b1e87f9e5ff25b35afb55c6d96fc3719bc0cbb4eac91751161a3e59912a3bd15

Analysis

max time kernel
95s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 925KB
Sample260724-2c3s6avblb
SHA256 b1e87f9e5ff25b35afb55c6d96fc3719bc0cbb4eac91751161a3e59912a3bd15
MD5 493599d7adc7a0efb4b10ea42a51aa7d
SHA1 09764cc5b2b806d8486f571dae2205dfad53ee4c
SHA512 ad1ff45d16f8c20323ab5b01d9de5397a51f0593dcea94fd32894a5fb6fe9fd575f34c78d162c9385a5488d2db3a6da6fa2906bea36692705544cc6860f2875b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKp:A3k03kHRJG
TLSH
T12115AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1324-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c618-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1324-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3640-203-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-458.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-690.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1090.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c618-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-222.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-259.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-458.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-586.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-617.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-690.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-733.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-783.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-821.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-852.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-871.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-890.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-903.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-916.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-929.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-948.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1003.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1046.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1090.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1134.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1165.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1178.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1215.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1318.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1337.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1362.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1369.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1384.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3640	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1324	2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3640	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_493599d7adc7a0efb4b10ea42a51aa7d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1324

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 925KB
SHA256 b1e87f9e5ff25b35afb55c6d96fc3719bc0cbb4eac91751161a3e59912a3bd15
MD5 493599d7adc7a0efb4b10ea42a51aa7d
SHA1 09764cc5b2b806d8486f571dae2205dfad53ee4c
SHA512 ad1ff45d16f8c20323ab5b01d9de5397a51f0593dcea94fd32894a5fb6fe9fd575f34c78d162c9385a5488d2db3a6da6fa2906bea36692705544cc6860f2875b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKp:A3k03kHRJG
TLSH
T12115AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 37f4dd3f5b265d708cf5fe67556f2ce6a2786d0dc4dbd434cec274fc936baf0d
MD5 f2b9a5907c763e8b7857c5c17c4438cd
SHA1 b61803995885e68ff1e1ad7f200dc6e268fa7748
SHA512 bd7ac7b0f8b263c42411dd94dc42a36e79de49baa04d8ba62b069db712ed33277b1bba3a15af2d277d8fbf957a06955da0339395ba0316d4e939da7a90a1faab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKV0Le5ji0hmxNrM:A3k03kHRJGPji0Aj
TLSH
T19F658C17F6A402B5D027C1B8C5D6966AFA7138821B3086CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 939KB
SHA256 1b3ec49d1a7f156148c88c4879955c1947213ad2881ee44f335c5eeed84e6cf7
MD5 5e82c8ddf092d70ba9db01a935317b51
SHA1 aed5b2d604674dfe2659cb900609623b9b2e2009
SHA512 5553411bc3b80faa95e1252eca559f77b9596ebc1c127225d44ddd88b73920abae71d5286aed75c9f3a5fa691cd9c18edda5f8849b40511af4f3e637d2d68357
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK3a:A3k03kHRJ
TLSH
T1DB25AE13EB9500E9D10AC1749AE65A23FB757C56176093DF2368C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 948KB
SHA256 6d589c1d37fc2232ca5b343290ed25e4fc1bb33a7caa3bc7db5c176e7aff4b41
MD5 ac2d67801474267cd4a78cdf9c30a729
SHA1 9c50ead8b7da289b3a58d705b7e5038de0b52a63
SHA512 c32a9b353a10d69aea5e1d7c906ff899293f33e8d054c3a8783fafba843cfa87490773d8aebae13c0acfdf14026b40caf43043f6e82d3c40ceef174f66fe3de5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK26:A3k03kHRJw
TLSH
T19625AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 948KB
SHA256 9e9cbaf533abfd28b8b852c805bb317e5217be616b1fed4f57d5a77c121a6968
MD5 8bc70e7d19706f4debfe9530801242fc
SHA1 9d658256b8d101d0ec892f2121c3afd48835bc4a
SHA512 84a9193238445a45e30ef3028415ea1294b9875e90b3e103fb9a1f6d390b46a4fe5538df01da06b781b99de50eedfc7b33cb21409ca9572415263e6b50e07d33
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKmN:A3k03kHRJt
TLSH
T1A825AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 948KB
SHA256 e9bc849862254a1f6411b444f2cf43f075805a401ffd202d99c36b45eaf6bb80
MD5 bbb5d412b05946d05c312cc13bbc1d61
SHA1 374238ce43ed0179abe1b6e689466729228b7c1f
SHA512 089bc65890402795f8bd3017adfbad5865666c15c76c15174327aa5e55c66a794ede09f99db3b9539357723182ae0fa91dee13ae4d724373dd8d8a021f303005
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKkf:A3k03kHRJF
TLSH
T1C025AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 948KB
SHA256 8002cfccaff562d4df93fa492b00c5fadb4f9f9a4044c550d3ae5cc538f9d4fa
MD5 be5a9af4768b1c18720c8f91a88fee73
SHA1 4589e9bdf3b3651eb4e9b9bba5325e3687af0c55
SHA512 02ec8a45ed2f0393f998c43d6e2305c2dee2ef6ee15f56f4582738def6d489df513b80aba77418a3bdea3d36b366d275e75841eed729c9f2a9dda6e1702ce5b3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKOo:A3k03kHRJQ
TLSH
T1B525AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 948KB
SHA256 ebd76d23b1686bdb6f92e33833a904e08bc4349064c1ccdba23e1276e6ce711b
MD5 f6cceec2ad670afe9b33e97a5e0487f9
SHA1 351dff5a121ab490f85063abd7405c5ff5a53366
SHA512 85d4aefb45fe044369a8bea7ea410ce0807a20dbdfdd59335df9603a342e3eef23dc7e52fa95e4a9df48ffaac426478f9e8d43d814128388cd3c2bc5aae6d5c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKiu:A3k03kHRJS
TLSH
T12C25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 948KB
SHA256 52c8209a189c0a368a088ae5649897816454723074bceabddb50aac09327cfb6
MD5 d38c7c5ea964b62bae82d717e79c78a5
SHA1 b7f99bf297904c5819fb931979f812e10d6228ed
SHA512 136cb51c828f171694ae49e19bf59b15444b4cd692ded1de0acef517f5a5dbafc532e728e39472a9e78426be71650a6fea99e2f1b511871a5d810c4f87777312
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK29:A3k03kHRJT
TLSH
T14D25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 948KB
SHA256 7269a0f2e6841f4915c24836a3edaec73e16725996330d04331acf8070e350f1
MD5 aa3f1748227e2b6effbffe847e351b84
SHA1 cbf975b41ae4204155688c9fde896acd0f9fb2e1
SHA512 5da8a4eefdf74771091473785925ce9d493bebf7d1f93b3af6277dd055b979f5bded8ceef87b18f9e2c88ee42d6acba26f456da9abd9dcf4e99f1f4dd82f441d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK2c:A3k03kHRJ6
TLSH
T19B25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 948KB
SHA256 e1ffbf2cb0b3fd8d041ccd1f977dddba2a210ee23c8c4ae8b1bc920dd5e75aa6
MD5 c5be046a2ebb6bebe132847c703c0f14
SHA1 befad5bdd94653d4ccac805a7b8afb6961c227dc
SHA512 76ff0e7e25092a6f12cfd09526418df16ea13d123bba87f592b45d3136bf11df35bfd722623911c642e8576e6e2535ca1860b576d612e20c70e66f841fefadb6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKvp:A3k03kHRJg
TLSH
T18125AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 948KB
SHA256 82548f2eaf95ab4cadb93ca21275dadcec7ceeeb451c7baad4c4082494ba02d6
MD5 308c9bc52119b66e6314baeb234498ec
SHA1 aa2adee0eb04092152225d4298e00ac93d52a497
SHA512 0d7a2951a2bd19380bdded0fbd58e4072377bcbbbdac36595ff30ee2e00bf47cba9d09bd7e28edf4fe35e173a7eb3ffb380f3add404bb7df4984a553b7a08562
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKQN:A3k03kHRJf
TLSH
T12425AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 948KB
SHA256 58a7dbe75aeb3dc235bb94deae021bd14838af66405c01886bbcb705a11dc84a
MD5 e0226cddc825d4ff4310aedd1ab2551f
SHA1 89a1ae830ddc3e996e5da51bf1b9d8011ec0e735
SHA512 75583da900e1b9cd2e6b4f7f7c8fabf3cd24ad76f099f966fc30b595581e0fddf9bfeb49f49228b1ec9fc9413a73c1aa5097513fe2be294611c62bcf85df75e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKYF:A3k03kHRJ5
TLSH
T14425AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 948KB
SHA256 d2f4d30422f631486fd9588816b5b067fd6d7b9b27e20fa9ab4a75001253b56b
MD5 bbe1a4afe2fd434f12b7acdd6c716529
SHA1 5dfc86c017ce0f7130686d03e98ebdd3682cd80f
SHA512 0d03c3526a388f4bc32ffc2e63bdba2a15891f008f0bca0d56e1bd29b6c94f237d1ee17a5231409ab782b6da668b31760389ba5699262da790fa070e6cb517c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKNC:A3k03kHRJF
TLSH
T1AC25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 948KB
SHA256 4de6cb224dbd0ecddf0fc7ea7121fc9276923f45e96a628d813f1d7555c7ccf9
MD5 4cc933c4c668978452b54515d641f263
SHA1 65f1d89f2febf45047ea15e123ff55924d48c5d6
SHA512 35f0e28d79649d1ae4ad2e6cfecf95f418f954d1a89348f44b7f96fff0c41ac37f5266f208ec05951b2b448265454eac4357d5e6aaf3cc13c5f9f076db9d1d8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK2w:A3k03kHRJo
TLSH
T1AB25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 948KB
SHA256 172fe4d98502985050edeaba2bb58af132dca9cc0ab75d5e38677a2328631120
MD5 dea73db997e872d8be8e81838a3f9580
SHA1 2d37f21fdb2e217c390c4ca6a4d3540d4f71666a
SHA512 1dae0e7826123372705d58114bca80f5cdafc3266ff780ff1b08ef62e4fc6ca654dc819d1811a033734d784899a19d1a6c1c48ad94a19b8e7d16f5ceefcd1b3d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKlT:A3k03kHRJg
TLSH
T1D525AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 948KB
SHA256 6f1a8215cc916c189edc9ace526bc5b4f9ed3052b6559477b2bfc67572f8bbfe
MD5 064833aa119663d8b1e1b433eb9a60b3
SHA1 f41a6649cea65592341cea5e3a2dff00093efe2c
SHA512 2b72f4783c67f9b9c08f7e927076cc5059c9df81b509b157e7dbc78deef52cca6f101c47120f5a8368440e6871298d8306cc51bf654346d15362926ae300d7e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK7u:A3k03kHRJf
TLSH
T12825AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 948KB
SHA256 e35e761832c8ead82213ec0965d3ba4ae400baec45cf528966838bbcc7b7f53f
MD5 e76b76e06e3b77599574a465829ac5b1
SHA1 dafe50fb251fb1a405fff8a800d38efa4727f14f
SHA512 e38a1f6b50d0870f1b6ec724be75a89210214f2c8f199b210f88d1ec9f15bc6a178eaf7baf29a123aaaafae407e092b4d801fb351f7fe8a3e55af75e65b25749
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKfb:A3k03kHRJG
TLSH
T16725AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 948KB
SHA256 707ae63e457fe4b5622e709728529db9e93a50c157fa4ddd2ac0b6496fc93915
MD5 49555474a5f51c3554e9d55b54b937fe
SHA1 753f985df09952d35d7963d01a0cb4127b47b3b2
SHA512 f6ef265c7eec2895ffecd682eed00e6394751e2236f0cc77a1d4f56b014e74cd873d99352cfe5886a907ca84966d0ada3e0fb2da00b59e83d78b6ce3e6a763ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKbf:A3k03kHRJW
TLSH
T10B25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 948KB
SHA256 21d93066c803f73d2a18e862e11d49c36961f9525f65ec8073b120b0bb9ab106
MD5 f575828b9052a9496ecf0e7833bd1de9
SHA1 99a38f75ec35d67234f43b2b5fd7b9e341335832
SHA512 bd0376df3bd9fd16ef45862fbfdde95ce6674869c83e95f863b3b0774be68bcdc957b6a84389e839e7aca587fc8a6b24cde70b5e768382cba0da5a110c37063e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK0K:A3k03kHRJ2
TLSH
T11E25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 948KB
SHA256 165d8ffd54f128e50a86d61df4dad194b8ddef69b84f9cc87ee1ff28c74c946f
MD5 d1ebb92d879343bbec531f4f24c33627
SHA1 a57f7e59c4614400c5bd79523b38ff003961b60b
SHA512 25538a12e876ee0f2ecab1bd1b676d06eb4b793f3363d583e65fa2e6822d2226f871abfe362e4a8547d46a908c2978226ff9c71f868ca2e52932811bc85fcaac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKpk:A3k03kHRJr
TLSH
T15325AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 948KB
SHA256 fb3fe42857ba62eae41bdbd55a5f8adb8780f439c047eaacd105b5e28f96333f
MD5 1502f51a6ef5b42993ed894522111c1f
SHA1 b2f3a1f4cc1799e12935db3687aeeab297608596
SHA512 71e943a10c65bde29ca8df3f21d4dd3c88fc43e0df33d86db17111f82b238afd98004c515729b8def2bcb44d67541938091b74eb077727c9d4d9a2d81e06a92e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKG0:A3k03kHRJ6
TLSH
T14125AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 948KB
SHA256 d3939eab2c22042054c5f54126819449c55be5179ab701065c1915a7fa72eac9
MD5 e24d0449a6c897bea453b2f8770f675a
SHA1 288795a9f04df906f83a1ef191472b34f56e0a20
SHA512 8ad6c0fe30d6ea5a54638534336eec7665ccea1d1e23e7eaa3cf46f6ca4cda6cc7ef46ed0b2a5920c8665c15a800d82c402217119de1e17df0337c8e340563c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKVg:A3k03kHRJD
TLSH
T17825AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 948KB
SHA256 218becdb23e17f95d90854e55002e1e2f232a4c98f9a9a3dbd495391c8340d9b
MD5 8a865a4d40ee8dfb06d094bd2c711656
SHA1 2f2cfa3fa4f8f1ee1f88cc76dc2658c34d4e08a0
SHA512 19d1522972f8fe221b79bf172312aca41533b6662598f2e7eafa47658ec733d2cc4c4a178f944469e72bf2c2a053670c8495cd9343f69930000cdd99e51e4698
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKkr:A3k03kHRJV
TLSH
T1FB25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 948KB
SHA256 6464999057f4dbfc2030e463f63637facaa80b8d0531d95cd9a61976f4dff9df
MD5 e9b9fc554e4e776c4d3c38cb098e1668
SHA1 b1f2b7a942b15255d3718eac8a63a03916c05a81
SHA512 53c5450a13fed6ccbf11cd3494261ad4a5796b0a5c3af6fe3bbd33a2540918ae35f1a9e0368a8a291c3000b1af10402dcfee0ec1f0ba7640b56fabffe71e485e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK6n:A3k03kHRJH
TLSH
T17625AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 948KB
SHA256 4688009a5dc65268609ede937271ee22d1d0bf0ee4fdd48541c1512e7ed429fa
MD5 db4ae20ed21d8e6d16338011c4c401d4
SHA1 537e033645417e5cdb83183afb0d1d8f5f4a48b6
SHA512 70054b70aa70d94177b816ae73ea63d6341579b95d5b88211b1a3a8ac143760c8d8e2c2163c2ba1af06ffeb611faaec6e36c577d358d48a8a14521a49d8e280b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKQx:A3k03kHRJd
TLSH
T13425AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 948KB
SHA256 716060a220a32c68be98679ce6e61bb5d7ed70d695bb32594fca3688b8096bec
MD5 d5d8d2858c2e0f181ce7f18b82919961
SHA1 c153114f7bb27b087a1244471d686e5c8bea85d2
SHA512 0914c9a9c3b8c5339dc3feda1b2cfc5334ef968f8b546d096c40ba09238e4b7910743b1e71010e93c46cbae5e00f49a89d1caf8eebfe656ac0436d39cef65398
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKSA:A3k03kHRJC
TLSH
T17925AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 948KB
SHA256 3b49713ed075f834412fec8a2923aad4697fd959d3d2c32feefb64eef1067e54
MD5 5992643280b5fa41873ae425114ca3a8
SHA1 588565268e3121985cf1d16bbe87da2b154682e7
SHA512 bfbf64ed3b0bfa489929d69eeb1d887c901557efe1aa031aa2b306429677e8b86b1ad8462b4794d41f5601fd9c4e8e963e781bd1e5a448cbb0398c8ad819855e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKr9Q:A3k03kHRJf
TLSH
T1DF25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 948KB
SHA256 ee4a8f73572af861332966acdcf0039036f7df338dbce642499ef4d77e058f2e
MD5 5dcfe06a883c6ea093ef314f634763cd
SHA1 5009edaa4e8affb090331f4f949f83afb8e2f351
SHA512 0617f9d7bd000d50b7547554666d86ee0951008c613f07207444980f521631d56925ddf0974fdb84a3841ed57cba271f67f5ef731a2285664b85c5c8e91c92a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKa4:A3k03kHRJg
TLSH
T11A25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 948KB
SHA256 e4c09b2c7a767df3759c3521b8808e673a241494454ee94a77de73a006cfd9ef
MD5 c3918fe7f99691238502855e2dae2f61
SHA1 815d9e650d1238f9311ff6b4aa5daab102533ab0
SHA512 9b1f1dc629a532dfb91dc8b4b025bd3339069c425fe3f70fa7dbb5c369d6d684a82dfbdfdcac1427eae0042f1489997e9ecf63329a5afb9f30e4fa75f727b983
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKBu:A3k03kHRJB
TLSH
T11425AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 948KB
SHA256 c191c5ff035e072a8c53bafbe481d0d5be3e33feeb6daa2f5afb97bebe4272b4
MD5 fd429ed54f692be0c2b845b38b270a52
SHA1 3da00b904438190bad9954520c6b21c1455fb5cd
SHA512 77b6bbd67f2f20ec3736a26f4e844d9cf61b02dba7c731425edb66097f7cd0da92eced01e4c9fc40e5149591f07ca69893f3b7ba6d5492e3cf91ab2bced23fc7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK0j:A3k03kHRJr
TLSH
T1E225AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 948KB
SHA256 526d36b041afe0c636d5d1f6b1820067022dc620653a88587cea157c2539ff5f
MD5 73d72c02f5f52183e9c4b9cdee4faf1b
SHA1 3a219877d28303b4307d174842da8ecbddd401d1
SHA512 3255f17771214c10105d1e4be65d7a0cc72adf0b244f0ddad224a7b0fab99439ed722d9b2821feab0b3d2e4de68ff277247ab4575b518b8573ccf3fc4d7d8809
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK1g:A3k03kHRJj
TLSH
T13525AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 948KB
SHA256 4e53b2e9c0287b0c39866e458a5cac6110eac66a123d8236633ed81067f722cb
MD5 3c4a14b021253a342160588811a58c99
SHA1 7a9d5e3d56299807190ca5a10e68a00c15d21f07
SHA512 00918811697d4189541a43da9bea848fdf066a4d90ed82b5ad363efa5db666e4b6bacc819bf0ce6e3db6bffba049ec49dad0759d8309cd61e6acd35e8db502b5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK0I:A3k03kHRJq
TLSH
T1DA25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 948KB
SHA256 577cb29523a2c9afd9a2a6fd735b568235b7d29b3cbe43bf773fabe02c1f5b0a
MD5 db0e3b88e537de1bdf0d74247fce974a
SHA1 52b8c5f55790adf3def176cee0c97466de823e0b
SHA512 581f6764ff2f5216b203ac4a300181f876fcbbd84230f029f2348212a46d12a7d492c377abe2e06e4ec8e745fe0c00814917ec2c8ae00ffccd77d28b1c776b79
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKmo:A3k03kHRJ4
TLSH
T1AB25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 948KB
SHA256 4fbc22a496d449e2c2a65fd2023fb2805a9c3a109959d2d29ff741ae57b41857
MD5 f3720d7474b0b3d1731022fe4d7f2f19
SHA1 83df5f4abc922fe96bcb0f5e28c65844c6761f9c
SHA512 87e05d17d0abe2f1b033ed7745448eaa62f2671d428f3318f7177c8942ddf19daa90715c07b56d05e23511a2389213ad9dfd431579b8ec5f99974915bddd50a1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKN+:A3k03kHRJF
TLSH
T1AD25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 948KB
SHA256 4ba2f74570a5d934dda3976d826d8a58918da3ab24582c68d408e172eea587e3
MD5 36b72e587da98c88aedf06845aed6aaf
SHA1 0f40c88100b8cab4af752841b25d46f65d488054
SHA512 e73d47116ccc9ed39c3c4be30e8f6d573dc7c7c8722af0346cca08c03dcec5c40f73c6927d2de3d430117553d6cfc95092a6085b14267f6f858f300f0538969e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoK7Q:A3k03kHRJN
TLSH
T19025AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 948KB
SHA256 8dd0830c890204b267d8b709fde76c44f7cc7f815b77678472b10f0809264ec8
MD5 dce10035413b2bc1b313008201123539
SHA1 a2abb29f51cf93caa49b95ff7ef1b1a9c9735113
SHA512 fee900e2ed6b6b72a9765cc34f09da9557855ec25eb8055c26d803e354b7eda2ee8be93ac65b3e8e2de4edeecb74fd5b2d8508f86d5d8480f60385438d7b77c5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKwX:A3k03kHRJ5
TLSH
T12E25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 948KB
SHA256 5e0094cd3bf52e47c4ed4409ddb50565b855e14285d71c6d23c5cf261245b52a
MD5 530c3f387a7d879132d1b5f1880e4ab3
SHA1 4690238d4343748bcab7d549c99d36ff8102be81
SHA512 6254cde8cd755eba021a187ea773dc04e0ae7da94b02a9111ef29433333c2dd5f7573e941902f61a13546ed7ea1aac265d0a879babb2712eabb5e741f7f4f4a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKGL:A3k03kHRJz
TLSH
T1CF25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 948KB
SHA256 f91548f4514f75625a60a12eaf266ea33a5af070e77aea525d572cfd179bbef1
MD5 e52c746c3b797b2d4f06c443e4c92347
SHA1 292c196b4f0bc3dce3237fd0c2870f2df3da17cb
SHA512 52b89c58390e8df3aac5e2059b3504e650a3ab619ed355c0356ae8a678a310abdd375ad3e9a801809f0796edd100df9439f01d3a7d966a41b68417618bfdaa03
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKaM:A3k03kHRJ+
TLSH
T12E25AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 948KB
SHA256 bda4c2051fa2b342d0283abca2d84d32ae4311d562dd15c2980bcb073ecd6ae0
MD5 aadd39cb1006b13762963bf64e42f2cb
SHA1 4734bbc11aa6105e034f8a8e30d5b7c1d63fe513
SHA512 c50428c68472635ab7a47e62b3d13dfc3d6a362159eadc675aed9005a0bb1c5d394a517dd9526336dc18a5705fb08a000485ef3d9cd740e4c590a7266a6cbae3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2eyoKLh:A3k03kHRJQ
TLSH
T10425AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1324-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1324-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3640-203-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads