f21e2642c6b1d86d8f1216ffeecb2aae43ddc86b2a11c217f522f56ccc4971f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaNQ:A3k03kHRJi
TLSH
T14615AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 859KB
SHA256 70500277ba0fa10161122b84e9bcbad8da0f70f2938ca646b11d6672a5dcc759
MD5 a94c020f725d3f9df49ea0da5977f6a9
SHA1 38c80088665bb970211092e11dbf70a69c8bb7fe
SHA512 a5b925eb0985ffb35a68e2f3a26c7223808116f263fa7b1e50e8926394cad0f30a612fe3717e65248f6f5e8a3ee1cb7cb9e69c70efe18b782c2a41568c5ec3d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaCX:A3k03kHRJy
TLSH
T1E715AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 859KB
SHA256 0b0e6af7d550e353b439fab390068720bba93d4548c29bf2d686ad1053ee354e
MD5 dc1bbd8be504d8611e623a6c04eb8887
SHA1 abaa5fb5a45f5c4a29ccecc8bc0a94f3fef87fd3
SHA512 b4232cd60bfe7b611e343e5e5e5a2aacc63f61bca9971f49bfa49a005c2af905742fa4b94a688e4b81b18bfc233e7e0fdbcf26aa9e6448e0caf241f1ac9b5402
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TakL:A3k03kHRJc
TLSH
T1D215AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 859KB
SHA256 e53b60bb8d8f7185cd9292ec2ca7b86a87d911651fe32113293744d6f7dca149
MD5 0fdfffd71b380df71bb815ebcc2af237
SHA1 c266b118122970db41c8557244c3890ea2c1fa3f
SHA512 2ccd8949a895fa83c052f5c331f115142e04ed850463beb9d768e3c1f32d0b6fc25cf8f359b81cf0a2a15d62f82e473fdde3ea9b8ec838e7ca33488240f17bc6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5TaAM:A3k03kHRJt
TLSH
T1D215AE03E79400E9D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 859KB
SHA256 31f92009dd7ed6a98bcdb7cf68706b5c652389e4a22d8543b0c7eb9a741d83fd
MD5 c7a93450d436e0a10fe4fa857e87a226
SHA1 14a61c330ff03e9daa4d4a3a5da590358bd8227a
SHA512 fc7e3b0a65f64f85731a074deae1d36572e5a3f6f4525b8b23dfe1d7929ea82775f6b1a11571c0dae8ac6d31847c3f7054c1dbfddb4eb3912bb1f5f9365fe4bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpWS5Tahh:A3k03kHRJH
TLSH
T1C515AE03E79500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2168-252-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4292-202-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4292-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads