c5d1d3acde81aa2603808f5dba23aae408bc9618fb3548c09d9d295801138bc0

Analysis

max time kernel
94s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 924KB
Sample260714-qasdvsf17t
SHA256 c5d1d3acde81aa2603808f5dba23aae408bc9618fb3548c09d9d295801138bc0
MD5 467836eab33019c92ac376e0a275d95b
SHA1 3fa71fd46b562e87e495ce621a918ea497e2597b
SHA512 77a5b9e840a8a98fa2bb297892c31b5e6c906e623956a9138fd806478ea28cf95cc728ce858ee3253d5a54b4d713299ead562aeff31cd71f7677cbb19f14cdad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaC1:A3k03kB56rd
TLSH
T1AF157B03E6850FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2612-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c5cd-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b301-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2612-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5052-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a65-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a66-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018989-568.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-612.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-637.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1104.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c5cd-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b301-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-57.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a65-222.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a66-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018989-568.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-612.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-637.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-980.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1061.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1104.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1216.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1319.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1364.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1385.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5052	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2612	2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5052	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_467836eab33019c92ac376e0a275d95b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2612

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 c5d1d3acde81aa2603808f5dba23aae408bc9618fb3548c09d9d295801138bc0
MD5 467836eab33019c92ac376e0a275d95b
SHA1 3fa71fd46b562e87e495ce621a918ea497e2597b
SHA512 77a5b9e840a8a98fa2bb297892c31b5e6c906e623956a9138fd806478ea28cf95cc728ce858ee3253d5a54b4d713299ead562aeff31cd71f7677cbb19f14cdad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaC1:A3k03kB56rd
TLSH
T1AF157B03E6850FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 285b7c820a15899472a119e1ab2f2e2ccd917f7964dd71258d5ecab70f0d883d
MD5 211008c24a8b0578b2c869e89ce2b9e3
SHA1 6989b86800a50556d2a394763e377d22c947db34
SHA512 310fef4f3e09dda7e0d7eb8bb9fa99648eac3d91d4805fc15e167c56cd0804793fec26f84343de3853c3d0f26b7d7106665f41f53f6e82e21cddba12149abf5f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCx0Le5ji0hmxNrM:A3k03kB56rpPji0Aj
TLSH
T199655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 972KB
SHA256 d1961587dc086d14437866f7a8cdfdeff732388e30d4c019a30f6eac594c9e3b
MD5 4230d87e550f6cf2532a6ec69c483eb1
SHA1 f17571f519323e36fabdac66d4d1617d481ed1e6
SHA512 ff3ec32d80f19900f4f2a6e43abc034b402dccd99d58c27a3ae77ae7f099862589ecdac78ddb31b5b1b2ca728d7f61e2249394d1bea17f55d68d69d47b20da76
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCAb:A3k03kB56rYb
TLSH
T1E4258C03E6940FA5D10F81749A958662EA777C425F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 947KB
SHA256 b7588c42ac9421ad2991751c2f7f2a0a85e43cce6292aee31f40efd26fd70a28
MD5 49f45170eb512bd1af433e76cd879d4b
SHA1 faab8a4b8fb7b7ff35ebec6aecc4b28a7becd353
SHA512 2ac7bbb530fa6271d7c40695f81274d6b82a8f3bd64b3065f631ca66e01b3abdbc557072ee0a9471674bb6b7db2113e4418ce947f54fa4c91ce12dff163b3927
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCS6:A3k03kB56r1
TLSH
T19A257B03E6840FA5D10F81749A968662EA777C065F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 947KB
SHA256 4cc5dbd1976aa7171fde07fa66e5a490b1d49975c8f48107598eededf7f61f7e
MD5 669536f79a13406324b2e44e1f8e182f
SHA1 375611bce1e42cffda0f096422de312f82fcebef
SHA512 c87fcd5386f8ff8abfeb0a2758d699db353cff8351b20f1ef926a426ad4cdde9c22d5ad30b724996c0c6ac5ef8ed605459db085a80c2af1c065bff2ff5386245
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCKN:A3k03kB56rE
TLSH
T166257B03E6840FA5D10F81749A968662EA777C065F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 947KB
SHA256 973f7fc52ab768075670f2d00309a10ae0e8cb2dd8e8c1e4a06b824c9b12fc29
MD5 504e01eac56db67e04ea560ac41cb83e
SHA1 6a0d32cb9e11b1bf8775a03e3854d8c8ced1eb81
SHA512 2fafcd5784d54a08e3f96b388b6aa3250166bd6429ff2bccd10784aceab674918b8f6539650c27da5872390aeef1a4d1eef7ba5d3985f09b26b5d91d845dde3e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCwf:A3k03kB56rE
TLSH
T133257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 947KB
SHA256 7c07fbaf016822530a61a72fb6beaac44ff8fe780a0517ef78767882e62f0fa4
MD5 23bfa257c17ab474278270e331616f18
SHA1 d8099fb39e14eac82d265c036ca60c02a1e66446
SHA512 5d478c11ab36b266156b11a7799985fe049ccb45088e70eeae753dba0c6bb081db958c17e4167992060217c4c9d5e089ec0edac7e6b51ee5aff4ecf527da4082
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCKo:A3k03kB56rZ
TLSH
T1AC257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 947KB
SHA256 c3d5bc611524c04dd486b7cc353697cf97374d2fa97691dac1cc078b26c4c60d
MD5 87480f6d936a7d1d5fb7646cd87a1ae7
SHA1 4c4925d048181eb30ef7f0a2d2fd725225127a8e
SHA512 56d267d0c04318bdf051f1febf84cf191755d7ed92ecb3c45f9f22cc0c3b68969fb53a3215dd435c4cc667d62c0508b379a3b05b169335ca4e211faf13f49719
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCeu:A3k03kB56rb
TLSH
T1B1257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 947KB
SHA256 7e20529e09a9caffd132b808bdaa0fe512d0c266511b0267d34f59b6b4fb85f4
MD5 e855b41be42da2f6ea71b0eaa3820b29
SHA1 fba36cf4acb9ba3663df9da77a35c3f1ca6dc22d
SHA512 183991c1880f3c077712454b3d4d472029d868305922e0f84005e1a4156a4c2826f820d70127a63aba542ee8f9f94d7e7f036890a40dad7c5d78f91f4c79480f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCS9:A3k03kB56ra
TLSH
T10E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 947KB
SHA256 2510b3d79c337b71a390e712c6ee927bdbf5963f5764e033011cad387f55d4c4
MD5 487474b65ecb8ae8e455ab09da3470ea
SHA1 9a91a6847351eecab7edbcb0125bd4dadb02f0e8
SHA512 9c4dac1519f808dd249780b2ace3638bc8e0d72644fceb19d19dae0e3af6fb2d01da4dc8a01d6842801830d6ce67f52afffb5c70c42bb04f83e569d29fa442c6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCSc:A3k03kB56r3
TLSH
T116257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 947KB
SHA256 f9e2568131189a9e4192ac0cc16117bf5c113888170f41ba47a5404a1a24eb6d
MD5 f0506911bcb55dbbe364aad09896fdb2
SHA1 f1ed3ba9d7e7b7de15818653d5e75feb592a6cff
SHA512 1c2ea2d37b591470fd15fd59c8c083396a036f266b3a7086abfb35278992544af9cada9ccf7ecc78751fd2b80d3b9bf532c2d636a49d30e5fd5f2e8487ee2c85
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCbp:A3k03kB56rt
TLSH
T10C257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 947KB
SHA256 6403bde3be5ec4c8cab209dfb261cabab9cb88b4dc4a5004d90d696a0731731d
MD5 70e71922f265fc4fcabbbe8cd6ca2238
SHA1 0942a45e0e51f590d13eca18f2e25dfbf4976f95
SHA512 43b8e228124b9d346919c0b2d17a97e08e0e721cdddbb14e76fb5b7b5a9beeaa387443e3d4ec3be4aa1c9c05fe720bd7f276cdfab0a51a40e19500ca5bd42d85
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCsN:A3k03kB56rW
TLSH
T18A257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 947KB
SHA256 31f066da96b5e39b88296ee6e16a9e98a6ae96f1770dcb2a8fdf759d37c7c227
MD5 f4c2a4405329d7e4371f9e50d4824cfe
SHA1 8548f2055a55ae87ed4bb51a55407cd1ab4ff634
SHA512 8de32bb8c79c1522b2ae1de5e838b77f34de27cb032311cd5f1a03791ba2c52458612ed92cea3c9b62a1efbdd1c3680bb065a2fe5bc578dd03b9e1614a65cf07
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCUF:A3k03kB56r0
TLSH
T16A257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 947KB
SHA256 34e8b0cde2163894b0f79dfffbcfa2a9c89ef3cd50b29789b3f0d140e3dc45ad
MD5 68cdcb205e81b2ceb69462691d43687a
SHA1 0376d714a353ca092c22f3dd28fbafaf62d9a0f3
SHA512 8011543d8ac8897649a6e5af928326f935e48a2b1c3fad235b3709d0707803caa81f6e39586cd107241f50e46361cc4465dc5a2ef4de2c13783e10d92280f4d8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCxC:A3k03kB56rg
TLSH
T12D257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 947KB
SHA256 54b5e6d70f55c4d13c147ed916e3294bae512812b18e18cb003885c37bdbf89a
MD5 09624cbe310916b708b1552af7562e04
SHA1 5d7c678693a785d2e68387f6953c0cc825799c13
SHA512 87bec0100196107e7d1e6ee819b1a4ffc97c0a788a1f3539c64f242bebc6687cb9f15af0c0eae52c05395324f5d9bece2f5a9877ba9a9c3c19719ea281750b3f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCSw:A3k03kB56r9
TLSH
T11A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 947KB
SHA256 220d4cb0bdc51a1357e94b22b5af45d5e640f35953804c58d97b7c947fd6abed
MD5 88f5462607f68da1abad181e502ca8ef
SHA1 0b801797909eeab18507e7f2fb0895b4bcf1b783
SHA512 880a13a11afe5a8351b84960119a25e1ac9eca97c6b3b2923dc0c2165409975adc8391740d32411f0204a63d48897478f384d6c1cbad4c4e0ca70683399bc6b5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCZT:A3k03kB56rx
TLSH
T19F257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 947KB
SHA256 1f6687f0e45f6dc0a7933f799dd1e26d42f2b1fac2f5d29449eecf748a96dba2
MD5 6135ff0e88c209b5cf72fdd11401ff56
SHA1 d357408f9f7317d7d6287bacfad21e9e0cb827fc
SHA512 e91660e640aee3a2691afe37a3edcbbeb9e896bb7ca8faab720481ccc2096cab5a90a05d52b49f941baec972a2f3f3dd3c1c14d5527a68d795a5974f95df2d39
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaC3u:A3k03kB56rm
TLSH
T1A3257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 947KB
SHA256 895598402ab32e999a5750e2e8d756b19d24781f54c7fd1f4b93dedf4401b32c
MD5 40422d43fe0c9c1bc4bf768eeac81b18
SHA1 ad6500c058285ddf3b5fbde1ab125626f546dde9
SHA512 275a13791efacf92c0d91f75e1f60d5c9dbe49e0470f3e9772783a7821f55f5cc53d9c67b90a0b5944cda3c5ddf5d260b9baf03f3adee6de2e6810d16cf4abe7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCLb:A3k03kB56r3
TLSH
T181257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 947KB
SHA256 4c18c1d72c65a1aa01a29e2389c916e10de9b18c8026a0ffcb3de6f3c929ad7d
MD5 d4a0e845f03e6a6288f16c6becc55347
SHA1 417f58ea229cc61b4d896a775bc56e9dc8b65cb0
SHA512 6de7e12193085dd4282ed0e5f7bd43b7b47229e0f7525e72e253010216af84874ab8a1e038897350db222f3a404d8815b24c74d013e056adeb7b648b6168a1f7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCff:A3k03kB56rf
TLSH
T117257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 947KB
SHA256 3661cd09e33b7b6e6cfa1911f84c5fbf472e2ea35f106dd81a514013ed26a4c7
MD5 5eb43c1ee0371b291e05311c06dee41f
SHA1 dd877ea17f7802ee6db7ba9e2eb06a04e4702a5f
SHA512 ae6fad57240f1434f7448affec4b1a9c9c8140fc4c0b94ccd6f8a3c50f2ed00c67c6fe128bfc50d2bcdade5ad3e5f83de028a48c524fb2e4cb117e11c117c2a0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCIK:A3k03kB56r/
TLSH
T1C7257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 947KB
SHA256 9e93dc92c820724a26fb3affa672c5ac6027fd1adb19d2c9977a20e134eb10b4
MD5 c1ac1c62ac96c9193424683a2304b6f5
SHA1 e9669f942b944de371c458c2944a45a796710148
SHA512 61f154428be1f725f1f2c93c273e18b408f6b68137f94504885f9d9a80f2ca1584cc7cfed81170a2004d516b14998c7cbb786eed9e624bb3d3aa4f37307ef8bf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaC1k:A3k03kB56rK
TLSH
T14E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 947KB
SHA256 4f8e12b5ffc8be19f8525697ea61cd79cf8642b54cef8e8cef2986ca638d1641
MD5 41e4f30cd9146e263e0f350394ea6d8e
SHA1 4c1ce6ac3456eb36076bc3efe31404611fe10a2a
SHA512 8775680f058a6e3b7f31b57da73c40354fc70b96927c1b6f9c78ae3f49528748ff83c862af1c4920af95a34347c964f1379b27abb0131871df571e63245be7cd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCq0:A3k03kB56r/
TLSH
T195257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 947KB
SHA256 77fa50da8be8031974a81f380b79981d805864e132ff34500919b6a86912e7a0
MD5 9354cc075ef7f30ebd7a29f57bfae020
SHA1 dc58a98a77581461923a58de2abe09d03828110f
SHA512 8292936e5569812c271f552800a43f18363625fa365809f3fa302742c3a5d25feeeebd95898ae62a05bdcbeea46428b8250b4c4c69a073d0a06efdcf799c9c24
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCZg:A3k03kB56ri
TLSH
T12E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 947KB
SHA256 fcd64c2f32affdc67755a0e3cdb49603d01562a101642f604d51d59b15f152e9
MD5 96e8e799c2786d16b0d1baea67a50fd9
SHA1 a96121514529a26b05cd0c7d1fc57e3490cbc751
SHA512 8af1a24a2425e1066d9d874f39f3a8252b6213efa429cae25f0be488163cb5636933a550782057255da46f07a6a9ba84a8e86800909e4be6508996827979331c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCAr:A3k03kB56rs
TLSH
T163257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 947KB
SHA256 77f0cbff798cba31446828e3cb4e68f0a84907aae9b13b83450c0f608628059e
MD5 bf40179a03902eb57b23d5a3322f3084
SHA1 27e619659ee9e646a1cf0c97190492681159c472
SHA512 d7807822826183818faae7aeefd48acd955caacec1265452ef2e9db3439eb92d50602616c9f506f03bdd0ea514e01bd2791339ed734631f45f982dca809dbad9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaC+n:A3k03kB56rW
TLSH
T1C7257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 947KB
SHA256 1aad13c7af450012eb027bd0b759e6a4b033faa123e18375f542d79a5e7d5423
MD5 ceb89e43a30e88cb476a69870636cc2f
SHA1 5039b641edf27ef9e1fece8295d180af31e952eb
SHA512 398925b05b10646a1e7fa656fbde20c2322939d21b546313e59111af692e9a29f6833c3c7ce9bd37a906eeacf2a8aa7bdc5faa0ee86b51dfeb19830d1cf9d14d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCUx:A3k03kB56rM
TLSH
T1F0257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 947KB
SHA256 c7d3c9de3af531b1295f5d263c4d6ef45002670f29ee14126fa6cb70a856c484
MD5 d711dd415e449a471ba7edd05ba5b60c
SHA1 8616d932bc22d65f6befa4c276f8ee93b613a9a7
SHA512 eb4863f26bdf2bbbd66b6865287249e8fd68fbd99e13fb8099c454a0140aa53b2eaaadc75aadb7d1d394b7f86ad8fded0cc7f165bc5fd79bc561bb9d382e511b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCeA:A3k03kB56rX
TLSH
T1A0257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 947KB
SHA256 10427f0cb0cd70860d53d4ebfa6b86f5e328ed0db0974cc05ab27dcd87861ff4
MD5 ef4bfe5e47dde8e52a17f5d65c8e150d
SHA1 5edd6a6c8470c5be5845a048496df09c5a140ed5
SHA512 8d6a867e0674da0d8227bbdcbaa8380d84d59ffb0fb4e9d824b44be6c41adbed03318b0aba8cd514dbe09600da3c1ac3f8eeea3f795827f5dd65f90d058195d1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaC39Q:A3k03kB56ra
TLSH
T1AB257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 947KB
SHA256 6a1a8bad6b748b98084ec4dc9fd5d7d992edf8a746f438d27b9c38a51545c9da
MD5 7e0a4e24540935dc33f2cde95f36c73f
SHA1 c8c73cfae08c5f5a97c9709087f31a4d689c1b32
SHA512 4776117eb0f399bb7319641a4cfa5333a8f73eb377e6bf14c4c7f37cf44383f46d4fd609d7c62cff0d281859c1c6d06b8f846e164d48f63891824d5a1404791d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCe4:A3k03kB56r5
TLSH
T142257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 947KB
SHA256 27d511a2baece49a1866a0624a20d67020212e074bdcbe38cc608ba4760ffbb4
MD5 e7105efee78ce6f11082111b011b79e3
SHA1 bc1b9e3a43d27ee90e8e08fdc658618da2870dfa
SHA512 fe5a60540bc2fd49e99ba5a5f4a4dce7e68f22c0284b5a3ffc3b213e81de790b999a3df491b10e4eca63593881b5fd8930565503eb9516216c1b29f1f2367ae0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCdu:A3k03kB56rE
TLSH
T1B0257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 947KB
SHA256 81ca3de26f656ee061a7b3f2060b5b322b6fcf03f4f8858fed6c89da68813b77
MD5 2283ab16510c783c46b579bd5811076d
SHA1 78caee97e7cb9e983f941fee951651805d685c99
SHA512 df902a0967eaa91bed68c2dd2173ac0006626cce476ebbd51451de39958d063246f7b7c35a6e44d56bd4f89a62536d279ff86bc63bccd0026f887157d6a697af
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCwj:A3k03kB56rG
TLSH
T1E0257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 947KB
SHA256 8bbba02f066621f5a5b6062692fed9fa9e453ce358421ec27c78ef0bf78b22c1
MD5 9fa644ec52b18ffd20ae33aa37251582
SHA1 d6e9e469d0109fe0abc6ca639db380e76435a774
SHA512 54cef61ecda1537c220e89a9807fbbeb78f293638b6bb633651d46cd46924996399763c08734ce1abfc04d5df546514d5c2012f473ac35c8435e487eaf7ebca7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCBg:A3k03kB56rq
TLSH
T1E1257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 947KB
SHA256 a25fa18b7f541188d7b27b2284f72b95aadb863b0fa826044eb5fade57b60928
MD5 09198aced558708996e1c430b84648b7
SHA1 1330b520aedd078354dc040147301466406cfd9e
SHA512 2a9b5e6f9502455caa682d70143ce3ddf4fe8688bfe863d193d96e8bf4c2e083eb58abdf1e46d19352a9ae940d1b3dd110b0391f78f74ef2b1ba2e599a6272d3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCYI:A3k03kB56rL
TLSH
T1AC257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 947KB
SHA256 8006427a6e1bc718556c178bbf266c2a8e9b181082c3521d46187d0418e631be
MD5 bed5e018050f625f6968905fc5101ba6
SHA1 62cf37db61ae263bec1fb9fc4432d566090b8b7f
SHA512 7bf51e1df613b558fdd293853050f3249cc840ae474066761b16601d2be9b2296954784d83a0455f7a648b0c62ff520e61a1a5360d4e20c8d5c2f6ca769790f2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaC6o:A3k03kB56rV
TLSH
T1CE257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 947KB
SHA256 357f77cebc74f566c19ebd5457365ca61d8ebfbdb9ed6732d23fa1fabf59d3ef
MD5 9a00cf435aa1e91cab73aa89b026f777
SHA1 d1667093d7c3d5753c6b29ed791714d11e73e3cf
SHA512 55a3d4ad4363d4d60201cb8f3ebeff586b9c5b3e7270fb8ff111dd472ccd83dbf016afbd56d47cf21e9cfe210c5317252521994a08fd81dbfd10c382d7f95a61
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCR+:A3k03kB56rw
TLSH
T118257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 947KB
SHA256 3d6e539ec0c53806033d4cbfc67eecb0133345bdf4ab35421f0eb1fc32085f0e
MD5 92a2f0e48a5b7a40905ce5d46d2049a7
SHA1 f6ee4e358b71b2e660fece2c76b68daab530b7d7
SHA512 e6ba22f51927302b4bce3fcfd32aa320eb80a3923232b4734066ecd7df6d6c477e8a23a7b610a566c7071f39b324f06baf9835f50cce903c0908c8d38ea991a3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCfQ:A3k03kB56rA
TLSH
T199257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 947KB
SHA256 6ac0d307b1e6b71e7baeca3d3db3ecb2b73b070c4fda936ced4b71a3b59bf21b
MD5 d82f140e6b9ab1cc1e2a4c78b8b76c4e
SHA1 bfceab4c833918a8fce0f864c1beb859939fa234
SHA512 8833da9137ddefaad867af2c0bc2b970054121cbd270cd610065e5b1fa95020964416fd39e6895d189762768b691232d0b056571f9428387e3359533a3b6bc17
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCkX:A3k03kB56rw
TLSH
T1FB257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 947KB
SHA256 b64bde25c789165d708e3721f84e95d8acaab4c587c6b63c14814d43bc9ca630
MD5 5909e33592c8d4dfe23f5c70ff46b81b
SHA1 0c8c08a58fde602824cf46635885738b12dc41d2
SHA512 d9f6df776756db8101e0327ca61572be523d643a3ced7c08ad1e54b565cea0f9edb1c077a0bad2dec0faaa189d1ae4775599b07cf240f95f403637959de5e0e5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCiL:A3k03kB56rS
TLSH
T130257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 947KB
SHA256 c0c4fe1039223e749c041f00bb5a7b51f7d5d4c1629bbca16d39b3f1044b174f
MD5 a227290d973fef168f25b93be945437e
SHA1 95ee83cd6616ab94c1297f1ff953d7328aae6f75
SHA512 be58520548c796df45381f78c2e89ecbf8d8ca907fb8c9d312b940b6716c8259beac2778ed5dabe05538fb8e0c7b68d06f3f565332506addca7c4d460db50acc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCGM:A3k03kB56r/
TLSH
T1CC257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 947KB
SHA256 fec9a4bbfaaaf5326693109addb2bf9261a141f7010e139fd48fc75b2c54eac0
MD5 3de0f550d0c45ef6d10a9af262a8a0dd
SHA1 ae85d1fd1e892c723d80f41f40ff3ade099dead8
SHA512 b25eab57550651176ea858407a5d0ba8bd029819095f086b3608011023666746223b760dbf58ee3722ee184185c34f22a651b6220589a8c907198b821340b682
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0iLaCvh:A3k03kB56rx
TLSH
T12A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2612-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2612-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5052-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads