d68ea77d571d613b42c8afa2679627c48f30ee8790a52d63538b042763b506ef

Analysis

max time kernel
101s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 931KB
Sample260804-fdvchsv1ex
SHA256 d68ea77d571d613b42c8afa2679627c48f30ee8790a52d63538b042763b506ef
MD5 fdb7e51e19a03d92139c7c6b91466695
SHA1 bd99f4e63ea1886fac2dd949a6f9d66739925d8f
SHA512 87863f73e69e52adb9847061a18b062e5a506a1f6c166beef5e4e500def99ae5d7fd2befc58a5f5a3cb3fc69554712a092eefca7fe69e662d634ef5a72b6c4c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviN:A3k03kHRJARJA
TLSH
T101159C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5064-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c511-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5064-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1244-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-692.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-974.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1018.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1105.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c511-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-692.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-736.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-974.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1018.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1105.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1167.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1386.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1244	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5064	2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1244	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_fdb7e51e19a03d92139c7c6b91466695_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5064

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 931KB
SHA256 d68ea77d571d613b42c8afa2679627c48f30ee8790a52d63538b042763b506ef
MD5 fdb7e51e19a03d92139c7c6b91466695
SHA1 bd99f4e63ea1886fac2dd949a6f9d66739925d8f
SHA512 87863f73e69e52adb9847061a18b062e5a506a1f6c166beef5e4e500def99ae5d7fd2befc58a5f5a3cb3fc69554712a092eefca7fe69e662d634ef5a72b6c4c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviN:A3k03kHRJARJA
TLSH
T101159C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 c84d269fbf6b829fdcd725e52a786acf0e7a487ddc7fa166e504040d3e45dee0
MD5 dfced6d3ea7327743623ef804e82dd7c
SHA1 b5c08d1257c607300da5000ddcc733fc6992fa35
SHA512 cb860060a333f0c51c76b9f575ae70d22394c7e2c8479588e34f53899b3d062e685c5fbe2cdf429e62aca9a73b74d4abc4664aa0ad60a58483c57ff4a9247aa1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviZ0Le5ji0hmxNrM:A3k03kHRJARJYPji0Aj
TLSH
T11E657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 946KB
SHA256 f68bc50fe07d7ac57711bd0c893503bb6867cee08252377a8f10317320ff243c
MD5 3bd81971f9e350d703093c32ffd28d1d
SHA1 8c3f5aef1b3f7906169e45993e8e27be2f737adc
SHA512 0ef4ba3b0025672f78c3be2f03886f6b7184bce0d2d07f6a0c43b3c70072f8dc7276ee7fc3a69ba012ff15fcfac4c30ce312c0e3552dad9cf9f01134069fa64c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviLa:A3k03kHRJARJ
TLSH
T1AC259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 955KB
SHA256 68baea51d6884a86b0482e4b92a9057c139911764115eb77c29788063243d93c
MD5 24cd4c8312fd0117add034b0fdfc2098
SHA1 8e574495225ef45d7c7c661b934dc38e15574e5a
SHA512 20fe76f6e786f4b76ca8325e1b858d628a2021f53b6156431e7fd7291c9ced2ca511f931555b1e9c3e6385f0f14681875c2180d29db88ea7c1a085a263822173
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviK6:A3k03kHRJARJG
TLSH
T143259D03F79900E8D15AC1789AA69A22EB757C56173097CF2358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 955KB
SHA256 89b8a2b33d5c5eff4a24de7008d66b2d58815b24ade943e4ef30fe4ceff5fc91
MD5 47319b1b06f3b54dd357d5223c5a5dc0
SHA1 b655eb274027e98b3a0f2b426a0dc46a3eedfe7a
SHA512 92c4d7bee97e998ba53a3a495a9982a55db07cd61ee16982d68df4b0d943505a7e70639fa7f88d50d5355b30894251927c3139c974e24224f7fb92d083ce560d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviiN:A3k03kHRJARJX
TLSH
T195259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 955KB
SHA256 fb1f88fed93763332ac51fd01e93e6e039087df2f1cc46227f3aea93d8fa4dea
MD5 993896dd3cf1eab0582b99e0e0f48976
SHA1 b454be1163a66c14bafeaca23a444e0327ec9311
SHA512 756eb5aca652ba6469e200a2585853dac49fbe5a6bafad923880a962d5bc1ff1cff9e18292be996dc162d04576c89dee4b9793cbe77f645b3f68f9478be19b1f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviYf:A3k03kHRJARJT
TLSH
T1F2259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 955KB
SHA256 9f6fbfd9f79ba7298ac7841c6d6169925c1d1da32fb92b7256b64553fd8410df
MD5 f27ded367953330340570b12d2691eb2
SHA1 ded2adb50ef80bb8cf34f14022eb9166e4d1bc96
SHA512 c23ff731322e971198706280b3505f52d44d195b5ebc497aeda6430d900ac9c17ec722eb9b805b5aa46dff1842d950b5686e13f5228f3439868bac76846a77c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviyo:A3k03kHRJARJC
TLSH
T1BC259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 955KB
SHA256 df8d98183c83823a2644fdb9c98673df79542f378efd4f9e3faf07234dc391aa
MD5 3792451d1513f20ae6f34386f2143ff0
SHA1 b8a5a7f24b3a4c3b6268033d135830fcaa49bc54
SHA512 6eda9e2982169adc5b627a643674461000b3acacd806d51897a6a3d328f4337909d879187447d44d095b6334fdb49c06a5d01d365625b9ce98250d2dcd8592e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavimu:A3k03kHRJARJM
TLSH
T1EA259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 955KB
SHA256 b16ab54834af99c7a31f0d07e55785bc0ff9ae84d9266c0ee9a951016f530846
MD5 5d9562c5f9d96ab0cf69b7e677f48050
SHA1 e9125cd549b3645fe11b2ccb6261d6dcd004f229
SHA512 2794c40c09958e3c48cf4370e5c81052207e5e1adb2552201f498dad0a6dafd87c23349899c4980ac52309d0d0ced1333fb1a922189a82b33d1ce655c3fc8cec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavia9:A3k03kHRJARJR
TLSH
T10F259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 955KB
SHA256 aa07e52a2725b6072f13abdb2d0e0a76b2adfad163a3e5f4b6950672bcc78818
MD5 43a3d63661739163e034236e3b7abd29
SHA1 b420ebeeb4fd23abe5173e7db86f42f434589b97
SHA512 06f1582077451f38cc385951b67e339d5db31eea8d1cc8c5b9f90533ccff2c0b7d6aeea1eb6d14d5693a114d0e47b52743f15ab1c093c6b964346c0cc0e850d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviac:A3k03kHRJARJk
TLSH
T104259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 955KB
SHA256 6b50b6233e431f3c4deb44be637cbc089832fbb5533e0897ec3c17521ed546dd
MD5 f1710b5be2aac2ea81e8333e70da31bd
SHA1 886c887e06f7957958fedf3ec017f5f9be22891c
SHA512 61ca050e416f497a4fa5434dd168d9c608cbc99979145cf14fc27005a5c7762392e0ce88bb1008499a2fb45ba76cc1d650379e531c0f831ff584324a3efaa90b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviTp:A3k03kHRJARJy
TLSH
T118259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 955KB
SHA256 ab216edb6005deefe0847907d7b2c2aa27fe71b27972d0b86179b5535b6aa02a
MD5 5b89245c856253c19b47cabd59a220a9
SHA1 cfa2c3778af56990c8219635de12d56bd5245ec7
SHA512 31897ff211b07dd618c03a900dbad4f84df9d6ddbd787d6ca98d31114c4f3cb87e8f26ec313b89e6da3b0512770c90d6ef0fcc62aeaf65a120560a832c48ce49
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavi0N:A3k03kHRJARJ1
TLSH
T1F1259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 955KB
SHA256 21e3a4e97f7c2d8a7cee8bfcf31b8d02b36a71b3f24668b279a43d70722f7459
MD5 d685dfcd6f59d34d5a605bba261f5368
SHA1 73c00597e84629a3332dec5ef8d71d5424c9b043
SHA512 c0cd899c82d6cb7bacdc1650696ce31d3bd5006b1eb255701bcecda886210c7fc08fbe85113538f44b544f473a418704c22e23a783eb7c88f30ac162993866f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavicF:A3k03kHRJARJ/
TLSH
T1EA259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 955KB
SHA256 3e0e713ed7ac37fef987c9fceaf3586b4c6c7b6a9723035c5d21294ab403a436
MD5 f8fe8cb3320d4642289b326ab2f9a080
SHA1 f458f1960ca1f082bd14852d4f6e7a2942eeb6ed
SHA512 e5837e25c9e36b8e7559933341216cd2bda2a08c68f3a8162c35a3ccb6818d6b9258f1240e32d6ef2e26429160efb5c14aac1a0a10fcaa5fba4c5a356264740d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviJC:A3k03kHRJARJz
TLSH
T16C259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 955KB
SHA256 40e92f0d33b9768842176ba8dd648a6d9c81824ac1f6a1e1281547ad570ab0ad
MD5 8e9174c493ad1151be3e925e699afabf
SHA1 5e30f3496c9967b2dac1a1b12efbcd1cbeef8f0b
SHA512 e046e6a8c2d609be0dd4902138101c39ee223e9be277bf4a13946fad8aa5559fdbf4adaf77ff3ce609f0affe6663345c39faed8d15addc61e2e445e4e50dc11f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviqw:A3k03kHRJARJ2
TLSH
T152259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 955KB
SHA256 a021905d3feccf878c6f7b92f6632f81e95a3c2f4c2817077db3acce835dbb24
MD5 3582ac5c4c8bd2abd19e19d2c72ce72e
SHA1 bead4e85af1740dfb5b79be1d0c3e6ad2fa47f4f
SHA512 3646fc0013b8c8b7151f014a671a742c78be4f8e862eebe658bbec0aeca6f56f3b5417b20dd25d90b402ef4b4fa0ba495bde6b662d25100501c26f2d2eb3870e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavixT:A3k03kHRJARJ2
TLSH
T135259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 955KB
SHA256 f6cb629b47590af531195ad093286ea0faab7c5fde4adf647a841dfbbf69e6b8
MD5 562b7cfa0f70152b59270dfbc44fc3de
SHA1 87047f2e19e84e28886083bc618778df9dacbec4
SHA512 8a0d29a7fce8e8e983f43963e2eff98dbe7970452ad25519658eb88cb4184771ca6601390ae332ed9b16bf30173d44097c75d140a955ce1919a7911660c8e8ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavifu:A3k03kHRJARJR
TLSH
T181259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 955KB
SHA256 d491cbb87de2b29693cb7b646c00af78ff2fbe5217c15c9bd81c612718c0cdef
MD5 98a5d301e5b9f21ea2637dc6f020e612
SHA1 d108cdf8fc0fca189a928851b55be5aea81ad8c2
SHA512 dd733018a085313bc7ae49dea25ca080066baa56202e289a1f4d0db3c6c87fbb845bb474a40be06bb292c338ced261231430aa353aff7f8f6970db9df5e036d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviDb:A3k03kHRJARJw
TLSH
T155259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 955KB
SHA256 acf947fee26f0bafa1467fb7d5a13b73d5e2b051c233f28b1023ce42dc5c2779
MD5 0c8f970e3ccc3029246ab7550f5ffbf4
SHA1 15a14e5a1b50fff731843a2ccd9dd0ded44768b0
SHA512 e4c9ea0c8bd72ba1e5b3d30ae0485e549f3d31cc23b25a646b668add80e15c5c6cac21eb77cf95a1aa2fc757f89a947b2458eff41dc3d05afec617f64b51cae5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviXf:A3k03kHRJARJg
TLSH
T104259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 955KB
SHA256 ca7056a4289ac3a52b6997341eb0001fbff26864cd28089e43505364470f5f2f
MD5 56bdda0903ffbbaf784cb4fba7690f9d
SHA1 27a2a9724edd468ec61b6f81901386a06d600c72
SHA512 f38a1f3812d579c02e9f974090dec24ae3528a431a36cc8e29cb010ef51bc8cb7e8af2dc371371427b8b5d887df7975c960a8dd770012ff65b81c63f787266b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavigK:A3k03kHRJARJA
TLSH
T11D259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 955KB
SHA256 43fd0c07705d56d805d8ad37372872a27fb887f1c3715ee54db8f49f7e709e5b
MD5 e54da1d58df560d1e47b4131673c35c2
SHA1 2e3318d6fb60175ec09b42a4a5984f54931c37f1
SHA512 84477766df8229f1b436d22015da67036610d38d0ed5dbddebca4a6932e664db75e1a858e7310b4c035ce4a6c447e72978ec28577bd2ab9f5ff484d4014e0c21
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavidk:A3k03kHRJARJp
TLSH
T19A259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 955KB
SHA256 b231dcd4757b6823edf9e694491dd09b697bb51ef613cd9a7166b2141535b330
MD5 641aa83553398d930eb4f906cf2dbe2a
SHA1 d119b6700c9e80665c2a599371169b791edf52e3
SHA512 b4bb59c1fbd076898fdd5018a2f31071ed3cb776a6f14e19d7849dca700fb4b0ebf0413a5abd75fef1fab38424e90eef355aa0fc75018b212cec58eddc478fb8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviC0:A3k03kHRJARJc
TLSH
T162259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 955KB
SHA256 b9ceae063b27b77ef4249b555b9d2df75d93fbed0167c139ba3b669fe469af6a
MD5 a1e1f066d85a6c2471fbfd7337b01c30
SHA1 d174a3bb9c89d7dc255021d2163c815cc1310c8f
SHA512 e4904815a93406d6940fe53a90a764e3601aa02428c92590e30a44bc0d791591aa59f1bd5e37a19142f33d88d7caa5540c25ff35a0c379d8ad3edd86f948aae9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviRg:A3k03kHRJARJh
TLSH
T1EC259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 955KB
SHA256 5d2261b210ad32d8754f33c4faf667bbfedd14872ad58bbfce71b24ae957305c
MD5 22cc0fde44624922772df3317cad9d96
SHA1 2f9cea156002dc8f972d47bfed455f095b7d7a02
SHA512 1edb8d6bb2d0e0c1febe53d5215bb339dee9be3e4a57475377026c422cb8fa76760ce88ac18f86e2f0dbd2c4cc6699a6043706a3f180396b9a813f9d4fe96719
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavi4r:A3k03kHRJARJL
TLSH
T11C259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 955KB
SHA256 bb8ebc5059dbf0e5f3acfac1607c30dceb6de0fe56632900bc5a0359b9bf85e0
MD5 3ea16185fd5a28d083ea0cd9c843b7d1
SHA1 f2c305bb3012d1aa9217843acf9647f21b10f8f9
SHA512 7da4b40449a59c7792610a9a0432bb2c06894737e63ceea7f400fdd2691f772062202a2d28178033efab989cd83624fde598c91181ec15b09c6f1a8d8cafd6b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviWn:A3k03kHRJARJ9
TLSH
T1C3259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 955KB
SHA256 ae4fb8b3d5e0139f9ec03cc1398122d78d4392402817f9ab9fac8e251f2db571
MD5 c498b483dd109de24f5eee852e5ac080
SHA1 fd1573a33aea937591f321520cf52813054e699a
SHA512 7fc8d36481bddb5b55c7c751e97b589a941caf6c89a03096cd7cec1fe5dd613a655fe88613289e51f21f2eafc2a6f317a2f817eaf198609e8bd30347ee5cdaa7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavi8x:A3k03kHRJARJD
TLSH
T13B259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 955KB
SHA256 9cbd40de07d7189da80b802be55dcb5c3bbfa6a4685d42082aa6b23d76b8e2ce
MD5 c0b35bab257e6b0e18debe55af802685
SHA1 209249e21e4ebb40983e58e1b1bb72e82062bf25
SHA512 11963784d6d84a9f714c0d2233853ead5554cf23857dbdb2f3a4194e907ba695f287274bfe88509b78d4e2924516e6af8ac8f8d3bff595d9daa22caca7e22a89
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavi2A:A3k03kHRJARJc
TLSH
T174259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 955KB
SHA256 bbaeffce306100d5f7c0078cf5e28011eeb091dc27a0bcc0f2b04f60493dfd47
MD5 da5abd4a7f6f4f03199a4af6f1dad758
SHA1 2ee1db17fa084ce3573a1d75bac4adfa93412135
SHA512 b5107b295b3652db488633245fcc211d80fdf45c2fc826c685e9606e2b3ff6b24b90aacabe7b43407eda3cfade29c551c14f5713ea1ad456d029a35841869936
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviv9Q:A3k03kHRJARJd
TLSH
T1BE259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 955KB
SHA256 06ea58d5e112c912a7b481065dd84254d403d9e5214acf9a3be7dd471dc5f5e0
MD5 fc1f7ec668bcfd288d6cba7803f91622
SHA1 ae2e17c9bc54dd581fb1741fa469e9ab7280e64d
SHA512 5094f605061a378ffb5acbe0086c984990e0d408d0c5104f310ab4ca2e53e7dc2eb79cb09e88fc66b10445e60719c8c823382b78135f625a3f72ece7d0d6dee0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviG4:A3k03kHRJARJC
TLSH
T1DA259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 955KB
SHA256 5bdcfaf744e749d8358e49cf67161241d2a2ce5e6fb3f2104a2874a206c7f028
MD5 b009d6e9d19553d0846f527264c45407
SHA1 362505403c2d41aaec223b7a666054058cada8d6
SHA512 4ae3c1350cf4e463421abcdb0f93448a91d06b1c6c63beaec4ebba8682a6fc58909c6d031806863a14bc706ddab5953c780b709d014402746938fc1b250e83d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviVu:A3k03kHRJARJz
TLSH
T18B259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 955KB
SHA256 4fd99bfe0f823a870c9d008401db390bd19fe34e3290ab0586c83d5b43fb8dd8
MD5 d4cb7eb956c47501019b2a83164ce367
SHA1 e05d47d97beddb01613d3eff2f34d03406d694e5
SHA512 156702f2192d8f5e01d752995b805d083a2006b8f745c9414b38e8ef9f34d52f0df48ba87b1d26e27b13391e38e9e6fb033c25dfedd172d17565d43854badff6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviIj:A3k03kHRJARJ9
TLSH
T1D5259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 955KB
SHA256 e0b09a8572e0c3354b155a1943b78707aa7e6663d93721de86f65e14b37e4981
MD5 02cd99fece7d6e7d036c7d2e84367d95
SHA1 73baff9a8d44cf1e7b03a6bdc225e077171ea23e
SHA512 da018f4005e7f1fa68981ecf1b7cc3a67ff71b88184b188a32289122e1f9e01efff442b5a4687e940f28c1a354ce3f84b03ddf8f008b9ce5942f974017ee7f3e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavi5g:A3k03kHRJARJB
TLSH
T147259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 955KB
SHA256 165ab928e1383357a7f032963a12e736949814a4b764a636f42a484142127c76
MD5 95ba107eaa973a811f996748e2da8d09
SHA1 d9bd0be4c5cf00a7e19f55cbab6c65af7cd7f38e
SHA512 4f2c0e94d7e1201f365044c8b0710a4b8ff212bf3cdc6b49e9a6efe96079739d2ad350c1eafe91a32d081c8859648bf617b87e4fe17158f168023cf4a5dfca9f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavigI:A3k03kHRJARJQ
TLSH
T11C259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 955KB
SHA256 e5afde828d23dfa53ff5ae5e69dc14b91c708a8af3c6981c16f2445568b73c2d
MD5 919f1556f3713ae8c9b1c17350eae434
SHA1 499ebae78fdfcf2b0a482a4f1efeddd87e94185c
SHA512 6cf3fd19f137d4b5e8033dc5eca04b1c36bf72bfeab4476448a1418400903b0b37483d73253be2445721c145fc5118de0982490e4b0aeae195a823cac9457d46
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviio:A3k03kHRJARJy
TLSH
T18A259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 955KB
SHA256 6a9062d513cff03d625bb2b4af4f55367490f66d6f99ce4ac3169f429290d67b
MD5 c3810dcae14c713e39e8ba69089b272e
SHA1 6c468dddeb594a5c56d94f2a9f0ea7490281f8d3
SHA512 8b0d747ad13c87d48ef102bd25a89d5e76af6c71d1fc4b5cd129016a68f6ca3c5aae21c7e05cb8d20dff0be5b8e141fd2660136c61e4e25c2eb94ea59b3e49a9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviZ+:A3k03kHRJARJ3
TLSH
T189259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 955KB
SHA256 f15a1366fd8a6d6402856c93d0ddabae658e3a9fced07910cd8b1449bb496262
MD5 faf0fcd4fb3b4d59b22400e95a5be66d
SHA1 c67b9b71d4411731cedf9bdfb711567feb452ff8
SHA512 3cd1f68b30369e43c302ca2523b784c1f3ae668060f5ece45044208fe11f644aefe181c596fad800a3c1a2869111f670b4b94129debe56e630b7757010188689
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviHQ:A3k03kHRJARJj
TLSH
T1BB259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 955KB
SHA256 db3b782e007e2efe6c8b19ac27792cba1f4bf35a48e4c983d8ddefbd7baf502d
MD5 5c2eddff2173ebe30cdc74f5b5556d15
SHA1 5c3ee839d181214d3c78ecaa67f249feed4b9a5e
SHA512 c711baa856296525609dd18ad64c34300716482162f655459f69a145df53d70d4160eb9c00bf891578424085344f1b5178040c560398e9df50922a3cde579dda
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavicX:A3k03kHRJARJ3
TLSH
T1DE259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 955KB
SHA256 ef02968cd9cae4df95d9687ebbe7cf1f3f0bcf7ab8b4ce21b0c9324c5f6dc9ef
MD5 93a252e27f8e8db4338f9a4edd0dffa1
SHA1 28b0dd9a0ee80ed8350445a9d735c01fcc8437c3
SHA512 baf3bfe66b150be643e55c0ccf23543ae075f691337132832ba696603edc9b31b00ae18d0df8ecf89b59b8ca4e9aa97d5db5022b0fd31cce718cc874a4ee04a9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaaviaL:A3k03kHRJARJZ
TLSH
T14C259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 955KB
SHA256 c2aac4cc10cdf7e4dcf9b9d5ec75847324f800e36315597125b97e62a43f5ad8
MD5 3f7aa2b34063f197b8953696083b50e1
SHA1 4c0d281a0c6470c43bf48525243074bc59b36bb8
SHA512 93e726cd5825d58ab452d982136d18cd6ac395b5b6a0f800da491413f9768a42e81b6f858d5017a49baaec35f27d4d0bc67b51a91998a7bb613e7b95da8303b3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavi+M:A3k03kHRJARJg
TLSH
T11C259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 955KB
SHA256 890dd152b9d83aef3ebcccd632c58aac42545dfc96ac29195d4b6a025edff288
MD5 3b84452734f27b2f586220ae3f625b4c
SHA1 34cd015a8cc79926191bb907fe6b8dabe5236472
SHA512 fd7bb23ef59847b34c74040ad586c5609cd789d6a079676367700eb642a326e6220e3e896d341eb9ea2b2ef652a9c7aa6cd84cc64a7cc5dee6eb150579487f8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavinh:A3k03kHRJARJS
TLSH
T1E5259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5064-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5064-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads