f11ae2ffe3108cb7cf097f8ac97be9673ebfea2f23c0a6382e79d18166cf7125

Analysis

max time kernel
91s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260712-wlfr4agy6x
SHA256 f11ae2ffe3108cb7cf097f8ac97be9673ebfea2f23c0a6382e79d18166cf7125
MD5 02fe5bcbd6c6033eec0175f84a6d6483
SHA1 70107510f6badb2063da405c651f0312a3a4615a
SHA512 47f909b6c1ddaa3bda6caab9e0e9bb3dd1b0c67e254ec34c1239242f6c5b638b22b7bfef2bcd378a63ba3a23ccfede04678bda0a45fca5cb274f962ec8b8dc6c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascF:A3k03kB56r5
TLSH
T13D157B03E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4328-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c494-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4328-202-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-239.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5816-258-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-272.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-464.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-702.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-819.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-851.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-972.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1033.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1058.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1119.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1144.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1239.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c494-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-239.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-272.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-464.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-702.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-819.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-851.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-972.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1033.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1058.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1119.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1144.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1170.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1239.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1343.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1368.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1388.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1389.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5816	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4328	2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5816	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_02fe5bcbd6c6033eec0175f84a6d6483_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4328

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 f11ae2ffe3108cb7cf097f8ac97be9673ebfea2f23c0a6382e79d18166cf7125
MD5 02fe5bcbd6c6033eec0175f84a6d6483
SHA1 70107510f6badb2063da405c651f0312a3a4615a
SHA512 47f909b6c1ddaa3bda6caab9e0e9bb3dd1b0c67e254ec34c1239242f6c5b638b22b7bfef2bcd378a63ba3a23ccfede04678bda0a45fca5cb274f962ec8b8dc6c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascF:A3k03kB56r5
TLSH
T13D157B03E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 fb4c966367ec5a58bfb4a88d7f341f47369a4d840ac5f30ceb891d3ea976a109
MD5 ba587889a44b7adb4fe58dec38b0b7c5
SHA1 7a0e5b892174f1b69ebf3d54b9f98a75aa3cb2ea
SHA512 1f8513d8500814811e40822de64e2f1bb21581076a5b0114d2ab5e3b2d59d9704ca4b934bea81d57189f7a02a6a35b2f3287d8ce7263945c56be2a15ea4ccce9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascB0Le5ji0hmxNrM:A3k03kB56rlPji0Aj
TLSH
T14C655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 953KB
SHA256 30446fe601ed032e2400c1dbe6d0793eca87ad9b72970f7de9793f86ac714148
MD5 2a92a23eddaad6d2355881cfab8019b6
SHA1 e135c6a0c0631512f926139ed85d9a7e52125684
SHA512 9bd7070532b76a6389e1c3ba1915ba4d853ddff3c6f438e5442361a61a6fdcb43abd0eaddceff826f1dc23c568c63c3688315fa0f0da3b144fa78ac97ae4566a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascDa:A3k03kB56r
TLSH
T1A8257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 962KB
SHA256 b77264ca7937ee01113c353f9ed1223daba8d40b770e6d43382728c8b0d12b4c
MD5 7e995cb462ebd608fbac5f660b78271b
SHA1 732c65e353e2681b8823dc084c91c38105fcbf72
SHA512 1d3c6ee2f17c689472ce80ac993ca01022d56b246c149898beea0905914f1081f47f351b454e0e2eac0b2cc1b777061c58d743883004b5d88b531761231ab0a9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOasci6:A3k03kB56rh
TLSH
T1AA257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 962KB
SHA256 2b791416133e074f6ae3e163ceeeef65bfa4b39df5799b3826d6c835feda4b06
MD5 313b9d718aac37990235294dc298b397
SHA1 95160f8ef1394f99f681841ece24468ed956fe05
SHA512 6ce836dce30e8c8274cd92ebc9df353092a00975b68740e07d4ab82d6d8e05a3cc1fc8a3662c4e84af7b02fa17b1eea661dcc8f8407bf30348fdf740b61f87c9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOasc6N:A3k03kB56r4
TLSH
T13C257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 962KB
SHA256 5683e43ab9148bc601a0aa9441ac019611821dc108c835c7e979bb7cddc6e8e6
MD5 b7466583deaf322d9983a27e310f5451
SHA1 322bb0454c7c5805bab4d444e6db9965dc19f5eb
SHA512 cd9ecf75f9cbac432bc7502650fa0c947cff18f545e43a658ee53f219bf2b8c6fce37f797b1b13e475739e190289ec8e675a694f17c6400a7eae31eacba6a41a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascgf:A3k03kB56rw
TLSH
T1BF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 962KB
SHA256 5aab7fb54f72b2127656f077966fabecc61bd05e0546bc00173cdfaeec63a0c3
MD5 2cdaf57d5ebf4ae90bcb50c9dc1aac77
SHA1 2add4aeb3fd409b443cab17474c8854f51031b01
SHA512 d35c650218408cc07a2e225c698e5a4d8c0d80cf920046219f2a338a3f3bf1f73f25a3f0e175c7ac7d0905c9beac03a367c27630a8befc3e07315d9ce3ca3c1a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOasc6o:A3k03kB56r9
TLSH
T12B257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 962KB
SHA256 dca020fed325de090e6947cda1488161d63613dd4faeb911e9a1fa27cb740623
MD5 e76ba1c58f52b1d07d64f39542b037d9
SHA1 d6707a028bf97a9e282dda12adc95f664885db43
SHA512 9388cd009af6a5c185031759e15b10aa2f5cc2c489344e827975df1c21e49b45004b846a6cc51476cbb44d91890c65a9e250a7e9dd5d4b9f327fb97a9277ed21
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascOu:A3k03kB56rP
TLSH
T19E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 962KB
SHA256 62892ade24bc5ad02466b4d5be2a88e4b81aa3dc472096c4c70c274bf80e4f2b
MD5 5efbfde2b7cbee00fe9b99be575a065c
SHA1 97ce6d95a9e5804a9ac5dcb08be8eac9f7b5b923
SHA512 969fcfc5814f6d8b2570dc67a8684ebe53c5df94f65def9e1128da17de4113d5ef64db0078ea139f3d86c9bffa2b697f102cdfc9e425822679a041befbbd643b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascC9:A3k03kB56ru
TLSH
T15B257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 962KB
SHA256 05aa319d9fd7d6b8e093ae3079cd577acdad70f2392bd3676daba2ecc1df7bc2
MD5 21b4d9ac12d4b0ecde01c01b6dff9a6e
SHA1 f68c9a343e294e6b4e98a04384e5d89a2ae577d8
SHA512 2a0686ea822e16f29daea2c57d0ca0b7f1eed7be6c77d816549747f2407551cf4d4820838a7044a7e39161a3131082f3a69c9a18523952edc256a78565c5fc13
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascCc:A3k03kB56rD
TLSH
T1DB257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 962KB
SHA256 3c40e4b50e85e82662b44505f4c274235b8223563b900c95c875277be38289ac
MD5 3055dfdfca1238dd7fc2ad6b131dacb3
SHA1 22047bc78ee0c07aeee225aa996775da965cc05a
SHA512 e1547c6c1f69316863218455dff2da02bb1a520f0bfbbdc549a00fdb2202dad7f9da168182d4f14b30cd72e6b6a8117ccf14528c09f43b9ac3d812fc056b1ee8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascLp:A3k03kB56rB
TLSH
T132257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 962KB
SHA256 29776c9c5b22853b10520812e767322e17b592b029fa435b6316508109652487
MD5 11295e53604ab80c5048d35184491133
SHA1 8f2072a8ed892586c5c0506bef341e30cb9da472
SHA512 aba02a4d11262aff24e3fdd5d8aaf4388516d79366921b033a378b90bc14f96e3f168fea2d92284e7206937f3114ff6e9d1dc4203dbc867610e598c3173bc343
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOasccN:A3k03kB56ra
TLSH
T185258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 962KB
SHA256 13d1af6f019856a01ab8b89fa70ebc804ce56c2e1472b2403ce84edb30bab2fa
MD5 d430ca00f13da5cb8927cfbc16c2f1bf
SHA1 af41ee48b7e6a1d49ad49d326185824b7d239902
SHA512 827305778551b07ed0601d27d68d1e20512157f4da8ca0480aa6ef6a67e428a66a77bf3c22dbdbcd812c472635cc88f12912d202de6f998a6eab330fd36cf9d7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascEF:A3k03kB56rg
TLSH
T15F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 962KB
SHA256 eb6c1325431f3263c9c7cc7ebde7b7630ecb31efd700400ac573f7725f050f37
MD5 7fbc341fe5068956f8e418439929a628
SHA1 c92ff8ad929fa4e5526e28fc36104185e1f7a1c6
SHA512 24de6947ad5d76dff6e7f6c18b723b35f43b0a57915cfcac4fcae00f9de3015b89e97c8f4d555590c0219f972f7a96942778e02ee9e21a77b2eaf6cf48bc8bda
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaschC:A3k03kB56r0
TLSH
T12E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 962KB
SHA256 e4540ee68b80029a19c6dc5451a7a25e6a72072174a33c645312c21c508308ce
MD5 2e37b8771404b0395bb2720aaf8272aa
SHA1 a9e45d8c7a4a4abfe8bc41b6c81a36bc25dc97cb
SHA512 a92f2a15f3a6190ddbad16319849424c96dc976f352aeb8b5d32b2b7295d698f5f002280bc4c73c5f3f98cc2149e92c4da391855d2a11eea8828c1ad2b5b87b4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOasciw:A3k03kB56rJ
TLSH
T1F1257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 962KB
SHA256 4bafde220f77378b6935f704f11725e8104a2844dc62d9f2abce3531604bcd52
MD5 95150d51dd4cf74e433302ea37f199ad
SHA1 df4dc2b4dc754f5bb7df2150a3967f0cdb1bca4b
SHA512 e336d1f024c16ae2795d5927a3713e22d877af66a1ae79a92e913f9b506f2e5272f6b1faca3c8879c675d774cd71eccd3e79894b5d434bfeca91f52965af7e92
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascpT:A3k03kB56r9
TLSH
T11A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 962KB
SHA256 c77f88bbf1d2a0dcf07af02a6bdbcf60a5f9def12e762be21af181f0e8516e96
MD5 958f7c1f0ae99a37a6d631acc5275343
SHA1 fd3d359ebfa70be41f565c957a926bc99ad2d08b
SHA512 0402ed0c47f34326134bb349c7201373cc3b8902fce857e0c5955d70b0c8f55ebfaf4f34e036587dc65c2aa64331ecab61bf84d8b1dbc236bde711f3538658e7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascHu:A3k03kB56rC
TLSH
T1E0257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 962KB
SHA256 0ed6e3780facd796a347430f195a5d90b831d063eba15c580ebf9fbeb504cc57
MD5 adcb8e4afdc9f7d7b67d312e71767bbe
SHA1 7e35b5533bd1e43724c3c1c139291da783a9b55d
SHA512 e8212d488fe3dfb3f379bdc872ce514fa6214aa3f1769ec150baa01ba07db4417116b3a6f5131ba215161ed0ef3d7aa23efcb1225e3e52defb58af73b45e1114
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascbb:A3k03kB56rz
TLSH
T1F4257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 962KB
SHA256 72f96a49d51184da4d1b317c8d53e1afcdd3d1268565f32ed32d4a2142bbd7b0
MD5 3ad8dae32e32c5c9969fe39d5bb8c8f5
SHA1 1f2e58cc60cadf9850cf81a683ef8a44496c585a
SHA512 ee203d8973559bed77625819e354595c93513305e5b121bcb33ffe72aa68abbf14cf328ca67418f22b4419a2524560dd8bb014a2cc7aeddbfffa6bc7dd84a69e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascvf:A3k03kB56rr
TLSH
T139257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 962KB
SHA256 0430c0be9edc58b91c3a1af513450f93e1f19271a22caaa5fbdf0b8c1171ed77
MD5 f66a3ccc92e9999466a8543f4f2a4540
SHA1 a864590d94f0fe5d1aee75a80a92f7fdeb13791a
SHA512 bdb6b78e5ad8980c4c95c359c5377137b47ce44580633b02c20f9aad9a571a9e6c187cd857407f6af5aabd5ff3d579688c8bc018c91f65d35b2fdf3e90b6ab20
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOasc4K:A3k03kB56rb
TLSH
T101257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 962KB
SHA256 6d37490267977f10e39761f4b4f48714826caeca4243528459f6c263689e4520
MD5 8fad8805ac10993c0ee5853c7a34a28b
SHA1 c260c305cbcaac46e95f4797eb4073a16b9e316a
SHA512 598f037fdb5a7b9ebb2d11ae274ec7f36cfe059ed47ed85f7c77fccc227c144c6d2ebcfd9b660304b184e5ca5eb0b350658cde548eff161b0473281b01159dfa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOasclk:A3k03kB56rW
TLSH
T1FD257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 962KB
SHA256 d544eee2948dba0489a52f674c160889a3c3dbcfacf2ec3a4cbf70f90bcf0394
MD5 b3fe656cac193ef6ff9e6e07b223e347
SHA1 5d72dde51f31ef2f5248c8e806fa91149f2711c6
SHA512 95aa95c8d1233a72b45fa8943654e18d309588b9a5a0f5e698687e9feb6cd5274bacd7661c98c913984caa2ae8b7842d88d893c61171aa971821e33fe941e319
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOasc60:A3k03kB56rr
TLSH
T1D6257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 962KB
SHA256 1e4bea998a8a69e9c26fda1966e197f04a5c7c75dbccb3426d36155d57e46db8
MD5 a1e2898746ba1e3d7279019563b50c33
SHA1 e9ab40f6b730046246e2cac382453d00b4347fc6
SHA512 91597bfbf7bc94efc030819df468cf1f41c63602f88d4cabe82b67360280c4c7230a0a51f66cc8174eafd6060189ac16afbeab9668ad5fe6f641bce231c2e01d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascpg:A3k03kB56re
TLSH
T11F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 962KB
SHA256 dc59385798e30e4724e150f55c678cf3e839970684d95645e9fd34923604d091
MD5 7b609405e303e4625b05db2c85e3e172
SHA1 3f34c5b963f8b2e26a9cd7f49197e82eb7d4a94b
SHA512 6e364145f7682ef4f012110a704c7886d20db7991475c3d9403c3ff191f206f27eea90022d92cd4f2e78321c211934f2db38e1cf51f4c9c8aaa48a87d5cebcd6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascQr:A3k03kB56rg
TLSH
T18D257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 962KB
SHA256 0f0f3c64ae936ab515a3bb1beeb522aac79349970e17a1192d7374592542343b
MD5 51d26614c66a8ba1e4eb771399a7f0be
SHA1 a3da77f3bfb1abff5aa76a30b0464fa54bbd9201
SHA512 c02f94e82ff810cb3f368f4c129028d42570b74b1075111f2ddb196db33d2dc2765d0594769630d1ed48f9af285aa6be774c5683b8561e32a9cb49d480d6377c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascOn:A3k03kB56ry
TLSH
T1F8257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 962KB
SHA256 290d6c82d206073f9e432168d5934d2c5163eb747b3161d6a69ab05e7ca4af0e
MD5 1f05438706ecc56f0d2f8870151cae6b
SHA1 926dca876f8f58289d71d6615f492b2e2e1edd67
SHA512 19162b528b1e2f706caab3c74c6045ac34202b0409e41cad7cc1696755ed8d7691802abd962b102684d0b66f88e4a6a955e0cde21aa42106f2d0d5b886c2c594
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascEx:A3k03kB56rA
TLSH
T1FA257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 962KB
SHA256 db2953ea4e7417741d902a60c3c737097142e11c76d007a075374a11fc32068a
MD5 ea5a1c699c122ff7c5074f2ea94148a3
SHA1 febdc47176c7b10edf0371b1c78f931f96198437
SHA512 7b6d134cc4c45e6e880c82abc2a5f4dd976913d91fea39167d59b5f58a8c4cf96250bb3f3169fbfa99b11ee7dee6269ed6012c1491ae9e7b4d003c36c4ac7d04
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascOA:A3k03kB56rj
TLSH
T108257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 962KB
SHA256 c62f9540e19a8ce664a28d6e45ca3f15472f049ead1ce93be7fde780e1ea7834
MD5 d8c5eeaab5c019826c8d8d10da34b417
SHA1 cf38c0f7970642afb4e6c52f1d22bc914244bf5e
SHA512 623143d78ea508748d9f2cebb01f392ed124acab9fb60457ec104f9a18b74da21d7f6802e07ba97e681ae40e9432430fe6904c3baf757cf11ea75dc01df1b186
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascH9Q:A3k03kB56ru
TLSH
T1B9257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 962KB
SHA256 9673405dc5f0921a23133f97d1f462e76fc26c27522a1e6ff965590ad1563158
MD5 7662a879e2ebbc9e83fb6d80b6468fd1
SHA1 e1796114328275b4c3e67caa44e851b5c862a832
SHA512 e437b79c37d3fabbc07a83c6b5aa5ee49e26273d9d7b62be10f40951df2138536e615affbfef53ed39d5fd0fc6733ce6f25b90339861b4cf1f7eeffcfd31b218
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascO4:A3k03kB56rN
TLSH
T165257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 962KB
SHA256 1620fc73231646b4aeed22922b012e772c1eb7620e8b58eaea9745f1b5e58cee
MD5 38cd413ab96b65b5a2bc832553773dd9
SHA1 e417beea0dfa4fbeef701c088c45e9368bfd465d
SHA512 871da40fe2f1e3e21a737fa3275916432cc29d3e108cbb0cc33ca70d45163d4f1b639f04c09b75addfa3fa681a74bd8550053e11090c6beac8a7c0353bd4ff4a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOasctu:A3k03kB56ro
TLSH
T138257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 962KB
SHA256 d2e2f346241c41a65eed563f87f6c96d8adb776a9918f4a63309cf5092a330aa
MD5 7c30583c9e2dea4ce83c9ab94d577810
SHA1 715b0baa7689c4ebbdfda784e7d404414137a7bc
SHA512 615005f403021b8dcfe6be065af0650382a484de8152a2042e0426f386a4dbce388e1a57e742509dba62ccdda1f5036fb2fa15fda21856e66b7c3cfa800a2cac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascgj:A3k03kB56ri
TLSH
T18F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 962KB
SHA256 971671f5c386a97671f2538de33aacabbb0ca55fc907dee937e9e6897258c493
MD5 1ce620b06c2766a668af9d95113d5fa2
SHA1 da71c9c374956fbbcaa554248658a1e1c69cd1d6
SHA512 24155545ae9ce7837f4b81611eac13046adb33e5d9118a7c6e3c427e542235b701977029d27ef37e4cff51e857f3d9b3cfbfbece0650468166c24337a707e963
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascRg:A3k03kB56rm
TLSH
T129257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 962KB
SHA256 8797381e2e143648e0bcdc18311b1c84d4f8e5dc73f459a1571cca7732b447c9
MD5 d83d81c04344549e9a1cee6c74f2f0bf
SHA1 f420631179f9a2f02af624b855ffc7cedd902586
SHA512 ba4d9827dfea915643fc30e6ff0ac0a83883e79d07109aab08dd1ef5a64ef1bf322a99509c3f604f8d334f16917abd6f7fd88e09ac5f175dd72ffe2c9b8f46ab
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascII:A3k03kB56rv
TLSH
T1B0257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 962KB
SHA256 77124ebfb6117c7da10293f220b1508512adf6b6e672b00efefc9c6fd779bcdf
MD5 2af5cea2a22bf5e8a601ddc0dc0bdc4a
SHA1 443d52b90f79e6ed4b292628250e07e8340097b0
SHA512 b241a5712c8322c6804b0b4ed5f26487e32eb0e5ce3dd31a8c91d6efc266f211be2b1562d850234233401661af2a6283027a747c2b3300e8253e29ead4ff092a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascqo:A3k03kB56rZ
TLSH
T1F2257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 962KB
SHA256 585f07a85967f948f42f9077e660e37d5b019af0eae0e3d3e3313460e5fc056f
MD5 feb6fafbab1b120a0e5fa9d4b4188f03
SHA1 0480961be477ce0171a2cb3651f925335901e9f0
SHA512 68d4830ccc87e9be254fefc9be1b3b83a1b58c534f8978a0a015f7d6704bbbd1917b23f3085b90b7360b93a86a24304c61f92384019d5004f4b9e3c23fb8ae64
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascB+:A3k03kB56rc
TLSH
T1E3257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 962KB
SHA256 ccd2e92eca01393c98dc74d4dd35e906421e4bbcd226a348fc74931310455986
MD5 225571eb9a27d17dd9daeed7f442b018
SHA1 3ccc26ccfdee352853a7488f2c679aa1f9d212db
SHA512 98ae628dea0bfbf262b2ec3be5da4df72dfdee396ffb77974fe4a961183634ab75182eb66b6fb7cffd339bdb30a43ad0b83abb01a2fd515ac78043e0824dd1b5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascPQ:A3k03kB56r0
TLSH
T1DA257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 962KB
SHA256 2b338fe7c4dd2dfd1d09b1b8f885fe487007ec68b92a8cb83d4817585de75d2f
MD5 d094896eff2e0bcdd64f586b1fc6e21c
SHA1 1d5ffd9a3e29f3988d450a044e1b3eedc4178d9a
SHA512 0dda265406ac3e6ca98a91b22a1854227a4780f37c7eeb04e7134567fd58d4cb51768a67557298c51d1a610b4420086ac3b5eedbaa7e083df7830ad4c2d4f8bf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascUX:A3k03kB56r0
TLSH
T1E2257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 962KB
SHA256 12eff7598fbec07f0c422571ba3efc4886a1c1b045705e19d9ea0e1db54a8d15
MD5 f2b3a442a868ada9a2fcd637ceaac3e0
SHA1 8f5a72d8599a43a9f4c28cbee65b9df70b788afd
SHA512 713712e711d09658b7e28fceb4757c614b596a63151aebc27f4d3399ec70452e18793a0b9e4c490ab6aa19555330b09dcfd87eeed4783c76d499ef832f958396
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascyL:A3k03kB56rO
TLSH
T13B258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 962KB
SHA256 215eadd47c95b857b1127abf5fdc4a588603b0f5fb3cf9bd614b83c7c4fa5e11
MD5 8debe3efecb326ac9b475fc3db7ec0a5
SHA1 f3507126e56a82677c466bdd5b9bfdf7d8dc9a3e
SHA512 020630474f45198caf66b10e3c3dcf73d8fe2573b152c573f69404d664fb341656f2b5ea8427926da6ba29f986b66c83298396049522a2fa3a8fe32aae3382e7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascWM:A3k03kB56r7
TLSH
T11F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 962KB
SHA256 5effcd17d5e275f1228f0c0c31585a87ac711e9400f3b37662ca80fadad25fdb
MD5 e86e69e6e339edeba3d0b81ad358839f
SHA1 ecd2ca7630fee95564cca058f22b4cff583a5bd4
SHA512 8409d04e61552fa52568a15093ee0387b8bed3a0870e629cb059590864842cf6fdf5eb18947d61f24102fac458abb23aae1434dc6c5311c4a7f4cbc3b7576a2f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOascfh:A3k03kB56r1
TLSH
T135257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4328-202-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4328-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5816-258-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads