de98b0d6d547da56512b1c1a1816085a1419c4eb8c264176e86ffd005e3fa3de

Analysis

max time kernel
94s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 853KB
Sample260710-c7dp3scs7p
SHA256 de98b0d6d547da56512b1c1a1816085a1419c4eb8c264176e86ffd005e3fa3de
MD5 dcb9043df9b7201531770d2ea489f10c
SHA1 1cb99220332666a98f59ae9fa5a312a68e4ea666
SHA512 a6395a247ee2d3a511a695c2a6e71f0c6052d7208e3cdc958cbbf3ee288c687a14674465cf24c03452c64c5d456d6849d03513414cf3e1a4fd2f7bb58c8bf5c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCo:A3k03kHRJ5
TLSH
T19E05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5884-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001200000001c4c2-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5884-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4604-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c6b-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-426.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-487.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-512.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-603.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-719.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-787.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-824.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-876.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-921.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1107.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1197.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001200000001c4c2-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c6b-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-225.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-426.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-487.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-512.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-603.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-628.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-719.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-744.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-787.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-824.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-856.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-876.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-902.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-921.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1008.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1045.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1064.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1107.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1170.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1197.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1356.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4604	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5884	2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4604	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_dcb9043df9b7201531770d2ea489f10c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5884

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 853KB
SHA256 de98b0d6d547da56512b1c1a1816085a1419c4eb8c264176e86ffd005e3fa3de
MD5 dcb9043df9b7201531770d2ea489f10c
SHA1 1cb99220332666a98f59ae9fa5a312a68e4ea666
SHA512 a6395a247ee2d3a511a695c2a6e71f0c6052d7208e3cdc958cbbf3ee288c687a14674465cf24c03452c64c5d456d6849d03513414cf3e1a4fd2f7bb58c8bf5c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCo:A3k03kHRJ5
TLSH
T19E05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 8233e73d9e4125bab32faf55684ed74aa23da5bb280b1dddeab41ed988e35569
MD5 072771fdd85d813fe5dd2aae6b7d32e9
SHA1 5149b09a60d62eb87637669dd70ede60f14ac422
SHA512 40956702dd55413a4b8988961aa9d989788f89440f1a62fc011cff7627c0bc27af7cd8e819458ee1a64924893ff0cc82ba34562792a3a1ae1f2497205ddf2b5b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCw0Le5ji0hmxNrM:A3k03kHRJlPji0Aj
TLSH
T1D6658C17F6A402B5D067C0B9C6D6965AFA7138821B3086CF1359C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 868KB
SHA256 e6aabc6cd416a7371a107283a45b4c0f2b664bfb9784a266aafff895f94fbf6f
MD5 81ac6cbac937d252fd9e0d23773d52c5
SHA1 8f2511b5b910b24b1978bfe1dde33d2e5dea3a32
SHA512 c2040e093d42b33dcbd14b73430e62ec3bd5a653c20e2d19112ef741b1ff8e4818a85077b5c6cf46ed9b8469d0a0c0c324142b5d7b534612759abb5fa30f302e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCKa:A3k03kHRJ
TLSH
T13D15AE13E79500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 901KB
SHA256 a7d97adc69e0f13c0166e55b13be699b60adfe89a3e230cf962c95c6ceedc708
MD5 41c74070d20e5fde1f6623cc2d346800
SHA1 d9f09a35efd670fe9bdb40db3f40606f9df0e34b
SHA512 ed6222c072c9cc80d3c47193cdd2cd2c948edf30c477a23f98d4288c11240fc0378ef1a7009536cfa0209379af21a59ed8f50704669ef214182347feaa5abb25
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCZb:A3k03kHRJEb
TLSH
T1A9159E03E79500E9D10AC1749AE68A23FB75BC56177093DF2358C6152F62BD0AF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 877KB
SHA256 10ef7eaaccbbb84e0cfb0c23fdf3f9ce1718c235d02ee9d332a14462a894ea99
MD5 d7c95afcb40795ba18379d76b9e83dab
SHA1 ab86055472f3b1acce356253fc594fd52fcf7f42
SHA512 be844f1079c2627ade54b6380dfb1bdb985637cba97b718c4dedb9b82695022bf005d09dc287791ee2fbe7c80a33194674878bd2288ea9a4b1b18af899388d98
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaC76:A3k03kHRJh
TLSH
T13A15AE13EB9500E9D10AC1749AD68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 877KB
SHA256 797e9abead5c2997070323480065c176a7aa6676b7be8730c19e15a186052d4a
MD5 eca6ae16495f059b492024f3d3f44880
SHA1 7a43772877fc2dedf03a1d4b14de7ed0bb20629e
SHA512 17ddaaadb98e9a341087ef38b1fe5f9d5677f679ede995926d4284337a970527f89bbc70f77369d82841bd97144c6f1c868b9f8b98f733e3fd4794e99d132671
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaClN:A3k03kHRJ4
TLSH
T1E015AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 877KB
SHA256 74c51bddfa261ff6c1d1e64bbb52a65fe034c83897665983203de29f7e9a00ec
MD5 cdaf1246952673fe91452d9e03d7d602
SHA1 9c4fa31316339f1bbd4c75427c6a52f8fee7d46b
SHA512 ee7e0a300849bac65b37fbc57eed5cf5a1525a9b34ce4e9bc3a2a5aaf4602147cc9b9a060ccc66b6c90478b7606a565edf9f0aee2f6d86315c8dae4c83a20cd7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCjf:A3k03kHRJw
TLSH
T12015AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 877KB
SHA256 11e9a1d7424781bec66419d406837f17f6c865fa397cc736890adb65cd378a6a
MD5 326b3eebb8d80c292c1cc9ab8772f088
SHA1 311462a3f50134034d04540dc3bbed839833e07c
SHA512 803c69a290ad2ae0b0c48b7601aad64ebef22371e89f7b3d4a2416d77c416fe3953ce4c885fdc9e6969a4a36330f261006b33ce4b05b8c535e1db146dcacaeec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaC1o:A3k03kHRJ9
TLSH
T16915AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 877KB
SHA256 28f4c1d865c61c3ebc165a5ed4cc00c441b5a5c8bcd0dff8e919210395b6de18
MD5 3cf5e45738552222365fbbaf99b69e61
SHA1 02c19d75fd859b1d587d165bf17f32aa00c35983
SHA512 28cf5a09408680c06ab2b0d1cbef1666bf740f1708f865ae0d7d4a75a1514ed2f0ac4c1622b9dbfabde3d90ba7f2e567647a90bddd88f8242677c6908e00d929
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaC1u:A3k03kHRJP
TLSH
T18115AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 877KB
SHA256 9c9ef7bfaad91085f6dadb0897cc7077e7518bab55543ed0c06e58b9a94ffa74
MD5 c16d6b67bbec23f95eefe360a96092c5
SHA1 5de6b8ae810e581e008799f98fc36e9fa8d7399a
SHA512 526a2b2ec17a78256cca79e38be757ae2ca0bd4b05fbc68b1f68e913ccf79ebef2a15a4c95d164db1b80ba12a88f2b2569da707f940a9113d535ca600c58bf95
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCr9:A3k03kHRJu
TLSH
T1DE15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 877KB
SHA256 213ba1abb66cc89baba76d3976c5822747fee05bf1ae0cb5f3dedd15fe4966db
MD5 1f28fccd8c843c2f2793fc2f02dba0af
SHA1 0eb99d46d212835034181214222b8292674f662a
SHA512 4b709ac0c43e677451e80f96095d65678029229c667ac7493618f766cda8ca626b74eb217de4080a9f192b200eff6893371461c29cd5b8b7d522d59b0271abd1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaC3c:A3k03kHRJD
TLSH
T11715AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 877KB
SHA256 97504ec2fee1eeaa5a10d9cf30046567bb6d04bb837753a28cbd98927f431b49
MD5 d62c156b10ecfdca2e78b5b47d78333c
SHA1 8fa38cc9ccf7ba563397125037f24f377ac06e75
SHA512 39ae3990483103e84c1df697a7044d21e081166659c0fd95c216bde3fbe9bcc09450633c40da98d5825ce378700d6abf55d744d57006bd000b78a683433952e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCAp:A3k03kHRJB
TLSH
T14F15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 877KB
SHA256 262ffb4bb3eead9fcc5f8c1a552eac017cad5831352a91091294967f2a37e31e
MD5 4b21e2de17bd74dac3a576ab37bb1c82
SHA1 ee17f166fa963983f437947aadc01f3d1416ca9b
SHA512 c4d6f049b54389097c8f1df499ad88cdbf7077001b675858f2d6e9c07916acd46281f63c6c714e003948546072f7de5ee4e0ab81f8c0887ea6565755ea6dfb25
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCHN:A3k03kHRJa
TLSH
T1EF15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 877KB
SHA256 c5b93912c56dc2e8712714d2c12afdaaf253415972f16ae8dd03e749da661f75
MD5 853759e9032e6109a2537737adef3c51
SHA1 197f010c88b3a545c7576720dd981ac45d55555b
SHA512 efd92afe79c9666abf89aec282840a8b9a4b661ba0fe52244e5ca4e99c7e6d32b3cc7e8921d0d3598cfac4b7aac9e09d27056e375b3e3326864a9e4621dafd4e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaClF:A3k03kHRJg
TLSH
T13F15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 877KB
SHA256 43f8a6149be92f2b4f7ee597c96dffcb15c4e76b0a1729e65b3c62d54a459a66
MD5 57db663711348ae24686fc13314a9a5d
SHA1 476f86308e72b3978cb8d64613ad98b4e2496518
SHA512 c56d812844bda205b7fc47b52847a779bac811b5fdb57a047e7a4d94935f2c49d7a83902288dbd033b1e6904bcf0d40a647add313fb2b4c3598134ead3c4642b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCGC:A3k03kHRJ0
TLSH
T16515AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 877KB
SHA256 ec6da27f7bee0b0b3b46c32c0ee7fa5671ffc1212bc26d31d90d1de868599b52
MD5 29344bcfb7eecc9e5f4e728cbfb68cc9
SHA1 b06d0737678b3d2318f8ba68e5d2501bb39e8d50
SHA512 fa8c0bf60a421eb32d8dfbddd7452e26e58e969828224984c44006a4f7265c973b4bf5477618845116e04da2fd95d74310ac69b7eda040d98faf4091a3234f20
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCJw:A3k03kHRJJ
TLSH
T16A15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 877KB
SHA256 5ff0fb217154ca1dcea84c1692bcf050ffca0d4ac00742d17268fbf037eef8ac
MD5 6f03df12955cd7afab3683f622b8e75d
SHA1 bbdfa9ffc43f45bc4dfdfcd3b4321305543edcb2
SHA512 c34ef03b51c43e95dd3b221503341c128bfaaad311b63d2e8c4bef8947ca6b9968dcb374673b330d8bcbf75fa9c6789dec781146f3cbfc0b243b6592b1f01fec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCQT:A3k03kHRJ9
TLSH
T17915AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 877KB
SHA256 f3444dc5c8fe94bc89438fef64358b7cecf495dbc57e3a3d844c0fa7bb04399f
MD5 abfc249f7aa9987ed6ba1ff2d3285d87
SHA1 6e2417dd6c8810f85faa368c37c171584a6ebb71
SHA512 d1cf06c397c17d3884a061db9c373c1399618b3dc365b37901de3ef9dcaa45fcc8c37ab59ec0d943c270c8cd86af3f3ac9ce547b42ba17a208286cfe869f5fda
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaC8u:A3k03kHRJC
TLSH
T10215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 877KB
SHA256 62a364460439cffcd4d13aa04dafb38d048bcd1ce25d004ef97714d69e489808
MD5 d0407042ec33cd4d1e43deefb73e3e3f
SHA1 9dfd6fd44b038e32d4ffe9d9fff9c58bc50fd583
SHA512 a0558d622f76aa997d727bca696a32ed29146a13f1f62441bff9e1af2469affa52f1d807aadca484c4d0e531adabf8e9afca49a9912b035f0c01e48c2e0f7ddf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCab:A3k03kHRJz
TLSH
T11C15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 877KB
SHA256 b41a80b62a0c5a37e4cc3b664a4bef6c38ae6c2347630fa36373999bb27d974e
MD5 af31900e916a8c1e05dda1d596f04460
SHA1 77099d48980dd813976aeda255f652c9c495ce27
SHA512 521a66b8ba9311103f692621b12190e59fbc84ab20c11d80f1799c55ea28183cc1bb549c0a47f202d7b985d71e6b880eba5e1589d2f0567dba0e9f04c4a7569d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCcf:A3k03kHRJr
TLSH
T1B315AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 877KB
SHA256 afaab7cd2aee1b704fb31afccdd78b43f79d57090331d0868035f12d29618e18
MD5 1b32156182547c62838b50403bc7a3a7
SHA1 b58450c8193657df5451ef2c96c77b634872b971
SHA512 5ade18513f2a3a5d1332f730569ce8c816ab8905bf0c6bc347a07c38b0d9e9bf32c648d785a055fcb41268302c654c6f8a441f3bf28978f117d341ca1f03e312
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaC5K:A3k03kHRJb
TLSH
T17B15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 877KB
SHA256 c15fbe982fe612ca4bd5f5c60dcf1ff441acdd03055affcc241b92715f7f0ff1
MD5 df5a13c33283e50f2ddf5793feb86fdf
SHA1 054c3dbf1034fe80700cd77b7655ad3ae16f326e
SHA512 94ca0f30de8a47ec03d7e744d38879a6049145ad3eaba97a895885d7f8e310cc43886083cc6787fad0d910d567139c6b0ac47da0dbf8039ee10a3e58b8802826
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCik:A3k03kHRJW
TLSH
T1A215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 877KB
SHA256 dbc961d1be1c35b0ff98c422194cc03bb4d5384465f5e9b0cdd1d4590d718033
MD5 3a6ae65a04b5289972aecd07258b17bd
SHA1 91af454fed2e0b46369a9587084d552068038cf5
SHA512 0383c5ec8061105f25903604c3b3a4c53f768bb8d70a6749de32e7e6ba2aa3f57cca5a5dfb684fb3fd408884a11bdfa091a4f8d04d80c5250f98d1759c20a047
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaC30:A3k03kHRJr
TLSH
T10815AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 877KB
SHA256 704dbcadb618c36ca3018c9ad93d1a21c2f58d5f46b1a019c5386ce5a726353a
MD5 0cae9157a66f9899c784f3bf0c46d5bd
SHA1 13681a4407ca46c1dfe843a4302f7c7280b0549c
SHA512 af17b64ea8f32a4c6cb9a53b8d9cd8cb274a5da90eb73745bf10633686212212eaddebe6d15df357268da6b8ef930739daa744a60d983d48ced35c81328e658b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCmg:A3k03kHRJe
TLSH
T12D15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 877KB
SHA256 0afcea1394a46f757eb13460e6347f107868251faf33074800c2be010015993d
MD5 2139c2f744dec8be43bf240fab49a7c3
SHA1 d991161008bea9657cad41013b274b436bf894dd
SHA512 8d11f556c06b4e6ba0f075e5d396cebe04a9b4876007fb847697496144d9cbb9e324b0593b60e4cc3d5030a02a5a57664121a814e4e9791d02e209f67a181f07
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCvr:A3k03kHRJg
TLSH
T18A15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 877KB
SHA256 44a70fa2798e98892826f79aecd5daa3a971c630766eea28ed2ff53ded1d099f
MD5 85679223137716d1fbeab8b3bd27ee89
SHA1 8a58a9577af9b2c9edf68e2730dcca28ff46f1d7
SHA512 6b21ac690daefae4838f5acb8152c302f8591a948c7bace6e7b106383ac7af2ca23c2b25121b5f0d85ee741bf46bef4f8ec9b55865b2acdff7c852064255a604
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaC5n:A3k03kHRJy
TLSH
T1FD15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 877KB
SHA256 a4b2a293fef000e7a8055c15c801f84fd4e9b42df46ea11b9b7c47daa79f4cd3
MD5 2f95682a1981553f44bd1c0cab7e735b
SHA1 74bef9395795bbeec1e463bc6e55e0ee51eeb895
SHA512 19872a72aa2c9cff1107bae5e37f2e58affbe2115907fe3775e1df5d8eadfd8b57dbdc39a850ca22a7da0b2c7d96d637fe2ccc47b7df2eb3ed6392c0f99cefe7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCVx:A3k03kHRJA
TLSH
T1D315AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 877KB
SHA256 c35f360ec99ece8d2fe997ac320731be1b4a17d3bca7e87c0dfa7263b309dafe
MD5 ea90d8f5993a23e992c8eac6d896d5ae
SHA1 da8c008779bd791f76bf5460dbe30c6923b99b44
SHA512 3280acf957eb90e21e412f620c85331522e4017ec0c5ebf86e7affcec945a051ea039a222e419c6a006b03b72170f05ba4b9f4dc18fbdd77703b691daf6ba3d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCLA:A3k03kHRJj
TLSH
T15215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 877KB
SHA256 2a1a4a96718a14be31dd039707421994db3e0d9d3282173603cd7a2f4f0f66bc
MD5 87ad94e07f61e77ddc31bd271aaa3c60
SHA1 d5ea16a2a6ab06012698157a2476fd2108b0d4db
SHA512 af1d1b4c2a436fca0407f0c35ad97a3e63583df792b906f3606bd8efa1031f5144e2774d26cf8c4223244d4ccecaec938dbd4678cb3e4b3855aee53e9f20e148
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCc9Q:A3k03kHRJu
TLSH
T11A15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 877KB
SHA256 9c2c53e0fdbd234a28a87e5b9cf2e390e4989421684b9102cb448dd855f87c74
MD5 d55465c48b90acbf58e40abb1c23f255
SHA1 a15e2f073ebe2c412a55d33d544b104ca27ac258
SHA512 6c3013855f7f97b8cb34d2f59e46afdcee63e8a109d31cc57462004aeadf747e9fe53a958481eb89d307e33630952dbf5b4192188ac3b9ba3c37c313b3499bc1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCF4:A3k03kHRJN
TLSH
T16015AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 877KB
SHA256 b9e1297800d28ac8313872ec0d9cfe1e669a4329e80d121b54c1a2b240a13e24
MD5 6ff3480bdad48fc241728d7b1c13b9fe
SHA1 1d36a54836e5b42edfda78f27e26c2a60d1d7898
SHA512 8aa55f4a21cade68d6004fbf000ec14b13d75169f19b7d5b48b8dd44a4ef71ca4639c00297c4c3c98a0de383ccc2b68d032b466c5dc2f69a64cd3309747288ce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCQu:A3k03kHRJo
TLSH
T1BF15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 877KB
SHA256 0c08afd98fc082f292764743c804c6ab65591bfe4bdbb6399263dbfa0a37bac5
MD5 b1907fc9438c8e32c3f7730716493116
SHA1 f615c392d5bbead655895d3d84cfbed7f140f9bf
SHA512 2b63ee1b5c5499be5685587eb0fe4c8054435f737a6145fc01cd398ce9d4cef8dc05250c57932cd3dae888f11eef3c2a4f5a48e4bb7822259557c298bc137a02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCRj:A3k03kHRJi
TLSH
T1F215AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 877KB
SHA256 8e55670a2e9caa1cc47404c59012362cc34e3f6c28b595312d3f4376fbd1d91c
MD5 83cb1404dfed62d39943e02e0b29ff36
SHA1 3ea8aee05696e750677ed5175deff86914ea23db
SHA512 1e963a40c4820fcf4f14f6868881c368394857dd2303cca8539854b586f27a4a8aadbdf0860ce26d1afa1d7f9d1598c29905e24ad4d1d93a3b088e8c7c41e977
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaC4g:A3k03kHRJm
TLSH
T17C15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 877KB
SHA256 5bb1f764344495e1ac16814b1fc22afdbe8ddac10025e0b5ae6a38209e2647d8
MD5 c60e49de4864db4cc2b4726e2420b159
SHA1 964e90bb950bba31dbd59ddb873d485799c0915c
SHA512 1fa8d05e34b5c235d69f5513195a99ff488fbbb131964ceb90d4272299ecabe4e740245a0ac294a9844023f070a6594e638ab5f41e5c87807b70ac6077b367fc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCXI:A3k03kHRJv
TLSH
T12415AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 877KB
SHA256 1725d0ff05ccc1e3ed9f8c53f06f8317c4d3f6e6ae65b05c50cc73742bbf1016
MD5 ea0e2348c1cbdf4b846915ba45aefcc3
SHA1 b5434c6be4a2f1b260f70a75f80022cca59527a2
SHA512 f59b625d9949ec122179d2924494cdc0abd60d969db8808d270435838fb8f4bf814a863d449ca8140414ebca64cbe44a07286668f4338c3cd0d396923325e3be
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCdo:A3k03kHRJZ
TLSH
T10F15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 877KB
SHA256 ee877a174da4f4be0f3be0f9e52e0216492f3e5fdcd045a8f7c06c1b490c4508
MD5 c71fd0386a7d65ba7d416a8664cb0fcd
SHA1 b68793931b80c092bedb816f631be8c9068aa653
SHA512 cde7ccf2a9a0ce4e914dba4f00e0828a750d60c307ea175243c5f5b15bf6f47689b2655375a7243f87eee05c1822aed5f7bad5fa0a88a3690269cb375258e2ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCO+:A3k03kHRJc
TLSH
T12915AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 877KB
SHA256 8da131a866b0678a412ca88a5c2961a38109c0a4a475b796067a1cd7e04ce1d3
MD5 2b273b50f33caaa74c2e64b508b73804
SHA1 37fe4b70bb9585be16dbbc4100a9c76bb9922a63
SHA512 d0fc4f00ecb3e75711558b8ad8412ae2680f3a69b327681bae99945d5bffe3b19749ee523bcf35c79a39e3846cc8f751c253ab1e87fd80ed8f3c8291824f151c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCOQ:A3k03kHRJ0
TLSH
T15C15AE13EB9500E9D10AC1749AD68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 877KB
SHA256 9d7e93c3f7a0ab1f41a160ff4a71e7387b9f1d71f1da998ba3c4ef51289f8b1a
MD5 53f6998c0fd47decc705a2a2ce283190
SHA1 dc1ede7bdbdbb9f9e772ac1877b812dc5aa9ffbe
SHA512 47eb8d3d78468a63962d0797c9defe2366496bd6fe154f388f018369b50599e05939506e9758650abef93b3dccd3caa5b3056c28ca80a1fa18ed714a15775ec9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCvX:A3k03kHRJ0
TLSH
T1ED15AE13EB9500E9D10AC1749AD68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 877KB
SHA256 c02bdaac19321f57fd57047517255e4313f541742bb4a411d6921be16b3f3f04
MD5 ee29234512cc9bdaa73ced26bd8627a2
SHA1 36c3e57293f7f94c0a703964e8e161f83582b599
SHA512 a2615f37783f17c123229fc410c7dd4969e645e6553492e0b1fbdca2077526ad3002eb6b6f9df6add9bcb0610c814c6c54f3efe3f1c4cec6666eb78375b62559
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaClL:A3k03kHRJO
TLSH
T15B15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 877KB
SHA256 8cb281d46d54ec7c984cfe0b57705d03ae46cc522b4b2e5fd81c3bbe3eb6a389
MD5 8c9e28e20287d0652db32476c24c7235
SHA1 bead48b73c0b5a7ba80cdc3c0b583223110ead57
SHA512 4d89d12543af59cc7eb556b7c1cdf4162db5cf2b1a2d80c868ff435d7117e54b3b343a7d2c017880f382d5d3867f049919e8ff3db50cd3ba4603b27bd70aaa6e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCDM:A3k03kHRJ7
TLSH
T11A15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 877KB
SHA256 45e597a9de6db8a30f960d04f6afe6898b5d4b6d5c65f523cc55a3b8f24d412c
MD5 3375ab4f34b5dca12ba0f2a52af29034
SHA1 4b95016f7e63f80dc6197688959d34e9252b3493
SHA512 615fa9f64000a26508a2efaf8bcb5848d15914ef411fe345830dadb8fabb72db4a38229118eea8709a566b1f86281b0bc4a708f985402e12c7f2ce545f8a8d42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaCEh:A3k03kHRJ1
TLSH
T15115AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4604-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5884-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5884-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads