2bfa235eb61cdcc66662324f0426f95ff4a5b6f85cc16bdd4c6aa4cbb08f6e0b

Analysis

max time kernel
97s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 862KB
Sample260809-rdykqagj7y
SHA256 2bfa235eb61cdcc66662324f0426f95ff4a5b6f85cc16bdd4c6aa4cbb08f6e0b
MD5 8bc503dc906e84f5aed9d2cade5cb002
SHA1 ff68452aeffd3255fd0b4f9b9399527722d23e4f
SHA512 886cab9d5757254d531064ba24005cf3ef73d13265506a18dce11f37fb6c7b51e720256f975252f34c3685c13146e2ce87cf639472a61e73404e0cd4f338be8d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviN:A3k03kHRJd
TLSH
T16A15AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4536-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5e3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4536-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1896-209-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-416.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-483.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-715.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5e3-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-416.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-483.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-715.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1047.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1078.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1129.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1217.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1320.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1339.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1364.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1896	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4536	2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1896	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_8bc503dc906e84f5aed9d2cade5cb002_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4536

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 862KB
SHA256 2bfa235eb61cdcc66662324f0426f95ff4a5b6f85cc16bdd4c6aa4cbb08f6e0b
MD5 8bc503dc906e84f5aed9d2cade5cb002
SHA1 ff68452aeffd3255fd0b4f9b9399527722d23e4f
SHA512 886cab9d5757254d531064ba24005cf3ef73d13265506a18dce11f37fb6c7b51e720256f975252f34c3685c13146e2ce87cf639472a61e73404e0cd4f338be8d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviN:A3k03kHRJd
TLSH
T16A15AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 b1320e2e70b1b83c4675a46b43c2d23115a4f777e6d019f773b1f06dcd69290f
MD5 9c4801bcb92ec0d5debfa162208c47d4
SHA1 d4289db9e2e8ca5778767c8b933706b84addfb1d
SHA512 37980294139d0a7bae2f40e22242ec2c2e4179c5197701f7b20ff603ccb7bc8b35cc88e97847dbc06041cf7ce7f6e7b093856b92ef40600699222198d5268e53
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviZ0Le5ji0hmxNrM:A3k03kHRJpPji0Aj
TLSH
T190657C17F6A402B5D027C0B9C5D6966AFA7138821B3086CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 877KB
SHA256 91c075b7b1dccb904c91f07033a1e48f968239149b84ba88e49ba17491aacafa
MD5 41329997f35c688108154cdbae1a5a98
SHA1 f51a0ce0e809c6d1f47f81e9ad60b5fb052916b1
SHA512 5eb24eeba13498ec3b6f57245272e689114a45261d8902c7d4da9e979abb0cbbe1bb342a5ea71439c91f2601256261d2f52c3f4cdd87941c924f08840c46297a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviLa:A3k03kHRJ
TLSH
T10015AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 886KB
SHA256 dfa2d72e806efbb0aa08cc827e1e4feb69dfe2879d57d1232f7bbfea9154b2c4
MD5 c8966afbd87bb666e086622a54178da9
SHA1 ca73881809e90e8c1e3d7f33249901847ac31cd2
SHA512 2850fed466884911e27d5a50fbc0078d7657bb4599d92674b7d330c7aeaed4fdd515768a90c26b5f5f826bb8157ad2de3b53b0555f56a92647dbbcca85e83c5d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviK6:A3k03kHRJ1
TLSH
T11315AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 886KB
SHA256 9a11900a1f450c292a26d9ae2cfab3b76e45a40e14db35ed7b0780fa8f55c59c
MD5 08caa309fadf3281d3b6b711e143c6cd
SHA1 52b6ed812af25ecf2f986da901e240f1e408c545
SHA512 c2177b4d41b7e1d779a03f9aa31b609c1e8364b1a368c8ccb69cddcb797727f11a6e7a58a4065a5e90ba3399d8d2cb90dd090f20f4fd2114716adde99b34cc2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviiN:A3k03kHRJE
TLSH
T16A15AE13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 886KB
SHA256 a0881a9c92c5ebeb8ed90aa4179d67774e436bed069facdbf5b8b66690404916
MD5 8edd14c2ee7e18bb19a7bfc110da666a
SHA1 d168e2ae6153904da976691693b228efe7732d3f
SHA512 4beff75ead86536396f7f7eb0e1f75ca095fecaf7f73f6791d45ffc9ededb6d414c6fdc88d2f14d6f216545b8c5e20ea21760b2e685621d2166ccfa36a318016
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviYf:A3k03kHRJE
TLSH
T1DA15AE13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 886KB
SHA256 bf7ff0f3659647d9cbd69c771e4540f989165243fc55324420474194d35c100d
MD5 8f417cf57bcabb1b1da3e5a05d834ef6
SHA1 1a482e29263d20c37fa8570ed2880721b1892fdf
SHA512 009bf8460f8c48f4aff2a599eab249c3736514c53b6394485bf0037032dcf7529cc5b4d86733d891b9639002875ef79855d10396520ba394c1cc277bcc42158a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviyo:A3k03kHRJZ
TLSH
T17415AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 886KB
SHA256 1d29ef8244cfe9d14ab9f0d6661597afe5f2b246f46064166957a27c2089f6ea
MD5 c4393bdda7dc56b131abe6d0e7cea29f
SHA1 6379d629be8c53c5446eab4b68897d179bb1fba1
SHA512 aba05e3c2a754a16b6347b590efe60f1345fc97de0ae3745599acda91ddb6b96e8c8cb2421c11ccfa8fe2c42ee332251c493b55e1acd345f7ff050f37d338cee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvimu:A3k03kHRJb
TLSH
T15D15AE13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 886KB
SHA256 8b6b6b0c3b21f4e1ecbb28775620b0e5cbd487f7b46858269678686d45230fc5
MD5 c41243530d3ce6562b77cdfd29374142
SHA1 374c548f7237e3e9b227082eec6270e6f8e0805e
SHA512 d723c87e7a40f90315104a3a1e954337c8ad187f5f160c8cb03dc943e62ee5da0438b6c10d2403eed87bf8b3d6b61bf4c079fa9012b31593e83cf3669f0b4aed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvia9:A3k03kHRJa
TLSH
T13015AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 886KB
SHA256 6a27faefed16d468fdfa5e8969401513b46eb299121ad21934a05d7fe841fa4a
MD5 79831ba38f37619f6753b38dd356de22
SHA1 be73e93b6dbc226e9ffd697e03ef4f1d3428839c
SHA512 f68069ce6962da5da48ff0d717f74ec9093b6dac4d188126de4c0f89f453efe5bc3c0e22697fc41a1a285551c28829100dbc8067a952a92d1f281977bef96a9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviac:A3k03kHRJ3
TLSH
T16315AD13EB9500E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 886KB
SHA256 ea1863851a8abd940247edc944bcdc93da7f04028b90174b93abca970eb6312d
MD5 5589d7e4f2735d834817f94ee5d606b1
SHA1 e273c638e938f892d7e82635aa24453aba92bedf
SHA512 8b767f12888a28f92db3b0f71f9740ec7a2d059437c939a587ce80ad5abc9489cadc529dc55ef58e66eda819ea1971c17b28d82b9aef15d20225ae68cd53668f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviTp:A3k03kHRJt
TLSH
T16315AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 886KB
SHA256 dd31af68307e0336903c5824d7ceca2495c680844255db9d327a9bf5987c3ced
MD5 44848edac7ba83057b1285380b7af412
SHA1 e41ccfb789394d6916476f74bddbe28863fe36c8
SHA512 b15903cfc47809c7a983fefb011f92088304aa540fac9cd0cbf7ea45beef570e651ae3c54fc0d446fd1b090d23fdfe6f5517a6bde7aab71f5a563c6ec4ea4de8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvi0N:A3k03kHRJW
TLSH
T1C515AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 886KB
SHA256 afd79ba24872ffcd5056812737f72fbcd532283d8ac7c73f34b8dc3a889f45fe
MD5 f9187620667c76a6bea8457119d95a86
SHA1 7069350cb966f4d37aebb8abf24f3a12f77fa8a1
SHA512 48730d402f859c17d3847e105955613d4c224089d91595c3a45e2903baaa09a9f8ebaa6c7157c11b9db2f945816125b99f325d9fc96a02595a0303b79fa41138
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvicF:A3k03kHRJ0
TLSH
T10815AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 886KB
SHA256 edadac147dde59c90ccec5012934a472e0256b324df00da1f81ce0f578f85be3
MD5 307473a830d1823527dfac457faddb42
SHA1 a66916cbccaecc8bc9a2d48d1d439a8b897e226f
SHA512 1a71b363c8143042d81401df715404cd42846a287bbe1845fe88f395b835bd224ecea9eb8c0caab2e39ceeae2669bfeeaff99edc9859aabaa3471487b98a5f76
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviJC:A3k03kHRJg
TLSH
T1CD15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 886KB
SHA256 28a6c7d5fb43e132e663fa84ce68662aeab3cd8e4297a85a6ea10a86f69d0ce5
MD5 38c413a8331f5c80f4e42c15b9f0b08a
SHA1 aea7680014fa1efd0b45c9035accef674631d464
SHA512 7c332452affabf6f97cb61d874a7b17f25867dc3d51eab4e0ab5338262b8da67859e94cf13b86ce17ec66f289c85104315c3ed23acaca4150cd55c78ae96f50d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviqw:A3k03kHRJ9
TLSH
T11C15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 886KB
SHA256 44414b1c1984f34c0f067d126db45703dbf78c4382236b046b44ee359fdaf7b2
MD5 b2a46e735d51f6ef9c40e531f4548613
SHA1 9c4488d64cf4fb290854327495d3f56df0fc7045
SHA512 672a138f59dbbaa28c31020acda1a5749f3ed5abc0d6cdbf5bdf2175a16a6c4c24b01f59b3ca840cf65d59d32f5acda1fb03e5679c221cfa21c89f4c38b76fce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvixT:A3k03kHRJx
TLSH
T12A15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 886KB
SHA256 3b961015d4280667d96b4bef2a1c23ba31bf7801f4bfbd48ebd55d7bcf3b7329
MD5 117a599930e96c6d3a3bea8d5c75f2f1
SHA1 d51c097574691068f11d35f74d2ba933213297bd
SHA512 60d47ce06c7cfbacb342043769ae65f74fb858794d558df3a38795dbb15c1cef528aa562ccbb9c57172b65335aaddb6019ae984c88c696677f1b0a23df324fd4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvifu:A3k03kHRJm
TLSH
T1FE15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 886KB
SHA256 37007f068b259d382525487ac094e8cb37be3b90fd09b5aeb24cb530263b77d2
MD5 a109701b8e1bdf73057b259ea3d33ef6
SHA1 7f03b1281c682a0426f23df774c9034523834cd7
SHA512 54e6b9a0b4a23a861cb86045bc287c61e517a97702e67500c119d32bb5d15e516a17ffe5c7e8e12debdb9a35b6821485275dde570c3f4ac12e3d8e8468b75d6b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviDb:A3k03kHRJ3
TLSH
T1C015AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 886KB
SHA256 1f1e6b982e7d4764e5326b24c9ead8e42dc7fba324509505d140e888eae0f2f7
MD5 41765984131f7aa67ce732e1d0addd59
SHA1 adc8c4b5174614337aaec0ae5e1546aaba10d5a3
SHA512 dbea987be74e1780f9d1424be17ed35694c26a9303b8b5786a14313ae72251ed8ff8caaeca8e3127b410fd25d6bd7915334493c3118b19bdc53354542bf91ff1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviXf:A3k03kHRJf
TLSH
T1CB15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 886KB
SHA256 fb612ffe10621c88ef4eef241e74b14130b801128a5c6f0ec3f32e6b94c027a5
MD5 c647572fd6b76eca646af90919609998
SHA1 5636cc775cdef89acb1ac2823cdebb00c09f2712
SHA512 b549938b15968a0c934ad6ff32a27d510b144f8b4534bdbe75b69fc1f73ca81728733816d1890dc13edb5e46474749f9e4c1a96eff40cb6d5da38ffa16b2f495
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvigK:A3k03kHRJ/
TLSH
T18915AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 886KB
SHA256 1f682747e1b0bd52c7be34ed52dcb87b08a9c346e8dc60a95b9a1b5db246aec3
MD5 9f72938f68b89805ff1bcd247b0fa0b9
SHA1 f86d52c2a27246bb47318d4dd26b18f2283c9bb9
SHA512 3311f4e20b400a5c76fea06d288850cce2dac30f51113003baf1da95e337f9c311f9f0314e85989df3be6ef362651a848be8174f0c362ed8492b3494d32f1b8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvidk:A3k03kHRJK
TLSH
T13115AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 886KB
SHA256 a2121dff7875528e51a9d15c4a4c84b1bb90e04d9eb45c74cbccff85312fd827
MD5 ed71cee1a0b7f6e99a4527e8f650762d
SHA1 a036edce8c272fcccf804fcf52a1257001ce584c
SHA512 14485d10a751ee726b9ab77bc05b57299affa0d1d489f25369e2b6e95a9adf26461091d8630dc8d49f451562b27077f7dbc6106da5dd731c5c1be658da12feb2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviC0:A3k03kHRJ/
TLSH
T1D115AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 886KB
SHA256 91f57087786b9d37f7e38331e46486d43875cb6cc8c01bdd64730654de4c8849
MD5 6c2d83b67df2d65ff693eb99d30b9401
SHA1 a53c5b63203afba2aa39bc1e7023b074191916ff
SHA512 b8c49a771479a1468ecce6767b9c3c5a6e936486a993dc60cb8c55978ec443847585e214a79169778f2dada4deef9740f6d6f67d1f67a9c72e228f2c5cd0993d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviRg:A3k03kHRJi
TLSH
T18815AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 886KB
SHA256 21cf1a19d1c36d222a6ffa7186cd30ac4cca9632881b9982a0080d3c2e8b1d4d
MD5 e6180cfbccda1de447b3d58a7a0f19cb
SHA1 a27fd5067fa2297e62eafdffa130d23dc20f9c72
SHA512 66f82335c9c9a67baec935cb7993567d68c53901376f9d39f32b2feec1a1e30c8d56de455c6bdfaecc42663e2946aec4fc46a6ff4315481b396ac68002b39d73
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvi4r:A3k03kHRJs
TLSH
T15815AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 886KB
SHA256 61dacadc99abc1719aefd80fbbedd07d53ebf059b03482dc39992ef5a5e9fa53
MD5 37d194cd068e99c9aec31a43c7e13728
SHA1 47ea8197be96454371db62465803d4e4ca5ca6f0
SHA512 360330ec2425af46c5f5907c88d9410a1815a155e99a66ec382ad5237598539c2709b7ba60fc2558f930ab1a0e3da587b366ddf529debc522a45098fa05197db
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviWn:A3k03kHRJW
TLSH
T15515AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 886KB
SHA256 4ca6699c670ea0d0317f86e0f1a1798a1fc7ae9baba768b737585038fb784d07
MD5 56110c092f4ad8274ae6aaa1b4657436
SHA1 033f67464379847dbf87595416e3eb47c2cb058c
SHA512 78b743859895cb2c589e6db7ad260d678f2e7d08968ccf38776ecfe7e539bdff8e3c88a6184905ff7c96c5f1e95eca351117e19242a3d4a731155bd1994f475a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvi8x:A3k03kHRJM
TLSH
T1E915AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 886KB
SHA256 4e58bf60e20b47d2f34639fb7d838ad9c5bd242a11ba7c4b1cba9b6a037ccf4c
MD5 271f43f45e8662843ae05e5dcf94cd74
SHA1 aecca6f403fd6e43fdbfb4d3e5450c42eee53504
SHA512 fb1194a4fa9346a4f31d6c9b5a4ee4408b07a9d344309163620b801eac8f846f21aef7cdfe9139a7f0690d49c61e7024b54f1c918c748c37ee3116dc8ffe33fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvi2A:A3k03kHRJX
TLSH
T1C115AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 886KB
SHA256 1f8a06f2043d3e52ac79c3a8dc5ef812ffc4e3413310a32b63d6d0fa91d40f4f
MD5 721b4e9f009436fc4c3eb2941c5b31e9
SHA1 ad5933086284c05ec418320e0f08da519a1b0613
SHA512 466929803b70e3389f2f3a6bf49a93ee623a129dba16dc116a7ef9937fb7a21658395f2ed8ea044ca25f5ce57249c0290f54efb20712feb2d9808ab23cc3fd60
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviv9Q:A3k03kHRJa
TLSH
T15A15AE13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 886KB
SHA256 9c7548cd3c7759db4a63dc026f9fcfecda36747982af860dffa99be3579aae3f
MD5 b80a8e551a5ec14985b3b9a3a5fb4f87
SHA1 b7a37d427ecae8d0406ed86f1286950dddeb2faa
SHA512 0186c47cea507913b87553cfd840c8ea89f312a67cd2ffd87f13d5cc621181e5679d3415a98cc37d9c3824211910c6a6b1e31353090b752cbc63c3df428452ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviG4:A3k03kHRJ5
TLSH
T1D315AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 886KB
SHA256 a0761e4ef59db8ea1686b792eb061050642f8621e44d893932668327edb5ad38
MD5 56d5d48de3e04baaaa067798f70f63e6
SHA1 65adc26cf001b837a4305f75d732d58df7844872
SHA512 804c40889a96cb7ad72e005dcb4c3db28f6374cfe3fe5ce79c3f8b79989fdbcd32dd9da3034b45fc780fbbbe513f4039de6d783f713b78d62f42e0f14a50fe67
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviVu:A3k03kHRJE
TLSH
T15E15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 886KB
SHA256 032ee168dd7ef23459d9365e51f49cb98d563b39313774cbc7b61f0ca18585b9
MD5 fb1bdd24c1566f4756f7e17991909872
SHA1 413b6960a4d751a907c1a1c09e1d33e6868a5cd3
SHA512 602284962102205f770a5f2a0e5b5c445476132c7ae8a3a299f45be07398af13ae73650e7157bbba526b08a1b31ad55e35b2dcb1be0e078db4d962308e5599bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviIj:A3k03kHRJG
TLSH
T14615AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 886KB
SHA256 38ca048263e3d9d22735ce7e85718c29781c2b883777b4cb12b6a96c27b97ea3
MD5 0d2cf5cae5ab2697e9b36fab2c14bab7
SHA1 c5e0c25f1ba36d339c6b18285764d95b94a90d64
SHA512 6d8cce5a4008fffb6418e3a9819c42d59204def1c3b20ac008799d7e0bd07795adb36328cedd85ebfdd2379ecb291a13e33ac2aa6d84ef43784aeb5e00cc8d47
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvi5g:A3k03kHRJq
TLSH
T17315AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 886KB
SHA256 f5dda9004c9f797bce3ad98055366ad9284d5319f00a854658c6b115ad150bc0
MD5 de268c512ebedf94b0c4e54dc830e04a
SHA1 13dda818cbbbcb98acaf350bb267e459e71b67f8
SHA512 90a47321c522c5e9d00a157f1d617e1459ecba587f1e46a708a46d7f217e571bd05ba8bd53008061c3a80c2ce7e1597b37a4bc9950d2ced9ab406fa3759b276b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvigI:A3k03kHRJL
TLSH
T17D15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 886KB
SHA256 7b48397cba65faa86d6ac31af770ca62a367443097fbd2232ed94da905ac9d52
MD5 969ee66e2f0e209d17854b7ca15b57b5
SHA1 04077b0fe2ef229d222639ec6e0fb9660870e8ba
SHA512 fcb473ba4e0b900e5f4e4f53cca9fb0b6b33d7e0cd15b3a218269bdc7e747468f2d4d8452d9a45a2d817a7afb8bd68c55b4106a2237270cea28f30d4095dae75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviio:A3k03kHRJV
TLSH
T17F15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 886KB
SHA256 79d02827745d35c37e0c55c45de1baf21de573e69ecd79319591732101cfcc58
MD5 0b178b8be249a3d0d2c823bda07ba917
SHA1 8e06a22ee3a5eaea9211646024563ba3a4b68b62
SHA512 081affa9f0b79a1dbe130ba71b4cc14b8bc573476ca7bfe9c27019983cfd76577d4d2be1e73ed950f653a038b81f144d50a555a51a8502e1e2d91331f033f2eb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviZ+:A3k03kHRJw
TLSH
T13915AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 886KB
SHA256 7bff1b9fcb10694b512d0140b7ae3fc1f6c9054aedc074f2f7613b49b2a83b08
MD5 daa12a9f594f86dcbc25a4578be715a5
SHA1 3f805ab02be52cce69264cb9f973518adb8fbe3f
SHA512 0cb05c995fdf38b746de010c6c8f35f92bb6f52ff7cbaf1d5b7153d227967fab3747cd64455c0a5d18bfd8888c87a0715da1957efa45e2ede472bd06a43f132d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviHQ:A3k03kHRJA
TLSH
T1A715AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 886KB
SHA256 0386ab2d666bf6ce4d8b58b21d7ea84c4d5e8c1297707bd3a1dd162d53c78cac
MD5 f2f38da8e229636326776aaf2835cdb0
SHA1 94863e2e94ac3e215640c9d1819ba24da6faf685
SHA512 bea1caeffd222b42634c9b1e99bc6e129109c8c7f4dc24e9d78cf6979bc056d3c7134e4f1c0635d73a675225996fe31fc718fcd6a5678edc6d82b2aa4dde005a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvicX:A3k03kHRJw
TLSH
T1B315AD13EB9500E9D10AC1749ADA8A23FB75BC56176093DF2358C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 886KB
SHA256 786d086d776980096edc68e9644a12746e32e3035137055a61ab25cf91ea4fc9
MD5 fb78618c434e084f50e4688ad66194b2
SHA1 f0375679d11471fc93646bdec1d9ac838066bf7a
SHA512 28725a4e6d0248721a89c2b8462d01bf05988e3883569ad5755e65898ba1a1a31c848f5c63b234e6238bdc3d5f099fec1a4780c85e02928ade85870a3d46eb0a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfviaL:A3k03kHRJS
TLSH
T17415AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 886KB
SHA256 a180e6f6768a6bdc7172f4eb1ebd1eda7ec65bde2f577edab15a9947b84a04e8
MD5 11217bedf50e2139f2bc0a23dcbc7b3b
SHA1 a92c084a8375bf2a17ce08e2debf5aee2b552e7e
SHA512 5d5101bbca2a741d5231cffef0ad1b554859fa6ee3a6de3842c8bdbdbd17ee48cb8086e711755737dabeb190fde9914a94e361c028cecceef2429447d15bd81d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvi+M:A3k03kHRJ/
TLSH
T15D15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 886KB
SHA256 4810339048722aef4efb83c37db9f77ac27e379085dd19b8b8c8465e20eb3faf
MD5 b8e2522e1acf3222a6a4385ee7aecbb5
SHA1 d7f6a4de824e65cae7dbcb20c3c16668aa639773
SHA512 1361b67bc154da9c049f161b5816d021413bc3f1799a43beb49d44501914951c6dff4f570f38a4c98c8589f19ce6935ab4e3804620dd15314428d10d97cda6fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfvinh:A3k03kHRJx
TLSH
T14F15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1896-209-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4536-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4536-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads