670e0b14950cac66bef3478ce3825a034ae7c99e0485ade352e16753321295b1

Analysis

max time kernel
89s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 947KB
Sample260727-ed66msvfmd
SHA256 670e0b14950cac66bef3478ce3825a034ae7c99e0485ade352e16753321295b1
MD5 0f39ea1a493140d28515267ea5e9c740
SHA1 6b127f4cb8ee6cbcc7b1d219d24b9ffb8a2d1523
SHA512 ac9b756ed0fb130dcc796ba69805654e7a8a8b9b8c04231bcaaee6ace8e1d16e17b9a24a9bc34b177d511b67d434e3a459756a20a4288a290521bf59b2887c4d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LZ:A3k03kB56rt
TLSH
T19B257B03E6850FA5D10F81749A964662EA777C425F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/708-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c567-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/708-178-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1484-252-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-708.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-820.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-996.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1039.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1058.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1119.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1145.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c567-6.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2bc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-39.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a4a-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-708.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-820.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-928.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-996.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1039.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1058.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1119.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1145.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1368.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1389.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1484	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
708	2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1484	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_0f39ea1a493140d28515267ea5e9c740_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:708

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 947KB
SHA256 670e0b14950cac66bef3478ce3825a034ae7c99e0485ade352e16753321295b1
MD5 0f39ea1a493140d28515267ea5e9c740
SHA1 6b127f4cb8ee6cbcc7b1d219d24b9ffb8a2d1523
SHA512 ac9b756ed0fb130dcc796ba69805654e7a8a8b9b8c04231bcaaee6ace8e1d16e17b9a24a9bc34b177d511b67d434e3a459756a20a4288a290521bf59b2887c4d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LZ:A3k03kB56rt
TLSH
T19B257B03E6850FA5D10F81749A964662EA777C425F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 301178649b0aa40d298426e359522fe39675523d4049fbc308e650b95e2c73a9
MD5 5115fafca6de66049ea021c91ee7bbdc
SHA1 cab496a4f311c5f50f3a1432635aec1d11915d09
SHA512 f8da090904206ec24d80b42ab54ebdd0f60a0ef8eccd1f319222527937e8b0f5c9a8424743a6e5f11932f8657cde35bb17e0eca7540f58d71400ffee107de8c2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LF0Le5ji0hmxNrM:A3k03kB56r5Pji0Aj
TLSH
T1E6655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 df2588054aeace89f93f09405d76c70db64a5563a1fc73b1a10f9ad04060041a
MD5 f774411cf4ca9fa978e9d73260222d4c
SHA1 5b66bd2a916c64ba64554455359954a4437fc8d5
SHA512 3355d86a59b47a171eff1ec0e10d338e0c5aa033d85d83822411a4f2d0ebb48bb95a211dd9aa30e695627d272a0bed6fad78b538e3a837c4cbd0e81d98b36053
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LHa:A3k03kB56r
TLSH
T1AE257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 1575a28959a81d20e239346dfd478d7c0a9eb99a22645e8479d50631070b7d1d
MD5 1a2451ad8bf65f789c5989dd2e2bfed5
SHA1 a18c476b4ce7f242364b8891424993c9131719bf
SHA512 8911ad033dd4bd6b304a3dadb16aec028f1fe5fbefc04aea97bca54115d9d2e18d14690a7c002197c1e763057ec0ee1dd6e8dcc52f50a957d60f6c64d4e33cd4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Lm6:A3k03kB56rF
TLSH
T1B1257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 971KB
SHA256 a5c7e438c04e38f50ed76f5ce19a71a799b8ac31f064a9833f2545de70d85678
MD5 01595272edd37113b04a36da85538ec2
SHA1 e6de70e6f9e38e9661eca3ea301537daee844e74
SHA512 514ce24fb7f09476333d87405d31e56ff9f24ffe788f9b3b62e5f77aee5462afd205ea9e698bfa14a45e8c4fe41e3cf7da8b15d2fceeef4e7b81f6a4296c1320
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/L2N:A3k03kB56rU
TLSH
T104257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 971KB
SHA256 1308606db994e1b8ef5278df449258ad3e745353fe14addeb2b7b0cacd64c3ad
MD5 f71cf68169f554b90dad152e74016f15
SHA1 534c33c54216fc2b5fb3b4111ba18958c8f7123a
SHA512 ef987b792d00e23f2358c68a3f04b11398b2ed5ea013ac85a66492ec51940b64e3ea2fdc1d6fe3c62949be4b3622095dd293dbc64508e140e84b0799148f8bdd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/L0f:A3k03kB56r0
TLSH
T147257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 971KB
SHA256 2fd5046c8f2aebb2c0f4f7d9c416ebb89c5eb1b03a53a7245735ca73ea65094e
MD5 4cd5af27fb1da922daec826f6f935c81
SHA1 8af9c46084cc109b53b64bce1699fb6e328b7565
SHA512 3ffa597212727bf3192fb5812fa542c7005e108e565bab9f37ec2b603cd9611755e482fd2fd3e6720c148e5520e5d11b8c580ddc07f22bec53ab6841a2ffc6d0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Leo:A3k03kB56rJ
TLSH
T11A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 f15e41d1e2ada811ab845009d9260de706131b58380fa8f3fb1233d8aab09a82
MD5 7a9cdfaa91b1e068568cb680e1d0018b
SHA1 c9e1c8a331ad5db349957889860e7a19586a2393
SHA512 079a7749c789142f32a07d0711a437a03e4d55be701d4158079cfbc08b4b907cf81d5224bddb44317d17ec128a8301f7da6c73e5b2e69f4353f00f6678b9b63b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Lyu:A3k03kB56rr
TLSH
T19D257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 4d78b4f93a036d06af9c02664125bd36c951314176f27cd640d844ba9d295c99
MD5 818da9f6be8fd233cc9a4872eaeaced3
SHA1 857b7035e202b1cd2986cacd9942b7ebfb509c93
SHA512 28a9eb8eed89f77c6fccb33434d4c605066ec0281a8431d0654f9e52a5145e593580912cd6b087842718ac3fd30dc11e60d0de2784eac76f8167b31481947fbb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LG9:A3k03kB56rK
TLSH
T105257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 9f3893b08564798cfd688f87f6425d72a488f81cacb8801ccac60c7eac1cd16b
MD5 80f5fb4fb3e669102fdb3de156faf759
SHA1 dd8892934517a19b92ce7f395cb89d3e67f92797
SHA512 00cdcf5dfe6ebcd7831a5cbe4442f00fe9b12a2dc874dd1b4ebf39b8c985b6fcdfce7213a82503069302984d3fd67f61c4d3b26a6aceb9b188a16bbf8685e847
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LGc:A3k03kB56rn
TLSH
T192257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 4018cfcc0c49cc924911b37c7c1ae60394a99f621852b2e6aa55cfa845787913
MD5 4ce44b75dd89bd991722afe182c73e42
SHA1 7f879d831703046d87368bf50647a6c9b2293dc4
SHA512 9bb9dcc64283354ce67faf8a9bb0b1ccf0fdc82f37cd5e51ea28f382655ad15dace60456f40e07eebfbed135984f49c09ba0838784e894aac64d29d8cf144b4e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/L/p:A3k03kB56r9
TLSH
T139257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 c6ed1bfc33897c07fca32400935f0d22dee6bdfbb4f195e43eb91ba49dbe872b
MD5 e0c4ad47d586742240115efaa993adc3
SHA1 bbc03daf4156c20f4440e5975e2c8e7f003187f0
SHA512 c1eb7689c0c1f2962294365cf9d967d9e1538fa03d2846648c3222ed736b6aa5b53b26155a10bf493aee098276d8c6c08b0c1d80415ba49fde111851101d9e14
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LgN:A3k03kB56rG
TLSH
T143257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 a4cfb8fa48e7b6817d8a44eaa759053620a0a9bc37162c023707718e35bc82f8
MD5 c4f90851f03698154c3c16ccd0fcf8fe
SHA1 1b8c24d7a9ba3e1b7506064468ae1e7f67cf6c89
SHA512 791b2e68aaff095273b059d0e063e13268695ce391c48ff542ed11097dfcee7686437eb2be4fe940a607826f3770cb9679a0060da122a15e96fac19b1c5abe98
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LoF:A3k03kB56rk
TLSH
T118257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 cfbab119f18df405e2915dcc662c816bd59752cec2f9007f91adf0d922cfc5cb
MD5 36b9dc5ce42431d8e69b397d5dea6769
SHA1 564e3a69893930bc527f67451c1d1cd5c0ca27c2
SHA512 e0e74e30be8b943344a88184c3d2fd233a6161957df77bf3eb9342783eb35e9b31cebb2d9df8c25518ae076586b0b0e200795da2a2b96896f8b1f685a8e89fb9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LdC:A3k03kB56rQ
TLSH
T180257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 dfd34d99b05fd636ce844bbfdd7eb0d5d02c3a97770d2314bbe51918208a0da2
MD5 ff4a07af466d7c5eb3e2daea1ea70e8f
SHA1 58e5e320a17a0e65a11235eeaf91f19b722b2bf6
SHA512 c88f51af245b567aace5872f2a9a2f93c6c8f0f13c51cc9c9e3083f9e1fdde3fca666d533b393650ab3f845e050c0e561716a256407ddaf66f0761491ac00572
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Lmw:A3k03kB56rt
TLSH
T1CE257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 87e49b4a121d6b697624f44fbec55d49a54fc7ad124fe9ea8c7e6e29d8888c56
MD5 d14458f5f8ef62248530d5adc9fdc68a
SHA1 616646f354906295c24428a76b5b2702f7dbbcde
SHA512 121ede504b5db87c6c4276d49b861da49d5e42cab15b94ba8ca44d61682dc35b75539c816582dbe145d161cf9ec2ce8ed477f7b5eaf5a18e85e69feaf3e9ef44
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LVT:A3k03kB56rh
TLSH
T142257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 e2653706387ff9abee6a9f1afee1f46391d08ab4d8933f74a48f1d0f6dfb9304
MD5 991e7044edbc41b24520f44f4c6ca7dd
SHA1 364adcdc598732d5889eda9a0c5c510a6734dba8
SHA512 1b5671421adb02caf555aaa0a42704fa6b6f5312f431f6260fa56f3f01dd9af0c8f2e1fd1e3212d389f5cd34d066acb9937d445ea54262d7a2e3ac4cfcc4aba4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Lru:A3k03kB56rW
TLSH
T156257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 af341946c06d3ef6bb8416f9f0d94ffe6a805edb78bb52ccf2937cbb311b3654
MD5 6bda302daa77f9aefc57d18f8fd95b44
SHA1 d211b2b6c3e955e01d2295e98b6f763867264770
SHA512 dbca4ac8cbfd1f09d6c6fc130de6a26dd7171bf46579fee356d23f781875eba0b1788f65afdc7f0435d6b5a7a6aa5ca4cfa8539564696e4bfbca790a85fd6860
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LPb:A3k03kB56rn
TLSH
T1C5257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 dd4f9ecc612c553d133a6c83dd3e15217233765adc8db8aa6d8ccfbfcd854638
MD5 51ef979e89497ae9d7e8c1d2b78aeac4
SHA1 92b388e2dfe3b3ac88bdfe071523f406b21d1776
SHA512 ba2c56edada7dc61c5bea9c5e11285fcf66ed55be8f940af8573e525740b4f193abbeb5398da30de3cebdf710d45c416cd07077e9b9f24f05b8cffbeedf011a4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LLf:A3k03kB56rP
TLSH
T18E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 ea3f5462f2edf4ba42dbb7d0ae48d38f63eff743ba2fc589a1c9212c72bfec0e
MD5 a801a9f8c6be2e40d5303b4d9c33b9ff
SHA1 0c4fe2ec684032c8c5c435fac2360d112b91a470
SHA512 be5b337ec610b870839a9d902f83fb6029fe17d2048d64e322e702e377bf87e600dcba10c9689b73800b38771bdf6fb9d5a75cf38130cc189c6095ccc2a7da8c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LEK:A3k03kB56rv
TLSH
T161257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 57d86a7aefbf4018c2941cdffef146271b8d20a16ded5dcafc237f57005b4cc5
MD5 d86d57e3d5a9cadcc8d79c20bb500dfe
SHA1 caf119200fcac36f2c613c7720f4e168f019a21d
SHA512 45451fe940bfb35cc3932c11a7b20305c8985c8dcdc056a0080c79c5e844f8e579e3cc4538d88abcd8255afd54543934417cccc5aeefc8254226ac42f925a19a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/L5k:A3k03kB56r6
TLSH
T113257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 8e8844b366151287fd73e6e2f9fb86ff8498ebd93c2e712370cccc8c4134d806
MD5 63c1a4f38bbba1e9a6ec51a1c996dc7f
SHA1 60da0b23db2bb306168b35b562f23595f34aff02
SHA512 532d3526f137d52ac1dfc65d8a51767d7474b055acf03b5cee22a98076ad2c699b71a8929ffdd2f2731b36793217f40c5ffa7f335d3d52649055b1d0619a37d1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/L20:A3k03kB56rP
TLSH
T1BF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 cbbae4487a631d284cee450f6291e575b87589fdc51ee24a834a0f0b49a2fc80
MD5 538233608bf48a5c719ba4b5456ec3d2
SHA1 07e961536d629b5322133086bce4af315fbf3501
SHA512 6f8f7d8471203fd00cbe94d3c5e97d3d1a0f786048bd1d59f668238daa18c834dd9f1042d0bcfe5c96a3758abc5e39c47954c6da25482df56555b58522443ebe
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LFg:A3k03kB56rS
TLSH
T177257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 294655d215932c83c1116251e6bf5772f57023bf94f84ca1e786e50beae6caf7
MD5 af4d355f7f33879c53d4f00cf53364fe
SHA1 6d9db07c1675278a4a067893333bbe6a51b9493e
SHA512 e290aa60574ba7d52f709c441ffa0f018ca72b8cd3dc873d098f87b232aa5256f32a489455358ec4a285f08323971c2158f57949605d238e7bc84abaff295a44
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LUr:A3k03kB56rc
TLSH
T19F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 740b1f882572174bccb6cc02e02016f29e9f67b5173e51e2215538f126a71585
MD5 f84481139bcfa99a970b443d1ce93027
SHA1 f3f71b4e5802421d56ed1f1050f4670c5bb0bebe
SHA512 518447711dadb6155cf77e30fc39a47416afe98af8db99522286b927cd04a5a87e0389932ebcf53545eba6bf387ffea2565b3aaa2831c23247b9e2368b41dbaf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Lqn:A3k03kB56rm
TLSH
T169257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 ec74d2668647485fcddad675703bbc88b95a745ac87656bac383e9e9189966d5
MD5 84734cc27a3646fe2c630e69e517298f
SHA1 7d56e65bca78c0a3c885182aa1ce49187972288f
SHA512 cb4e00f523b8df08bf32af5436ee84157848907e820409df9465ffc189a5cd043daa47703a0082e3befc3acb8999e742cdc2a83dd3f6d3f4bcfa2dfc5d6466b5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Lgx:A3k03kB56r8
TLSH
T122257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 7cfb8b4a8e924cf3de5ef7c73017b6b50b115aaf3f2600bfd3124d97bcaa38e5
MD5 6a300ec460914377ffddad9dcbe9a817
SHA1 ed5d38b22d89aef6a9e85bd32c168147ae89d311
SHA512 1ec7333106cd979005958eb8b29866cb6570aabb80b4608fca5c4cd3296d45542e32dab78714b0f01e86ec56713c3f206466266c41a011f5c02b7af638a9dab2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LiA:A3k03kB56rH
TLSH
T159257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 3340dd897767e4a36e5389f63e4512b52c2bb3aed3d56933374f15009e440496
MD5 42c2108c98f4240b97a3741fceca3bb3
SHA1 ea62257db719e1459b80e087d6f27feea1b5d435
SHA512 54218cefdde823c65f6fd6c293940b7517c59d70072a501361e42132fa10feac8efc3d2453b7f5ac4b005a56eada0899ca79e88a13f490f2de148e300498b0c5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Lb9Q:A3k03kB56rq
TLSH
T16D257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 23d5c7217f70eeebdf309c1776aefca84e3f2d2aa39926b06d949dbe4f5bd0f9
MD5 9830b73d9eb43e263bfd3ecec5eecd95
SHA1 7000070624364c899b7a2265068379e19ce92eb9
SHA512 0fa7807ed033aaf96c56f0c347ac0d6f7d62af4d291faa73a2a3f37ba74663e492b7aec164b0c73aaaebdf7621ad840323bfceaaf52c3fd250b11832da5f5dbf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Lq4:A3k03kB56rp
TLSH
T1F2257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 3d5cd768b1d55f684e928e0535783a978c3766568a98b17fb12e523a18c7a7b1
MD5 14fbd7b783114fd5d41789ac36ecfb46
SHA1 41e461bdd853480465aacc725ece62f818a11bba
SHA512 0d05acd30eef8f11808c8941e599bb730952b05e376c8e9d724d18448fc390c1426d670e89239639bcfb8e98a8e909a3318348a63303e0e25b73d8542587b09e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Lxu:A3k03kB56r0
TLSH
T1F7257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 4826b4a3d591bf8a5244d65e106d441abdbb9e599b2b18088c75b1d243b249ec
MD5 d24ce6597b96a75ad03eca4c20bdcd84
SHA1 74e423dd365db2061cbf1ced6d3eff88dc2f9d10
SHA512 bfc65fc6b924eccf033d0735eac1ae7827761d29db4f04f705ec3000ef44832e92a15ff1a42632846f85dedc84ca8a2c0fcdef65d608a54f0dc2efeec8af7383
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LEj:A3k03kB56rW
TLSH
T13F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 c8306657aa54a020e33ef4137e92afac8364c834c1e0acc1e85ffd1b516abfa3
MD5 6389ab6e14a4ff1e5dddb3bc5c4b4e06
SHA1 00458c0c809df293ea37dc8e186701350ab9c4b7
SHA512 8a812e8cff5dfbf471f30e63f39a0d8f85201b3e98d19ae2149048d3c8b9b0fa7cb9895fcd104405ad1140ce46f1aa1ce3b91df222ec33a27856edb370651a71
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Llg:A3k03kB56r6
TLSH
T142257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 ee9e6a0d9c0bd9625e7972a4d801c30f3768ed5e3191d30e7e8fa1a104343a00
MD5 de21110d810e5ad9a371604012758e51
SHA1 23fcaeb432bc8b46c93bbfbf07d27e77ac3491ff
SHA512 309b2019e7696c042fcc9ea2246b57fdee66bd4b012a001d01783bfab7b91c98eda223bb7b7e95320171a50d3270f13d568ac0e9794201b7449aada28856ed10
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LEI:A3k03kB56r7
TLSH
T190257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 4c62da1d0e075fedcb6c8e997fc0b8810661cc4841882c385fa34dbfad7af3b4
MD5 c782de11dfd376b5f231b774ad024772
SHA1 1994e5271b5e933b51120784c9dfee21e1035f44
SHA512 edd9fb118787d4d945fe497b0750a467fa57c47750f953e11690dbf5ec6b80c253b0257ae645ba929a8978d18f92de03aad2e7aac92d6e8141ebdc9ceb886f5a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/L2o:A3k03kB56rF
TLSH
T164257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 4f270a1ec8391743af85943cc6a731fdad2ce57e328155b23a7897b977778464
MD5 8ebdf005d4437afb34c4bb57c5704f73
SHA1 cdb77dffa444025fb398980e460fa9a14b5f2372
SHA512 757295d45079d3f066eefd28b29c6f6809b98ce27ee8513a578e8d04a39b26e3a258c530f4469dec330acaeb11d18db6d5946ddf4dcddb3bf2958dc8c188439a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Ld+:A3k03kB56rA
TLSH
T133257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 d4dc1894415dcbedbadbbe68dfd7032681bd8b7704b64a84e321c85146037917
MD5 103e382d3e39e5ae08715f66145f48d6
SHA1 1adf7e2f8cc2b561fef7d1ba3baa99f110bf2246
SHA512 01eceee09268c993307baea7e338117550776436b3cf69514ef9100fa453a07f79e491f4c0859cd4f4497527f8d5346e827e134ec1302ef7dcbc792238ea65aa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LLQ:A3k03kB56rQ
TLSH
T1FA257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 c20f4aa9968368039e876770aa5d8e9a09272b5f46829ca11692b9b4151169c5
MD5 d9edae264a7a8a1b4bfac29d3769b591
SHA1 fc81e730faa4b179191c58d4a4d5649739abf593
SHA512 f25c9c7f870fd3823a0f16ba453af1f74c98a4f1ab69fa5b67ff5c5b19c0c96907b9c38cbfdec81bbb102b1b0ea9cf790bf0c4afc26200bdf06a3993f3ba167d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LAX:A3k03kB56rg
TLSH
T127257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 949f4318b25eca87ed011e3969226c336428531d8ee815bc4f09a1a0ca9a6e8e
MD5 dcf7e47475802091377e72683ec62735
SHA1 f35c82dd69ce4110041b2d827238c11821f02a89
SHA512 133979e2312396082fa6489e6f1d79a64962902ff03c38973a47a4792791d88473cdbb8bd237c570e8415309b6e5ed139af334b6a5289e35125e38d48c4f9082
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/L2L:A3k03kB56rC
TLSH
T17E257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 5b3281f3bce400b94f717ed5660e9c5cbb32de9b743d46f6e7414ac9ac113438
MD5 1d02099d1b6f3d77df8104790988a2c9
SHA1 88156b78d49cf72cb1e3bc813419f8ab059a471a
SHA512 ac9e75861e62208f81fc114c7b65aedc67a4aaf682a6f0b1597c51794c7924da4151053ff2262df31526c691a9840ed03f11045346bb28115bde2e0898385e61
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/LKM:A3k03kB56rP
TLSH
T19C257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 2a0c3348af2745da226d90d536ebe4201cb4220471ea16cb7bd13dbe1aa469dc
MD5 1d86edc460f172f93ec3268c602bf5fe
SHA1 49081e17d984f888796339dcfa34cb7419758d59
SHA512 c10e0dc2d2ef57c7764b1fd5dbbfc84b0f88b9a2854cd72211ca604c7fbca1d61a857567f91a160d48d68cda9b0cbea22262ee43e65f45d4219f3f0f95065ef3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsC8/Lbh:A3k03kB56rB
TLSH
T17D257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/708-178-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/708-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1484-252-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads