5c1e18fd9db0f9f8d2089ad7ec41dd449d0031a3b679d764eb8603f516072b1d

Analysis

max time kernel
98s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 931KB
Sample260717-t1cb4sbt21
SHA256 5c1e18fd9db0f9f8d2089ad7ec41dd449d0031a3b679d764eb8603f516072b1d
MD5 d284868681f0c60c1fdd86f65b513481
SHA1 dfb094ad9ce1099f68886b0b6f68472652efe411
SHA512 244ac1bb7ff9ebdd7e7fcdff4ff16ac6a91d15b15f3a5ae337eaf6ce217c589a536d367143229f8dd8a2bd728cba5730ad62ae21dc5d08220b0f57724d468c82
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7No:A3k03kHRJARJh
TLSH
T1FF159C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1756-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c52a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1756-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4488-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-575.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1159.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1288.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1352.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c52a-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-575.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-911.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1085.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1159.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1179.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1288.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1326.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1352.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4488	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1756	2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4488	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_d284868681f0c60c1fdd86f65b513481_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1756

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 931KB
SHA256 5c1e18fd9db0f9f8d2089ad7ec41dd449d0031a3b679d764eb8603f516072b1d
MD5 d284868681f0c60c1fdd86f65b513481
SHA1 dfb094ad9ce1099f68886b0b6f68472652efe411
SHA512 244ac1bb7ff9ebdd7e7fcdff4ff16ac6a91d15b15f3a5ae337eaf6ce217c589a536d367143229f8dd8a2bd728cba5730ad62ae21dc5d08220b0f57724d468c82
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7No:A3k03kHRJARJh
TLSH
T1FF159C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 d62e1e59865140a42cea33124c47c79dac77dc354e2c11d52c0b92b65c7f87e6
MD5 e7df736a3b166e53a1654babe85aa869
SHA1 c9e48b451e8e1de2b98b2509e593a28a50cf0c11
SHA512 cdbca23e8104e09ebfb83e63f3e5bd1f176915849785021b2c543f6b104b6da22072369a7e842e504ad1e0f4ebbcf09620bd9c5a526a2db873f6f3ef33d3a5ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7Nw0Le5ji0hmxNrM:A3k03kHRJARJ9Pji0Aj
TLSH
T10E657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 946KB
SHA256 83eed05968bcaebe006ff9196ffe8764b243a8bfe8c91ebb16d66bea4388b875
MD5 4cafb73c1cf7c48949e8260ad3da4231
SHA1 20c4a9edfd7f0afbd3cd2872f86441b93949f688
SHA512 5c5b89ceb37cc997a27e3e4ce3f12781916093b83d024f1c42009ae1d66791067e60135e39b41b2ac04cd59d2e6407b99ac16f1d82970e817769662e8a829211
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NKa:A3k03kHRJARJ
TLSH
T1EE259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 955KB
SHA256 98f3c4436d1f042c7f62193837248889a8c66fe004dd797e59b84e46386e2eb5
MD5 61c614c1f0cf58b82b44adc3b237ddc3
SHA1 5d898b926bc1ca62337d7e54e1a4cf4e8ce38ec3
SHA512 9403e741dd65ef493b9c2e2e639e5f28d233dc04449d913e1a115f409c5621470229da78b75299704b537cb74e66542f5fb11d99601fbc436b9bedcb920e93f2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7N76:A3k03kHRJARJZ
TLSH
T1D4259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 955KB
SHA256 ec8e2309f3aa7bfd8eea4eccff4282e71385c7abe098a0d1f12b2032b770b846
MD5 ddb85b7b15cbe4c1f9d33ba59fa0a866
SHA1 1fc7b56194a4f705f1e786e878cb0f58ff2306a9
SHA512 77876e8427272aee41324109974f558c9b7cc7526ccf9de0e142927e5d9d19f496a1c4e7c2832dae4d91b7aea4fd5d6f2f28423c7e84d9e2d88fdc2492062958
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NlN:A3k03kHRJARJA
TLSH
T182259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 955KB
SHA256 e9b4ad087e7c8c03819ff377c026e9b435e49b68e37faac70c4d22ff4bd333c0
MD5 14e1cdbd309994fb3dfd0389aedab2be
SHA1 6fea8516135db004c0fda5a4637156d72a4b9342
SHA512 6a9bdbf10ec63ce18c4767bd1b6e852563a5d8ef99b0e980c8fcc8e22f78b6f5e0dfd2b4fa14b496417ada2d23e63dde5444e80445e9b45e2ba7298570707b53
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7Njf:A3k03kHRJARJY
TLSH
T178259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 955KB
SHA256 1177d916be2bc723bad7123b2ab441f97b5213268740cd1acdb5621f450c0aee
MD5 7271fdff0a974ad6fb84b38c33efea72
SHA1 1dddcbdb32f0a98321fea864794b5870f53ffcbe
SHA512 176f9c02bdeb3310fd017ed97ce85a912e9c07c71fc4bde5d4a2ad55dd6ad33d1cfd1969ed461e104b5095297203f8a28e34f8f21df59075588a4b5b6689538c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7N1o:A3k03kHRJARJF
TLSH
T100259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 955KB
SHA256 f17ece47d8c416e1f320603db9ff32c411604c3d01ec07d9f9ab1bf9763f1fa1
MD5 fd4a4fdd95287373d7c845b5ce6b1c25
SHA1 d03f4def6263828945e4c77f394c712e53c9ddc4
SHA512 3be24d9c5093cb34cfde3a15626f04836b738dd43abf812c28f1bbbe6d4f5feca28c28c19e0f06d326af1185c10b4ae1ca37c1090d6146964832e42bb158d25d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7N1u:A3k03kHRJARJn
TLSH
T1FB259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 955KB
SHA256 70472dd620041f38ce08817c6cb94c40df4cd63e8f421297817b4702805a9f4f
MD5 322cb917042e855bfee0ef4d7823f95a
SHA1 edd63b49cd14d926d985f891e3e0071a9421a862
SHA512 fb4b7e351420b47d67cdd81f03cc0bdac505eee51d640db2f8a58809117296d1238c3e85de6152b6aedaf961206dd9c70b5e6e75ac27563a7b962c780324f0be
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7Nr9:A3k03kHRJARJm
TLSH
T132259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 955KB
SHA256 bcaff2b95f016b4a656eec922568d98e6d4cd18d1f923fd94fbda804aef7d352
MD5 228ecc066f214589fe66c7485911db95
SHA1 7771e5431f8ba1fb740fd93cc89080309b299ca7
SHA512 5535012d4922333b95d5451dddd92f7b56cff3ffd71a27454f365d3e12670bd65950748ae4f2e2ae8dbf17b444212bd0319498884a333accb7e1b2a28b8ff2f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7N3c:A3k03kHRJARJL
TLSH
T160259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 955KB
SHA256 ddd515dd47353190bb263557a1a34844bfa0dd864e47bce5568e6533562ab7c8
MD5 eb0200e7d2467a713ea88ad412d7b0b7
SHA1 bd9a0236deab73e76af7ab154cc5849d9d689c6c
SHA512 ca04d3ef0785e13b042ada0b84b051a8b16a3c1ff8bd2b022567163d45f62bf0da4d0f4f0bc28260bb1cac25f57b3d7f4994b6665c421ecae62fdf9c238c12cf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NAp:A3k03kHRJARJp
TLSH
T1CB259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 955KB
SHA256 b8d15385343dbc11b65d73803d3eab7c51538833787df5e1e96b8251bf6d0ee4
MD5 fc9ab3de66c4477044e7385bd5775ec5
SHA1 987f70a2484485d7b59e7819c43ecaf474d8a789
SHA512 80ebc4657a34ab12f225fed67626ce21ba1045fca49e3ea5f7a86a26d93bddb4c118ac8971e5ce5b050da7e68c00251db0882570073badacb9469603115c6151
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NHN:A3k03kHRJARJy
TLSH
T12C259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 955KB
SHA256 299f482488319019f3bb8ef1852de6ef79cd3d6bdce9c05ec5ca5f6e33cc3b68
MD5 a46556c221b9614420796ee88ce772aa
SHA1 88d160cdf4e862f722e385e4686922625d58106a
SHA512 eb98c3b6546e44f5e9ee5db55d8ebffff6418377c79c72819c7e92ee6213c501dd94d70de6212f9b4bd9e19082decff3ff090916a0a251ca7bc38960cdcbd498
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NlF:A3k03kHRJARJY
TLSH
T160259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 955KB
SHA256 5d410b75b2f3d10e5121872355d063a20bfeb20d85e98289221d5815b107839c
MD5 ae4b1946f0f7c7012e88553180eb6ab8
SHA1 2caead94ce54a9f07a5d6edc5ee8be0012d35a16
SHA512 7a9c21d982e6bfe7356848381225e09e8292c2dee0a2ff6700ed157403f7797227a775fb0f5fe77a213a0abc4db1e6956499bf95f0f3bd3aefcba79c841fc146
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NGC:A3k03kHRJARJs
TLSH
T1E1259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 955KB
SHA256 4919f2b67c7e76cd634f9660285b0f791c51cc79d1c24ab1002f4deb1be84a57
MD5 2bcb24dab0209341245ec9ec2db0e265
SHA1 fae4cbf97bdaab2e1c8b183ecc49691f4c9644fd
SHA512 c7074da59084110210d4d2f90207dc1bf10d9973d47880fb53ca78820bbb589e49e72eeb1194c1fab4784e6a96aa17f4269b91213547dd223399ae4e66af572d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NJw:A3k03kHRJARJh
TLSH
T120259D03F79900E8D14AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 955KB
SHA256 e0163c112b5f8f7d69a7b8c98e2f1d79c80856219a5e507871ff465c37683dd8
MD5 0832005dc48edc2d7d6226ee086dbd2b
SHA1 48e49e6eb9ddcc66291e1b2cc347ef66d5d377b6
SHA512 bbdf66883afa262567a0d1fe0dd51787af5ce02584ecead69480ba435a385000c1ac5869bd6a6369ad147f5d3ced4fcbfa0649e5969bc26c6cac00a9013a93a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NQT:A3k03kHRJARJV
TLSH
T1C4259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 955KB
SHA256 3af9bda6df17b8224802d3b0d56d5e87b98c85ea746e63c1d4cd8d8e361e9c00
MD5 f39c82a07b9fa5483dcf0cf44f0614ff
SHA1 1f0383a57ba146fef3ca1b6f25ac27db41e6a410
SHA512 f779beede9f06a55dbfd4fb1380abab3a1a0f0ff28061e7a66271596fb960d6906dee08d103c474e41816c18f6a932fdaddc82b30cf5051112d5d48414a9efed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7N8u:A3k03kHRJARJK
TLSH
T180259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 955KB
SHA256 87a50ffa5417db2de90dee05e9e489d017f694a1ac097f37ad93488e26feda7b
MD5 1dea30307ea22ae0df96c75c3b218a53
SHA1 9e597d0ef5c2fd7bb4d6da27b01b8000472d81f8
SHA512 1fde009a40d6ae71a040dbc779b5c461d4fdf7ac465aa4dee6337b70532ff760a04034ae5a361b375dc40327a79d60b99b51d23a5213cf313174106797e4bc61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7Nab:A3k03kHRJARJr
TLSH
T14A259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 955KB
SHA256 d616c70dd07d8552a00b2d0a75573a794f0b01d4dda6c3b1af78c2c122a513bf
MD5 c9d3276ef06693a8ede1e1d0e0a8c9ea
SHA1 e362dfb5e6914ccf6bf83f7e8d268def3eb72238
SHA512 22c164906f01d30620fa92011289a70c77fb98fe4f84c1e3afd883f389ff8b50f035cba4a6583018f1d3c711a71f737e39da7a5755c5d8b22c41b930c4b18621
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7Ncf:A3k03kHRJARJz
TLSH
T10F259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 955KB
SHA256 74048316d4c0ff2b02d8f4a0d4dd15333bc5638c630c7cc54c25748b3a9c095a
MD5 cc39a17c4d4185adc182de0a7bac0b0d
SHA1 257c89b5f4e01e5d2f5f2d33393e520f61c00614
SHA512 73e4fef7befa0945c18ac6c728e3d9e808b328dbc4019673048ce091d3dbb1e63389711d6b452012eabaeae9a4bcb971785d0e84522b2851776c94b041d598a9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7N5K:A3k03kHRJARJj
TLSH
T1A0259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 955KB
SHA256 40d1b3341e86eed536e41ca7cf6373af82eeefc5ba1730c55860ac967a986c05
MD5 97f6ea883e2dac56a0a62ba2b095210d
SHA1 ebef5d8553806f75317171f4dac1a06ff02aed0b
SHA512 06c4e92ed2222a02edced25a18608c16fb66c41c21163e5a6bfea01e839dc13c542c2174f59ab790a512f5b81b135269c881a607a27dd5cb0a847806e217c05c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7Nik:A3k03kHRJARJO
TLSH
T111259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 955KB
SHA256 ac2c9828f0710d8cc3f5486b6292f03891981274f4ba33a35b020c3f1eb8f591
MD5 f6db5f06b356995d4b741f0090ce60c3
SHA1 8fd587267d5a3c83eb910c178fa4898e47b1b759
SHA512 c1cb14dde321ac31352ebc97ffee7710fef5200bf88a7827555d1534cfb578e144fa1fb6b042a3eff3766b56056f71fd63f5337fd2145b5bad0fac7c32da3842
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7N30:A3k03kHRJARJT
TLSH
T193259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 955KB
SHA256 f04e97a51ed2068144bdc34a13851bd13f571880244aa90857c752bf8d35c733
MD5 e2b914ca5433b36a65ff276117c5d9eb
SHA1 cebb9a390b73306a3597bed480c8128ef2a29391
SHA512 07ad5a2a429ba1ae2c1dd653f8ecf6b768e5cdc859fbf1a437f5e75dc95fa8880d822aa85298018141972ffd8f4a091c71a705c9217d8f94f577441985433651
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7Nmg:A3k03kHRJARJW
TLSH
T1B1259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 955KB
SHA256 cfd532a482791c899d185a0a6663a9549001de8f68229a82df974b54a4a6556a
MD5 a0f9ac2aea547fc2b539fb213f3dc4a7
SHA1 bfd5081db12cb2c1ccf746f869d3dd3fcd45fa00
SHA512 498820bc1ac37636dc7cffeb036db617a3588ee8be38ab738ee145e92afc15567862408fa9e9eeb4c8baf33a34e7c3d6f05f4c2584ae0813096556119efde7b3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7Nvr:A3k03kHRJARJY
TLSH
T1A9259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 955KB
SHA256 a8207507e835d82c5c1515f70756c2265a5b906c1388e4817a28e1e8c751783f
MD5 1226d6a7c067d131b80afce243e25e73
SHA1 30fddca03bb61ae844589b2a8d0b0fd1f548ce3d
SHA512 cc97dff63e8162e78903647bc49a85bc305ba4803e68ae722adb247e0aa2bdd7bb260ec7b436163e5f98e8da2f61d189ef7d549ece5f65474ad5e43702e3f286
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7N5n:A3k03kHRJARJa
TLSH
T1C6259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 955KB
SHA256 5f0de8d296f9da42557aa32f830b5c6c0047eea062936c07d274ff7633d08411
MD5 249d1b5fc5e8680ef58f71d88f4ba965
SHA1 89ccb2fc927630fbfacea589149e121beadb7f6f
SHA512 05bf9e3388cf4553950d7a5cf9b0a52e6acf56102bdd384959f74c5269c7d0985ce662b4aa753febc4e2b393b5f47c5f7f1bd9c8f5ef034835652d5fd65d08d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NVx:A3k03kHRJARJY
TLSH
T19D259D03E79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 955KB
SHA256 af77b50b985e736888b0667ca2bccae56950589832eafaa48c71ca36dddaadd1
MD5 4365e233969ebd458cc8e9b5ce986819
SHA1 6f56de27a24e00f4b4b31b27f15a2d45c16f05ec
SHA512 98847b3d581422dc72bde5d681aa393d01c63e271d9529fc6570b2b25f369c7325cda9a41c6177dd4e20037d3254d46b30c76c42f27af9931e60ff598c2974a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NLA:A3k03kHRJARJb
TLSH
T17D259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 955KB
SHA256 5251796fe9b9732e6be85629f734139e338693b92a2e0439cdac43fe726452c1
MD5 bdc864c95a109511afcddacd1e83f8b1
SHA1 b2a180357fca0c625f43f01c3ec5cc00c9454a2d
SHA512 40de88846f9150935c2d0a023d61ac5403e1d83dc7541cf3338085395d55b06a193d7a36142bd7a3f4ae5336387201f9d754c55960a9ba67e866cecb9bc07865
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7Nc9Q:A3k03kHRJARJ2
TLSH
T106259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 955KB
SHA256 c9c18c4d6da6800b46bab82f979f725e3ce929343a5d75d3ef8707961daa5f2f
MD5 f143eeed9c66ced1d4d19a589959cd86
SHA1 99f6f76140a113ae466853773b06c1ea99926169
SHA512 1e00c07ea06fbca6f8daf288338686356ea05283c390ec7a8438258cd720badc952df63c0ab095357a233dd2e1cc209874b3a83b41a4c57deac2c4d5155dcef0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NF4:A3k03kHRJARJl
TLSH
T1F5259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 955KB
SHA256 e93d9d8ff074ee037e5921da09324f7e7386a6549067b989fb2ec85cb235caca
MD5 c1077824dadb99f7ee31a417c71c41a0
SHA1 42c399bfc8b326283bd6335a1fa8e1c3da96bbbd
SHA512 c6b284af2db7091b4ea290e2a402547968712bdb084b1162a59b81f19825f7fc329d02b2c5c1c827bbac26a335d418266485f2bcc82575e57e799c57520adfad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NQu:A3k03kHRJARJQ
TLSH
T133259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 955KB
SHA256 3b59214dddd38a3dc508cd1932011b7199ec3db1faa650d1796d36aa917eeb36
MD5 153b6d702ce4899e0b7a780b77a1ecd8
SHA1 ff1db0e2ffb569579db2fc352fae6c93754a4153
SHA512 d57b665b257be09b50a34abec59a9832d9f523227b1825e86da263092b5d6026b4b6850ee7e14faaf811fa4578f7d4bb890bb30a4214e616452106750a10b8c3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NRj:A3k03kHRJARJK
TLSH
T151259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 955KB
SHA256 3e76dc4047d8fee82f8f84203a8c542499eb38c5fc800915e86ae4c05dd3f91e
MD5 62f7fd59c1d49c830ff9c3b666f57b26
SHA1 69b5b67b0c6dd1c8ff50e2bd5e049c6bfee47e42
SHA512 43fe68ba9780af052813fbaa62c5e08e74cb97a5bf6017ec7d3227fba1409c3bc1868b50fc7609e2de90cd0ecfb417059df938da375ffcf558fd35f8c6569b07
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7N4g:A3k03kHRJARJe
TLSH
T138259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 955KB
SHA256 b67197413f545b1aa7bfa28ce89dfcf93fe75c8f5743d845742a7d883af5eb2b
MD5 f8ba0484d909ef20e93970ee6f63c277
SHA1 bcd552c6fa81917e4ec8ea9abf1abe24ff16df7d
SHA512 92ed2fd20f31050b41092b3faf3a6b000674dfafc22cd935e0fddd74f5c8c5ec9df05f3a375283e9a93964dcbeda4aed6b87e89c9335bce73a30281d4099befc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NXI:A3k03kHRJARJ3
TLSH
T19A259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 955KB
SHA256 2f4f99c69681cbfe8f143ca00875a31ba8ba63a5b8c549a866ffe0624ee13b20
MD5 08c3b24ad0cd40f672905babda738751
SHA1 a2ef5f960e820a6678a1b9fb0af91e94eab3bf6c
SHA512 2967fbce0e2653ae1bb5e4da95d57e8e7f9d2df8a670fc0c28171698f4702c706d938e2d2cda5017e777373426b560e4d3e853fcf152fe96a53298e255aae28a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7Ndo:A3k03kHRJARJx
TLSH
T146259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 955KB
SHA256 392e5789e92eebeb51dc4bc7ea8f9bee3c12318fdfd64adaca1fe02fb5a8fcca
MD5 95eb9d027d51c241a2af36e2d0ca3597
SHA1 a0eb7de90e1cad3c748d0302cb44f5e525b0122d
SHA512 fa26040d0b5fbbde6cf070dfcacbcf2649d1fb563993c3ced9d9ac1a33d26a5f901b223b0b6cede9676355383adc84272f92a834a4da33f1da34b8e0cda83c8c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NO+:A3k03kHRJARJU
TLSH
T1F8259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 955KB
SHA256 e8c3f5601919e6522c63d0a471d6648bad38a74264c12abd7ed1851af93125cd
MD5 988f3dd36dd010febc6b5fd3e4a293f9
SHA1 7d5d4ef633d9b19e8aac22194832b3e081d0f51a
SHA512 d88cfb3a18434d585f9d3ab032b60529861148dfd8951579b2581c998ab164c84926d97bc863f01e5c2c718b8190fa76c707b29fc4bd41c697c873315ac90626
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NOQ:A3k03kHRJARJc
TLSH
T159259D03F79900E8D15AC1789AA69A22FB757C56173097CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 955KB
SHA256 a6172df38d7ec50ecb7a0feca340c60ad8033bdc22ed8861309a32b31f849504
MD5 fb629e59afdeceb1db2dc00c6964e7f4
SHA1 bed043ba2eab8ad4483173034de5f1bcaaa81c0d
SHA512 d914740793454438f6ca5cac9b1a14e970013c885c4bd04f0a6f64b63be61d8b2f2293b5d1b1d482a1cd3578d19fa33e355c3591134bf4a80f74cede7f459737
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NvX:A3k03kHRJARJ8
TLSH
T11C259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 955KB
SHA256 0afc0cdabe0c549abce0f9c44bac1b637944b69149affa565f162fa00eabb27d
MD5 dad53310bbfd5d182f2a2fa636111250
SHA1 f78212bb02764d1edf290d35b110bb9397f9b8b6
SHA512 698b79b74b73b3ea4a5074cf4376638a33779ed28adb345e5c5a83caf6f281b207cee2dbaa6a9805695ff79cec293341d0969a9a8417d1ee1158f48867174b2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NlL:A3k03kHRJARJm
TLSH
T169259D03F79900E8D14AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 955KB
SHA256 805f02a6dec830ac371b41aa73dfed98d52734b7709b0a031102a599e1952371
MD5 5c3635dfef9f81adb3caaad9403a0974
SHA1 737bd0a4c52534c8e7db19b367bdfe3d35ea8b28
SHA512 3b2e83ccb60f3c4ced77036352ea81fbe6b2425d74865a9dd1ea8a6919f5bf9ebbe2d307d12590053a7b98ff3e336d51958428672065d9872f9830f2891b3c96
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NDM:A3k03kHRJARJD
TLSH
T12B259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 955KB
SHA256 cb5edf953a754630140cd72cd73e624e4fc6f79fa86c1b3438722d8735fa0ea9
MD5 59d4c924e9b675fe405d8d2ac65c1d3e
SHA1 03109fdc1f8aafdf3b37e14995d64ffb17e93628
SHA512 dfb959685d8aa58e3ef3b8e492797a24c66c81d923b0015317a50ccf211e52da65342d88f1f40b3fffcec108bee85edc393a3ebd28558a28c690c9f93cb30f7a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyav7NEh:A3k03kHRJARJ9
TLSH
T148259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1756-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1756-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4488-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads