041da9da4211595fdaa3c2d116e21d04ee56cea0f7d91d8dd8572dc63d215813

Analysis

max time kernel
103s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 921KB
Sample260802-bcajha1set
SHA256 041da9da4211595fdaa3c2d116e21d04ee56cea0f7d91d8dd8572dc63d215813
MD5 397c68bd9b0317e872d0279ead7722d2
SHA1 d5ebb52f1d0dbc57966c112d552f5b2897c11a1c
SHA512 22093665ce5b7d50bf443dd8da7e465002a9e08e6038a12746845a7213dfa700132a7314cced3ffb1a07c8e1988300b5022855819b7983d650634d83d4b17c57
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpr:A3k03kHRJL
TLSH
T12415AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/6472-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000a00000001c81f-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2856-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6472-33-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c72-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-559.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-614.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-639.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-730.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-761.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-841.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1000.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1131.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000a00000001c81f-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c72-60.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-223.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-443.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-492.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-559.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-614.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-639.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-730.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-761.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-841.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-868.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1000.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1080.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1131.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1150.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1219.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2856	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{CDB16BBD-CB19-4D7F-84F7-16B278A1D844}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6472	2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2856	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6472

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 921KB
SHA256 041da9da4211595fdaa3c2d116e21d04ee56cea0f7d91d8dd8572dc63d215813
MD5 397c68bd9b0317e872d0279ead7722d2
SHA1 d5ebb52f1d0dbc57966c112d552f5b2897c11a1c
SHA512 22093665ce5b7d50bf443dd8da7e465002a9e08e6038a12746845a7213dfa700132a7314cced3ffb1a07c8e1988300b5022855819b7983d650634d83d4b17c57
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpr:A3k03kHRJL
TLSH
T12415AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 f1b7d95c6af9b80065a88f26b037bf5ee01512020dcf3421d38199f2b6dba307
MD5 59a4e6671dc8094282fbf1bc3ad69bfa
SHA1 8db732af073d11369e4a8803c03d3b197a524ffc
SHA512 98b143641b71e874082b8de830af04457c3b3c5892122294a4de7ce882fa3f3b6754f16d5e7303d737ded460c13b466727b3215e4ac1501063999c3d282b112e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpf0Le5ji0hmxNrM:A3k03kHRJ/Pji0Aj
TLSH
T177658D17F6A402B5D067C1B8C5D2AA5AFA723842173096CF1358C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 936KB
SHA256 59ed9737a12b662d7efc2e6101819ccb421a80c0d472a67f5dd4ff1bf05d5313
MD5 077859be4f5b143d7dd3eb8fdd36e870
SHA1 a81ebae7791b46c7b8e82bcb2cc41aed234e8a0f
SHA512 0cd58b9ad801a41ee0e3f21bcb90c8ae0dcbc7696b2abe8fccef63350e8420b7bf64c7762d04223d48bbb89c18135359ba9db397f797b4020cccd492e7eeb8f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpBa:A3k03kHRJ
TLSH
T1B115AE03EB9400E9D10AC1749AE69A23FB75BC52176097DF1368D6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 969KB
SHA256 4780ce8622a155fb78e6811dfbff5d485ba10b68623c5f84d53f0245d3a07177
MD5 b0271ac69c6c85a30fcb4206762fbef1
SHA1 e12bf9eca876b4945110e328b7530cdd9c1696f8
SHA512 2fd92c470e65d5d81abf1cccc3ed1227596aa523cecfe9943eb77828465079e3211011a404814a64498e5e676ee711f8c01353a7a18e550201f65844fc030764
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpCb:A3k03kHRJib
TLSH
T1D425AD03E79400E9E11AC1749AE59A23FB75BC52172097DF2368D6152F73BC0AF3A3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 945KB
SHA256 378979c96b16cf4c5c161fe1ea6b62aceab96f1b3a82a2140e3ab1f3a5f540db
MD5 18c81f86ae70bab85cebc8a422e4ca62
SHA1 f14b5e640183948d75e2155ec7cda092c74b4d8c
SHA512 9c4847a8c03d749aa79e8259cb16ee46409c5a1b6fab52c946e683f5e1e091ecd46867744eccb63b4c30136b2bf3aee9b01fcb5e4cdf09964472288b52c5d36f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp46:A3k03kHRJH
TLSH
T14F25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 945KB
SHA256 de263997cf7e9ae533d88e9e655917bb757bbe863c88d9fe55dd10289ec90385
MD5 eaca1b0fbf8e760cd287acbcc7ded495
SHA1 5b868315c2981f9ee23f0cfdd8ec98a5823a7a48
SHA512 b68b52e9265f74c2953ae4e935f5faec4f10bb49cc603c3688cd1265b39d937654ec8fd693538168fd88a900de85d662032a86b6b93064ee4cc54ee633a634b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpSf:A3k03kHRJW
TLSH
T1EE25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 945KB
SHA256 2c80b0975cf2e08a04269e98a33924deae8fb521c18d6aa73abd34f5a0cb38df
MD5 1a21a028383826b1f0074530f3ffabd0
SHA1 95d77f9864b20557aef20a7de98b0f605eeeaea6
SHA512 176ed19af7f42d0d380d275b4b24970a0afd39bb2b0925f2ee6c17df1167edc0f0c0b6299052c8b7994f0a2663b1e298b9630b4334c3d72f064a25b79adf47f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpso:A3k03kHRJ3
TLSH
T1FF25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 945KB
SHA256 e2d6763cf87972c12fac3e5d173a6644ad7b76d9ee579cbb78b1844857b1c03b
MD5 8003c6b5f4d3ff428e30c663b3a547da
SHA1 3d9298fea282b0ee6c8ce54f332ff3334ce06eab
SHA512 3fe85b60210bea36cc13f23addf731f6e601d311cf45dc84209bdd3e2ad18d999205063d402ea406542794dc7f66fe61ad98bcc5220e33d8fe5d4d13dc7727a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpMu:A3k03kHRJ5
TLSH
T15C25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 945KB
SHA256 ef26a4728e3074ad183efc1c267ac4221aa68c705bf26453fa5aef0617b1a76e
MD5 1cc6e6e2a69694b0ac33f3193a3b533e
SHA1 5a79d96af9fda63cea34f50a7f0f1c493318c292
SHA512 a4e0e835d32b0eb4ce00127e5a29e702a60bf5d013c84b94e1cfc7269c80481d00588e4d5fc0415811d4ec05d17b67a382711968354a8acd2e65f19f687cce60
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpQ9:A3k03kHRJ0
TLSH
T14125AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 945KB
SHA256 865666bdafde6625a125476afad8042b2942c6afc18c7c57754c2d93d93e3ec7
MD5 f30667173f95473457dee38e6b920647
SHA1 d4139fd5952d1461b482a1ff5f2c8b186fe48c1c
SHA512 ecb9363a13b74ce81cb03612ac1f2845d4ebe4884c4707d14e70ccb677dd385b2303192d173184828605e081f244991afa02f1fe7d3059612c0c5abbd4ea2308
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpYc:A3k03kHRJd
TLSH
T1CA25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 945KB
SHA256 acea8d76c1da6f5b9f3587e97fb6d83a4ebb6ac03f2485934d47396efc331588
MD5 1d35ff727d45e2fba3a57d65e767afb1
SHA1 20e074a672aaaaae4fa8cac8ee7e9a6e64f1e1f8
SHA512 5b4bcfa455a24f4b2d76eec0c5d0f4a2bd27ed1fc443e81e5724e04e1b771207916392d7953a2a52855b18a637cea135c581eff160068d47464ae7bb6cda1154
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpxp:A3k03kHRJD
TLSH
T11D25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 945KB
SHA256 77d790a2e73ed2f10e7e949a61c2a7242cff65a72005f1a647ef7e9b1e33df99
MD5 ced70815931465900c5e8df14ce1bca4
SHA1 4db16fbf1ac14738f16b4b84c0ece727a6b391c5
SHA512 e3c03c633010213ddde4a5d8747a3b36ec0cb6ad38808e4d63d49e6f0f35432265ab6279c801ea3e7a2a1b1f347509ad97df306744bf8c8bbd26902ec1f2b942
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpGN:A3k03kHRJ4
TLSH
T19C25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 945KB
SHA256 dcee659e3e2e55221bbb088bf73a0399d6633a7de92293a95a06ee1f7d257fbe
MD5 6fab3c8417c5bfdde11956023b8cfec0
SHA1 71ee3b21028ead8cc2a10d0b76905aaf00cc7f06
SHA512 6b8ac7b7707ab6b30afb8e98ad89c9b57c39b7f3bab67eb7605e4ee19442d4e06cab7a9f746502bbfaa16ccfe17489ccdf7e765f9c8b02c9c950d2a23e23b918
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpKF:A3k03kHRJO
TLSH
T11725AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 945KB
SHA256 77cbb93364b663f0862ed258fdd0f9e2c09b428610424133a301ad508336672a
MD5 bf65f01b503b553e2f6737ec5f108911
SHA1 84bd6884541020cf78e809fecc367373e1d7b4cf
SHA512 3ae4e828c790a40c326eebda415641dd30c3c562b1bdf5fdbcb8849e493ffd2558b0e0cdda2120bf4f264a396b59cfa7660aa5ae80f9dca55c08fe5df5c6b787
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpfC:A3k03kHRJq
TLSH
T15B25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 945KB
SHA256 377b5e8fd02f609892097afe3d0dc8365de7380ece40afd6f10c53f86d33b181
MD5 15e89f3b68b525d1254fdd0c4467a6ff
SHA1 821e67ca32b457189bd46461b687437851d42494
SHA512 3a98ea1a806659a1cd23c51c903f6c19802805f3d7bce763f0890fb4d995ca6e67d2e9d6b437653c559932bf6e6f57db99e2caba0ac175de7c1945355106054a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpgw:A3k03kHRJ/
TLSH
T18A25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 945KB
SHA256 2751b032a7e3a7cceb33ad7c7a3fa67580880b5703dca2f0702d205fea0bf64e
MD5 835f35ef1cc1321e70b5e0eecb1b249c
SHA1 dc537c64efd5f40c31a420570f47aa43bde286d9
SHA512 b70b523e1173639b189e4d1aa2a6669721b2a34895e15ef552a211fb426c2a54a8d029ab87b895cca21670552c6a70c4fb6a49f42f8bf412ba3a1bd990e64083
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp/T:A3k03kHRJb
TLSH
T1B925AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 945KB
SHA256 11aba57125b0d972aa05dc59b1d7e30dcbf3d6c55ebcf2e4f42de60e15d1a887
MD5 ea80a0a5a48753c9571e0c7cf2464899
SHA1 4c60e0c72a8f121f580ed72ba81a09f54456ee73
SHA512 2a9d4457f4ea755dd96c80100152846d414232ebdd3e38820c554aca561b6671a8f6244ef3fea99bee0e3c8ce148aeaabba6cab4c21634f57ac0cd9ed99264ec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp5u:A3k03kHRJc
TLSH
T1BD25AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 945KB
SHA256 4d61d37b05bd8d4f23543298cca5eef05a1371931cd76c86977142aeecbc8165
MD5 fa1cb5f278fe478e97008929002a1dc9
SHA1 f5700fa7d27df1125f05be7846b197d04fd5dfc1
SHA512 a765289ba569a26e25094fcbf9b40766629924d95c85251dd43c75b5f1db29442adf45a975ecfef238ea51bc9ff6b7c6016b748c9ae7b0d241b838f52614f24f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpxb:A3k03kHRJ1
TLSH
T11625AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 945KB
SHA256 eb25ef46ce020a4abcce97a103e8da77a6907920c16c07610d1a0292c8df63d6
MD5 7b1befe3ef660569d4c50cb8d511c778
SHA1 20af7e422473d473d3c503d3c063971f7aa5be54
SHA512 0635e7ad18b8674ae98c4334654e7c527646aadbc444087a16699a2b10575f8755ca5ddd6029c5fb94e54eb3854f39cdbfbd3ed0b0ac73491f84f2d3e577b744
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp5f:A3k03kHRJ1
TLSH
T17125AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 945KB
SHA256 095cd9c4fc768f070631cfba53316914a391dcbf1e4321d06198a3817a953d5e
MD5 f9f05a1a7c597c7f3a826758861753d5
SHA1 bae0e63e35a93abf352012b6b75fdf2585df7be3
SHA512 8f308d395e45ddab953c8e0002cd159cfc3301265476643466df4816e3464172da6b4a37a20552f0cd638b6515e0bf7b18ca5e6c2b4af4cd05b8130c931de44c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpCK:A3k03kHRJt
TLSH
T12425AF03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 945KB
SHA256 e4e0e267901865f450a7ee0bc81dc2020b20730bf9dbd433c59ebcfd5cd55455
MD5 ec8097611d4565e468e6603b4a1eb7ad
SHA1 abbd6689231c8d84a16aaba3e9225260d83512f5
SHA512 9bbb1d636cc8439e9df55ee806ff22205c10dcb8883dd31f3d9b8959a5f008d4b8ff5572ebdc75a605feeeb8b32b7db02ec6dc3dbd944b06cda2c4e81b0df17a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpnk:A3k03kHRJE
TLSH
T18625AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 945KB
SHA256 6de792dea71a8d7aa9dfa8da1d477bfc1b1381b740d2cbc5bb53a9b2c5be5ea4
MD5 07f028403c9fe5cc491b4b3228a7ffc5
SHA1 47dd71e11c61f630de53154c7143536334084778
SHA512 0e661029079b2e3ebba002d09ae6db10c422c574164f86408be4ca9027d5be0ba30d1c62da972564439e811af931f6ef702d70c74899f656eb724b571781b8eb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpQ0:A3k03kHRJt
TLSH
T1E325AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 945KB
SHA256 02a44367382f83ec6a185b51ca0e80204f60ddca1ba017ccaefdedba8e463887
MD5 dc66238ead85b903461bff95048a0b1c
SHA1 abaf442d7e82944d493cf5e58b3416f658e17795
SHA512 b6a7decdf10638fa649be88e8854a018a96ca2a565ec591fb28137aaace10169e62ff80b84918d90d2b16923e4d0b57cccc606618d2569d4e8790cf0fe3e644e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjprg:A3k03kHRJc
TLSH
T15B25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 945KB
SHA256 a9768097908da14a76e909aaf2f88e7f0b36f7c9d37af1498a31c5e3e3fcfecf
MD5 437ab44c12b12cd62f246b1f2c166bee
SHA1 3f14e6c2a75c2667644273dc77f1324e78349200
SHA512 4c98154277920d0495859474846f36a3cc8e8d3116b19228d7f09d81ac8df0556f1810e2561210b88dab609ca2be599eae2cccb835b4cec909e3a0696af858f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpmr:A3k03kHRJu
TLSH
T19725AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 945KB
SHA256 bde1136d92232319e5fcc2e7569cc28a6044e99f988d884295066fe27b5944dc
MD5 bde1c41dcc3d8401b0bd56d1ac7efe4e
SHA1 038a341676b4c0c8616d75f972f31881e6852628
SHA512 d5a08dd8509d3816e7f2098ec3c18c73609b0413dc65f5e7eba788bc64c12b419ac9e5fbf8613556b1764149bf5a418535ce9133e6805d91a55c975846d291eb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpMn:A3k03kHRJY
TLSH
T12E25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 945KB
SHA256 9b66e01fd0b94ef73dfa3b9f8762577d72bb2dc762f77b1ba5d22c9cd790f164
MD5 690f3a19a879f995ec11e0b79a4209b2
SHA1 0417f370310686a8aced08b231a422d079110de9
SHA512 fdfdc8802f37e2273aac05c71e6000b8980ad752aa18842b88b11d6e28fe7e41e4361fc9389806cbfa1b36af63de8965bfb6d713bf3a69d28b1eba3534182df9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpqx:A3k03kHRJO
TLSH
T1A025AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 945KB
SHA256 b98105873fd483af2c9ae181ef68ec9e21d162564f11aebd64f22c149caa5618
MD5 982fb1352f14704b6b56baa54a13a53b
SHA1 b99e796fcff509a6459fe15d5b01b4f31e692467
SHA512 0ef80fca5718e233e1c7556c2fe267dbbac5bdcaa77d8e88d30a267c81be9f12eaf93833ea892923854f8e41c19537e8abc11e0257f98109111001bc09d3f70b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpsA:A3k03kHRJF
TLSH
T13F25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 945KB
SHA256 8c15476a2be09d1462f34209efe6ac5f1a2f9eca94b5f4303a9b22d29caf3e68
MD5 7dce8ce8c10474c89d48b59b6fb2d54c
SHA1 5be7bd843228ce3a6311f546d93469e04893a579
SHA512 ca42ce4395ce1b44ade566d86a2c8edfc38deec5bf4bf70a8dd75182f0e487328d786e3c7547412723d74d6601fa9bde8c031cfd2feb73c1c9a4335a35da2109
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp19Q:A3k03kHRJk
TLSH
T1B325AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 945KB
SHA256 755665e705256bd664f1d41552e20f77931b569b966df4464ced9e4e63345d8b
MD5 0b0e6e6b8558c6b54fb64d978194c3cc
SHA1 01823dbbe0375b0627b2abfaf4052df9cb21b83c
SHA512 641676d4f4e07da8a101389916f0e471215c522f2bb7f035f133ecacc54440e179355f902433cd06fa8ff3b8e2b9b9b0b7e74679327f52d617c4e84aa048c54c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpA4:A3k03kHRJP
TLSH
T1EA25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 945KB
SHA256 0c7f1edaf6b2d5106216cb0c7ca1706ab9413a9922a1df383a093e67a19e938b
MD5 cff46ace4157ea32a522b30704c1d877
SHA1 8204590d7b7a2cc9610e1ae91d6034d65fc5cf96
SHA512 2b4d2e5ae8c3ec398ca4ea2745a7e3688e7c2b111ad976b1550702b74b92d128e795853940ed99944c3469f985d487e94567c25a9f5dced972ee2a91b7bf6ab8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpju:A3k03kHRJC
TLSH
T17D25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 945KB
SHA256 d1cd09b3e1366e4c337d2f4e5feeb2b0a28c0f60ab320ec49d7efa68b625bd5a
MD5 c0b8bba95119fc9f22f177f782c306f1
SHA1 e0fab409e17ef117be4288abd97c267789fec987
SHA512 73e737522fe0327e39ca1888194337d15f24d477ab43438dca059ad4c14e39be2016ac0a96cbad1b0dbe584dfe1eda5fff8a203e62235270a30da80217e097d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp+j:A3k03kHRJc
TLSH
T1EF25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 945KB
SHA256 129b410a19aaf9b42d5f8ff0d3b8525b405d78fa66b9e76ca9616fd686c992a8
MD5 ad68b22b07ff1ddc7f2bf3dd24471135
SHA1 b97606a944937de9d8a8f4759de7e4972d013119
SHA512 358227ef8361cf3f313313ca471fb220eac8552bb5d09d8bb7356a723d6a37abac45f5fb47aabd1f3d00550338ac7f8914113fe740406791ae477ee7146169a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpLg:A3k03kHRJU
TLSH
T13125AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 945KB
SHA256 632b048b918191e367b178cae859d13714fcbcf27475d3bd5eb752a57c084a06
MD5 cd546df79c54750c6cf437c62366b6b2
SHA1 0914af40c8033a436808dc5b4dc53486e1bad87a
SHA512 4304dd4a8d0cba59b0d578c3366c8908e5edc8d4197fcc2ee716ff96cef45efd371deadafd1a119cd87cb7d1c9826335b245a25b8a2547b4a426630ecdc7abcd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpWI:A3k03kHRJd
TLSH
T16925AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 945KB
SHA256 5edfe31c9ca55d73f13eac44c7fdb24b9f329b5be45fcbcf5cff618dd53b9ed6
MD5 41d2b92c1217a22f0ed418cb23a29d3e
SHA1 e3fae1721657ff5e7f26e646fa2290aa8ffadd28
SHA512 9ba6dca60fdc020932764b976b2c9c475fa4e5d2e7e018f2e4247d7262763bee11efd502138ffe1aa5a035a5fd49f33b477e2faa0670222ca4a91c33ade10445
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpEo:A3k03kHRJ7
TLSH
T11525AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 945KB
SHA256 964b0983c567b43b9397974be26cdb584d26da8126f43fa221d43c1b642b530c
MD5 0b8128be9623300878508244fae99eda
SHA1 cbd9d5366904b17397fcda4b06d858bd2bb51b15
SHA512 dc4954b40192a614563093ac4e1acafc9ba53d3d119160fd9962723e3e9573fd5247eb21099f836a0cb3d7e3cb980e656896619c595ed4f2a9f029b1ce58c397
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpn+:A3k03kHRJe
TLSH
T18525AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 945KB
SHA256 63be84c2c29daf5a7ec5d3796362e0d10b23b5df71d77c0a131e47015c67bc47
MD5 e245fff730b9013e5b0e8515816be608
SHA1 b16b91de4d2325216066f1194253f0347f3d041d
SHA512 cd0c8c2c732317a225f4095faa5d903d8a742c9b7797ae85a8948466fa011ec036a9685f8dd3a93fe423e615134c550d422c37e715d5d656d74e7c2c545ac876
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp9Q:A3k03kHRJK
TLSH
T1C025AE03E79400E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 945KB
SHA256 eb96b273262dcd976fb19eda1fb2c9d742a8215a1fce0094c097cc02c3d17b0d
MD5 6df6244c5c52c39104d4e52d27321b98
SHA1 e02b3bc5aa433758d607fef9df99e6a07ad5ef36
SHA512 7f66ddfd88e309bab7030e7b985111a98a74800932da59f8d1746a9ef3c40e56d7f4ce5c90398a44b1e75ff856cf420fb6b0c1310088862e3983846e642a0dc7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpyX:A3k03kHRJa
TLSH
T16925AF03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 945KB
SHA256 892cba8390382890ccfe77571b100b1d708c4860829448f90be838a000a77c0f
MD5 632e6f8af3ae4c2fbf97b01cd9ec6e12
SHA1 603fd4dc97d2228f8cf980b5143eaf017248e99b
SHA512 c1c7307f9d79074c53e685a648ae0a8d9608defdf7d318c627f93b11b05392220a59e530491f519865ad60a3d567ce4f58095108d44c71ffe382e5cdf6d9da8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp0L:A3k03kHRJ0
TLSH
T1A425AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 945KB
SHA256 960231aa4c3ee5288b30a20be54ad2d64312d760136915c08ef153219da1ee2d
MD5 8aec3975b470008eebcb10a7a7c07ae3
SHA1 27ed5e0ad53dd60c1a9fee50db6145956d946fee
SHA512 a5567434ac77cd88c8ccb5e8381a15c1133bcc951e13e1bec6dd566d01b117d600911d16ea6731752c24f2429b6587a118fee355a1e1a1a5f82fe6f9a7678a00
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpQM:A3k03kHRJV
TLSH
T17B25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 945KB
SHA256 cf58fa36c86ef8e43cd4c8b80ac0298d2e3f9337f649efe8092a339a0f311e04
MD5 a40ace8de4244ffc5d0490c8f791c0ac
SHA1 21d0f82061171217599c2dc8cb41a0626606144d
SHA512 288142a962edcfbd7d985fdc75af6eaf69fb614b11886aa422b482a18da763beb07223c93cc319c8874b910d4621c8219f4f92747826bf649503351e2b0c25ff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpRh:A3k03kHRJv
TLSH
T11625AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2856-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6472-33-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6472-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads