617a39d15a9de004fed031ff9b23c9a50e1ad6fcd0ac85e89027cc3eeb3a91a9

Analysis

max time kernel
103s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 904KB
Sample260818-wa899seq6t
SHA256 617a39d15a9de004fed031ff9b23c9a50e1ad6fcd0ac85e89027cc3eeb3a91a9
MD5 6a1637c2de08216f999c58b14a049c46
SHA1 9531f97ac7dc625aa143beeffc598cf7baa1dcd9
SHA512 4306c96ade20bbf46942ab08bdc32e4a79e8d59680d9e9f3a09de7cd10c7216960b941b5574847aa0b7579a160fca385788b1ed38621592ada3d41c60d6ed9f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNap:A3k03kHRJo
TLSH
T1BF15AD07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3872-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f9-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5572-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3872-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-430.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-528.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-867.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1036.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1098.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1137.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1206.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5f9-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-41.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-222.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-430.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-491.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-528.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-867.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-981.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1036.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1061.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1098.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1137.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1168.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1206.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1334.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1359.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5572	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3872	2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5572	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_6a1637c2de08216f999c58b14a049c46_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3872

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 904KB
SHA256 617a39d15a9de004fed031ff9b23c9a50e1ad6fcd0ac85e89027cc3eeb3a91a9
MD5 6a1637c2de08216f999c58b14a049c46
SHA1 9531f97ac7dc625aa143beeffc598cf7baa1dcd9
SHA512 4306c96ade20bbf46942ab08bdc32e4a79e8d59680d9e9f3a09de7cd10c7216960b941b5574847aa0b7579a160fca385788b1ed38621592ada3d41c60d6ed9f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNap:A3k03kHRJo
TLSH
T1BF15AD07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 285ba10c30b476c7b00ad9b476c64a541ee3bad37a7a53284d1e179424e0a30a
MD5 d6609180785221bc1eb3bdcf37dfeed1
SHA1 4fc9b559c1916a2ccd8ab65834637222ea934c2f
SHA512 0f164813a59579eed21de93703adef7bdebd92c1f1cf697c670fcae64108477fd6fbf729de901cd4dff21ec6551a953fcbabda5be9b61fdf42e54a11e74ef53f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaZ0Le5ji0hmxNrM:A3k03kHRJUPji0Aj
TLSH
T1F2658C17F6A402B5D067C0B9C5D6AA5AFA713882173086CF1358C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 919KB
SHA256 906802c5d6173dcfb52b6a5ba2d93504717afcab3eb1558e7bd343cf7ee33f6b
MD5 173935d8144b13b547f0b6469e084290
SHA1 ee973f838e6873e10521f47c1b850e4b115bf81d
SHA512 92e87f24442b65e6a8facf55e49e17ddcd3a9aea309e6866dfa2f7126bfe416b4b25e48ae0f4b7b009d299d6da28905f894d0192ff0ed1faf04c7dcbbf8ac093
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaLa:A3k03kHRJ
TLSH
T17B15AE03E79400E9D10AC1749AE69A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 928KB
SHA256 fb9e007b5a6be53be638063102c734a5aababe0d13d5cf734d87bd6b80a95d76
MD5 8d1f305041034e61d6e9a32d9a3254b9
SHA1 dfd13e7850747d17a14379248aceb53c493a57f8
SHA512 5cf3b2c94b3d0a07385dde1077c40b1e65e156493bc2ad4f665b1b30484222341cf0ff2a62b3f5fb5bf7c456e7017068661945d7c18e5788cddd7c41b0c1fd8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaK6:A3k03kHRJC
TLSH
T12D15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 928KB
SHA256 eddaeaf080235043b0fbed5a27e7f4a1e16f58acff82a4f02d0d368a829ad441
MD5 4df57687b8df8563c229b0a7b34d3d29
SHA1 e0c5cced8e8d05c3250954ac616a97029a60048d
SHA512 a9fe06edd4dc3fb9b7c40dd05306f41f4164c0a22e6d6001873b78b1627362df5537387ceb086d316f30e8c739f53a0fc36b87d95ce17c3dd1e52be0f6dae0c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaiN:A3k03kHRJr
TLSH
T10015AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 928KB
SHA256 3907561cd021c71feca55712551a869e7effe893ffec17538fd358c2f9ea496b
MD5 4e69c52076e73f5c559bd235d5920b59
SHA1 4999a8bbcd5cae61ea28d2a6415c265b8598ffe3
SHA512 8293688f966c0ccde456d420f853c4531c7efe489cda3d022f1bc7b95696b28a99e641c130405d99acebfbdd5f9baa02e147a00246e2e82b55c4cf35994d22c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaYf:A3k03kHRJv
TLSH
T19015AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 928KB
SHA256 a1af43a592280e9a91cf3f712e842e3459d032a4f93eb397dcbb2339fbd8b0a1
MD5 0dc49f53ce74825ae9a854d8df10c4c1
SHA1 35c1f0973b64a3a75005ce74def58c0c8651ccd3
SHA512 45079106ef6ba0641b312922573fba4f3a651fa1fe9800ffc81442409a83fe0e828b00c9e1fc189b79c5200c6b25ac718a7b522708aec453004473b217939e26
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNayo:A3k03kHRJm
TLSH
T1E015AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 928KB
SHA256 5d8d88c2373556c64796a833a292c858b1fad536c0537b04fbe2a2f96a125971
MD5 3803ff98218f0e9927c4c94f4fffe9b0
SHA1 0799af502ec1c4c3df8cd74f54cbf07d74234c65
SHA512 b29792339d0f12cff4643a0a0dbe6b838b37ff46f741085e24cd3ceaf2ff511dceeb3fadac419202da314f4b155bea9defbadf3bdeb41cf213dd86693602af11
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNamu:A3k03kHRJw
TLSH
T1A315AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 928KB
SHA256 9ea0ad80f1318a791f9d149cd36f73b7f99f1be78e5246bed19c2ee11f6ff512
MD5 ad2dda569a8e9157f201eaf2d1565af1
SHA1 296c337cb3862952024ad7c2fe65f58d0d54b026
SHA512 d4672b9fa78435cba4baee728e73d3560886adf12b30dde53ab38dec8ad106d27ef4b5d145d1a1b53be58198706e66ad001b690be675b02d92370f32901c50bb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaa9:A3k03kHRJF
TLSH
T1C315AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 928KB
SHA256 4287a435a407d98e9cd091d0221ab4e2403d6ba7ff5ac04ffa72750299a3b021
MD5 b8336f37531cc93f4e419bd21b7bc3bb
SHA1 59ba1721bc80bc25a5a80e4735adba682a3700bb
SHA512 32e8eed5a6356978a786de6e14fe4d189e42d3a1520e55bab80a82569c793490ce7f3e91330f1a76f5ffa878781ac14b5fd89eaf0a70ac3f66094e46eeb8b43c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaac:A3k03kHRJA
TLSH
T14115AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 928KB
SHA256 57160eec5f60ca70fb0db109779e766016eb84b4b5ac621e3b96b3b225d4009c
MD5 75845f17b2a10d67dec0d0ebf1793c5c
SHA1 962801153c5158fa6ce423916ecef4b01fd100b1
SHA512 8328260d375bdacfb46e2c5066c66dd8508100cd900a9e421e0f67277ce17dbe26bb8baea795f3cba58a860079e60d70a043e7d89e58ec7da42d0417ce90a4ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaTp:A3k03kHRJW
TLSH
T11415AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 928KB
SHA256 2dc9e004c267f10dd3e7a2d2a62a93b06228794afd1f8393ffd2c433c2f26686
MD5 99929eadcd43aeb9d8b81dcf2e3c4991
SHA1 d820809d470692d3a6dad88bc60fc3aaae9ab0fa
SHA512 252a954a2a68e4c157245673927ac5020fcc20c2f6770ee992d0eb3ef11e9a52701dc15a82f5eed82b1d853c61e0a9d05cccc4053143a712b0e56af42aedfac1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNa0N:A3k03kHRJZ
TLSH
T16815AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 928KB
SHA256 5b85f9a161ad7bdb3791b20050ea7660d167b930fb328a6acc8ed4bfc33e4ee7
MD5 b030add8a7da98af20ae86f072304b39
SHA1 281b54b84cc3ea2b3d23c35ec5b24d8c0ca1ff58
SHA512 3665efe4d0c5c31aa6d7006bd1aa7d3528640f4a6d31f9826b6ccf2a3abb0129ee397486f92d10a21b6c442114a087cb0bdc27012aff25cb56c611222a035699
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNacF:A3k03kHRJL
TLSH
T14C15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 928KB
SHA256 7f2bf90589ff1c8f18f75ae6e12a89593b7aeb1e4a1cef88b4e21df183cb01ae
MD5 a0dc6a22253e3cc2853adc2a3126f992
SHA1 b8e5ab909898bae933954c4b0a746df56da9a0e8
SHA512 53c9d8b2c70d8583c211ff7b46a6ed43930a6c6066b95725155e6789378069a036368fb6c8a379b87df4f1bc377523d8ae8345ba74efb3b7fd863a75d32edeca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaJC:A3k03kHRJn
TLSH
T1F815AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 928KB
SHA256 b6938fee6343fe4d44117f23a1e90a8eaeeb59e03945f8c3b77d9c882d85482e
MD5 8c1fe3f63635ec37ed623ac06d32a0df
SHA1 d2679b8bfb45e8cba403bd2547cce6de7df9187c
SHA512 3b8408fdc3a55810a117af1f7791e22c1fa314cf5ada750ffe42f5120e920bd585be9a611dba7ebc63de200899ea9a482a1553d62189a8fc2f58d96bdbae658a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaqw:A3k03kHRJC
TLSH
T15915AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 928KB
SHA256 13b185c632997fba2e5f6124723734714915fabeb558b36c6b62f99ae8f9d68b
MD5 a63365d4ed1f0345f17fed95f2686567
SHA1 b230f45bc93799612c9053d6e116b5ad78b9bef1
SHA512 ea1c1c57259cb33060b92dfac04ee18ea08325d902e2d2c337e3f9e74b12ec5602eb345931c81a7f345a1bf7b303f8271dcd37d7602f3bf0204b89b1a9f48485
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaxT:A3k03kHRJy
TLSH
T1AE15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 928KB
SHA256 bf3b4c3e6f3184804bf8f244ea079363637536ff9d0e902701434fecea5de169
MD5 da5b197670d1ca64f0979fc088556fcb
SHA1 08b669139cd48e66d6edfa633b62baf15aec348b
SHA512 d536962584f57c20ab6a4486eb948aa0848e6e0d62350d408146c1a9e7944e73d1b3d03c3b299c81fe41e0521f01954fdd1ec7decb799a3ec203480a5f9253a9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNafu:A3k03kHRJ9
TLSH
T1A115AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 928KB
SHA256 7ef7219edd3a1e88d1543fdaae04466cebcab8e58f7b9b73b9392cd929d2adef
MD5 f78f2bcfc1a7b4d39fe70b8b690edd4f
SHA1 ffc293b7cce5aa2eed47a78ccc08f684241c2d1f
SHA512 ec8d5d01e378fbb8168b4d202dec64e0ed402ed89365ad186549efb64221b3cc273f95c01fc6c93d038fb5c54124670221d3b5cc73f829dc7a2066c44ee519be
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaDb:A3k03kHRJM
TLSH
T11B15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 928KB
SHA256 23cf3279de9ada06abcb2d0334a53075a27bb2f6e6d9e5287afb89bbfba09368
MD5 8c48f8ce8b9013dbee2aed4d3f7c67c2
SHA1 edefeb2e203039349ea11f3fa4d49113390bdb73
SHA512 938079ca9b6108cdd725be17d48a9d9f59f17b760471ab6a1e9f27501009f9574c58dc7b40a075b09833b4ee8d70bc2b5c90dd4e4466e345e32d72ef2e173b81
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaXf:A3k03kHRJM
TLSH
T13E15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 928KB
SHA256 263dfc83ef555943a2cf8991c39e894dba312d8cc3f03492045ef99e58b40d5f
MD5 56553909e14835268b5763c3f80d14f6
SHA1 afc1cba06bea224b2ecc10d25c99850efe4b31e4
SHA512 efdd9a248996436b703c5aa7455c844b991f60ff1746627b14b9c975dd4efa73b2786a6c31c4bb70e8593cec5a749f1da8a8e65d1be0f3b1ac2f778df69fea9d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNagK:A3k03kHRJ8
TLSH
T14915AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 928KB
SHA256 51e24211dc335f13ac90b3ec7db48e25c0dc56ff08db86625f27f61c045008b1
MD5 d2db2d00a72b2fdfede976938edd3a77
SHA1 4c6721ec6760db4350cb506954592672fb997ecf
SHA512 af5890160f5e3af699c4dba15c9b8f0635dfccb5001f085c03341a1d8e90fb3039ed783d674b8601abdf477395157a165829306814ccc15c6c82132a5c728cb8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNadk:A3k03kHRJF
TLSH
T17515AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 928KB
SHA256 642c149f08b8c086ba31e7be8b426f884a892ccaa19cc646068f37ba9f9050c4
MD5 ef9d6896b7cf11c04275854f5ab034d4
SHA1 bd799ff58ac8c754e5d1e54db96ff73b3e4a7312
SHA512 5baaffe36fb9cf91a3770a188114edef605d2726efb6df161ac7bf2b5137eac587321a8a2717a52f74f4e5b5902e552221ee1ebabd49b8a4dd50ac2c5b2f0b22
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaC0:A3k03kHRJ4
TLSH
T13615AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 928KB
SHA256 14b039395094629cf8000760de4c20aa0d7275fe51988e19e3ca6dce290338cd
MD5 fdb00520c15278af01be75ac03f09ab1
SHA1 60bb5e9d093c08bb99ecde25a40ba48b389cedbc
SHA512 2fbfd9ab9172bfc91242280e1a64d11dd5624e6d7f50a8035b5aeb9e894b8364059d0633312822922ec2a39d114aeba47d9a6924946859968ed8b7d0f7646269
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaRg:A3k03kHRJd
TLSH
T1DC15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 928KB
SHA256 fa94346f916bb070aa6f8ff22d147f1235e7f5cab035432ca442aa3febd5ecd3
MD5 3e323b274f99cf1f8f134f7e9d9a02be
SHA1 17230206658c3484252f1206ec39627037d44b1d
SHA512 0a2103418d97b3a2ca7ec8aa5df771ec0c6da8c411c098655ef62894dedd9876352246ac42e0448286a042b50f099d6e3f3c8d1973b66172a28e6e21a14bf1fc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNa4r:A3k03kHRJf
TLSH
T1E215AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 928KB
SHA256 c28360e2c42492d7b3613eb3d46f08aabbdafcc042be915efdf8a86c715454e0
MD5 53d43d14e934238c4a489eb9cfb77cc0
SHA1 baf7b69c90e14386d5ed5df84781d3da48739937
SHA512 78d4d7f554ca8142a07d2babf28a997a95302bb75807f8ed7413411f8530d330e57d4acfe8b76e14cecac8b839ca5f681991688a2caeb8194cabc5c3378f1161
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaWn:A3k03kHRJZ
TLSH
T1BE15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 928KB
SHA256 689649dce6287395f80dc8f9ba0fcf7301540c6222f869e0ad49350af9001984
MD5 b212964932350764493a8f838aa45885
SHA1 daeb36f5874dcf820875ec5abca0d9cd9cfab409
SHA512 747b070140d5aecf657792a44d997817f0a6f78121be42acee9ad6b87ca7c20591e1b0573c5a3f52a2034cb43aceb87cfdfbc2c2803e2561067536b3758d75f9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNa8x:A3k03kHRJ3
TLSH
T1F415AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 928KB
SHA256 27ec29f2bd8da8f64121f87b7c63978a7280c9b530a4317f94feeacd6eb940d3
MD5 6de338aa7fab22d624193bb0608c3edb
SHA1 0f6fbf9465a439753c02bc8596b474015a3cfaf3
SHA512 6f890e72083927a7744e1122d8c186229c928bc37b2c318df22427982e37823d359de3d374e2fe0502bdb0dc10021323cb072d325c02ba33c883d36315a58ad8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNa2A:A3k03kHRJ4
TLSH
T17E15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 928KB
SHA256 6b56dcb9b410c40bcdc0ca1a15bfc69e1393a9dcfd7d1209f14ff88f93aad410
MD5 e6039fa992364f4b5fbb648726bdb792
SHA1 452f149e3d46dbdc818a0eac1533f9bc5572a486
SHA512 48e24128fb2d6fda1791f125b1b7152b6b08b25f4df0f73e448ffd4c8d4a1088e4896c7a36e6d6e5c07ad28d9003a3d4ce8a1b54da7851894f7eea1a341ded2b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNav9Q:A3k03kHRJh
TLSH
T1DD15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 928KB
SHA256 6338fc7dee51163b06d950b6c81fb9866866169eb31eae4910a7f59a3e0f7e5f
MD5 7994cde42cbbd952028a2e4018cdac50
SHA1 9f0c4841ff7ddeb97e3c4e846b406ad230204dcd
SHA512 639c1df2855c878bd35e8e4ad34629599b45ffdb076ff7c52263ea5661eeaec40b83c3fd561a0954c84ab085ab66c1098635792df78669639c719c4864933fbf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaG4:A3k03kHRJG
TLSH
T17B15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 928KB
SHA256 65a15e9a8cc46863402fcecdb78775336dcc5abcaeeef8a9ac89b11d45836d17
MD5 6074a36eb7638176c627162c53f9229a
SHA1 9c7df606c26e39c39065a5eebb274385a67b4a28
SHA512 64a6f3e27a10188df0c0cdc410ffb22e1a91d915fd51141f960bdcc17d51e762a9b57c7616b24ee2067ae4e21fb0c818ffd116e5f452695001ca8f8d7bbcf760
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaVu:A3k03kHRJX
TLSH
T1D115AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 928KB
SHA256 7bb6eabf54a09b40e55c1ef8f22facabf47c5e3d32257ddbd72c65bc68f85817
MD5 9b456781faff02c70165a634a58dbadc
SHA1 de5cde5151367960be18d75f0b2d3913ff9e0fe3
SHA512 0a131c0b4cc00ad464f6a40da63e8f3eef3b57397c6adf95e4242a844860043e1724df6d63bfec77483b39cc94812c15f344ab67057819c9f7bec33dc21e0f18
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaIj:A3k03kHRJZ
TLSH
T1F515AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 928KB
SHA256 441fdc67f0021858bfb24367f5717b86953f88f29ffd2ddbea3b6baaf211649f
MD5 ef7d1aeaf32ed6975947e9d5d9ccee34
SHA1 ae682594239057e7950f4595813639a907041507
SHA512 e7bc6f644cccb06fe4d2ab9e6e6a0505e64153daa25a7ff15e9a86c14434674e7586f97e0f9045ce93bce1dd7eda4981f403ee6562c65f2b5bb251d320ad4988
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNa5g:A3k03kHRJt
TLSH
T16615AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 928KB
SHA256 8382b616076762c7638f0eb393b3b06367dbcd3e32b185aea858b9a68b13897d
MD5 b8ef8512a216f449162fe12ccf305e0e
SHA1 444cd83dfe17d62b9184bfa09eb92e7075c9bcfb
SHA512 03b761e8aea831038a3acd43f19fdb33f434fe765f4c7b891173b201dd1c2c4057c6e80b8e6739c85cbc4e52553f5699d05b70a6b69f1fad7706a3aee5172b34
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNagI:A3k03kHRJk
TLSH
T15F15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 928KB
SHA256 05917789286a2f9cab6926fdfb272ce51d6ddbc5c3b5b0530bbe84e3b62a17be
MD5 afbecc7772efa9aedde4e9f5449200f2
SHA1 525ded5c8f413bf49db11dfeeed8637777174323
SHA512 f60e291406da1575f2250295a4e1a5fd38d60204fd97702e73292e4ce96d2aab962ee7de7b9f4a7672348df690758cf65ab52932eb8b5fc2f3b2487608d42a9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaio:A3k03kHRJW
TLSH
T1E015AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 928KB
SHA256 728004afb6c33508e231fc643ea8f0ac7eb724d19537ed0338677cd3972426c9
MD5 b9af3a9d344ba397d3e9873dd47e8b0c
SHA1 c12200e98f1b7771c912601d7671b7e7e412d2fe
SHA512 048e51ffabdf62a0a1be8025864d5df872f8875a33cb131e629df64d4251e71c3eba629f394695a1ba194f09c0cd14f4c87f54f5c1442e6706858d751989873e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaZ+:A3k03kHRJD
TLSH
T1A115AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 928KB
SHA256 1765d1df3ef78a13dd9c61b4a0eebad3c8175bc1d462bacbd73fced8e78a032f
MD5 85b0ac12c15c283a66094b9c9ef12142
SHA1 ac88c133a84b441013730424be0b7d0f769bfcec
SHA512 c59032898657278dfae1da3a854d6561318997ef3bea3c615dff5750d1ab2d9251fba8b0bd5306c07677a090872774510f9fbd8cd61b56ec9a5b8e66ce953942
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaHQ:A3k03kHRJX
TLSH
T16515AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 928KB
SHA256 4a58faa66b6af55a5a491c53789a0193c15494cd5469d13d7b1961b8c5b80b62
MD5 2b9ba41f0aa0ec59f4949c7799b66623
SHA1 f5d3677bc9a58a2a53e17ee8a0afe16439ea056a
SHA512 854047f69d4ebb47f74b88b50d584a1ad7ae58de051e1a1da2edfbb716644c509e1f8e9fe4c3457e27b1512dfd828e2f833adf9b987146cf4343060a7b29015e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNacX:A3k03kHRJL
TLSH
T18315AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 928KB
SHA256 2e8b8eb8967533a227a7f96fb92e51d2b76975bdcdc1ee01f740b34acdddc056
MD5 bee226cfa75c82730366870b4b7ed7b6
SHA1 aabdd9252ee25b92caa2ea9570a115c13c393caa
SHA512 5834cdf7c9376b6906e843ee1f922c4a74a8c157f862a28d4d68fe6c78c239ebb5c160ff830f9395918aab6e540a51e7a033c895eb8fbe18a9f2708429f5ddb2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNaaL:A3k03kHRJF
TLSH
T17515AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 928KB
SHA256 803cd65bf35b33b852354567bcbfa309706b92eec2e119a01695cee8747ae25f
MD5 58ad054a256c7f32a79c20448ac14934
SHA1 ac7612d38735a415d839bdeceb76cce3fa5c725b
SHA512 a33e76b434e66fd77360d25ee9ed9724b35e04593f8da25283706177626d1108ec9b8b7d2b2e1a870ded9ff1c292b81597919d82915f102ec43062502c812e9d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNa+M:A3k03kHRJ8
TLSH
T14A15AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 928KB
SHA256 1f521012bfb4f7d49f4c90ee374cb0a10e5359390743fedc5c44b74cfa401705
MD5 85f0cdb67598ade27e0bb7a8c6ca54c3
SHA1 f71581b253ac0b49ad98cf9b06ec471701b09115
SHA512 471d78a666a22a37b4b66e4fa9c95c5c56020123178121ba1f3ae7a7487fdc7684e57205d6e7df87525788a935e27cfc41435ff0d082ef385fcd9cecc36accbe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqneaohNanh:A3k03kHRJ2
TLSH
T17015AE07E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3872-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3872-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5572-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads