840fb64660b47b632d5559917b9084e0414062b4b5f557ea947a3e3dc3800731

Analysis

max time kernel
86s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 853KB
Sample260710-ddsgtacv2j
SHA256 840fb64660b47b632d5559917b9084e0414062b4b5f557ea947a3e3dc3800731
MD5 5d000832cbb3ff71afd1016040143d7f
SHA1 5284a33f488be0b32ee69fcc98854ac65b042781
SHA512 efaa96cb868a0b42b57c067f2f5d76c154dc40a7a7167674a679ab93336d26e03b51452656c96610cd0f80c4dfd967e9162958755c6a7fadc638b2ff4e9f4e9a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxN:A3k03kHRJ/
TLSH
T13B05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4448-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5d1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4448-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5280-240-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-416.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-483.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-703.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-912.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-981.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1036.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1092.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1155.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001ba9a-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198dd-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1397.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5d1-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-39.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-215.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-416.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-483.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-703.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-790.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-912.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-981.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1036.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1092.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1155.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1219.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1373.dat	aspack_v212_v242
behavioral2/files/0x000400000001ba9a-1380.dat	aspack_v212_v242
behavioral2/files/0x00040000000198dd-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1397.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5280	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4448	2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5280	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_5d000832cbb3ff71afd1016040143d7f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4448

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 853KB
SHA256 840fb64660b47b632d5559917b9084e0414062b4b5f557ea947a3e3dc3800731
MD5 5d000832cbb3ff71afd1016040143d7f
SHA1 5284a33f488be0b32ee69fcc98854ac65b042781
SHA512 efaa96cb868a0b42b57c067f2f5d76c154dc40a7a7167674a679ab93336d26e03b51452656c96610cd0f80c4dfd967e9162958755c6a7fadc638b2ff4e9f4e9a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxN:A3k03kHRJ/
TLSH
T13B05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 ed41117875a8f97be29919d273f487e85df75d672bdcae78bf8473c1eb7f1b95
MD5 f924e5e306c7de6925d0201df1c00f90
SHA1 401861cb1cc8c9746214a6fd4a78cbeec898ed92
SHA512 3623408b1aa00f1a3a70ee393003306d587787dc2ef35c0bd5b49130fe8a16df3bc5ae9fc71227138830b04f76f5c47de19d11e8fece5d0f7f4b854e4cb8373b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxZ0Le5ji0hmxNrM:A3k03kHRJrPji0Aj
TLSH
T17A658C17F6A402B5D067C0B9C5D6965AFA7138821B3086CF1399C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 868KB
SHA256 8dfe7dcf62c6318b672f419963ec849b6c9c33f96fc84ba045c4ba730e017898
MD5 6588464f405748d43446223317f78ac2
SHA1 3508b4b4042d51fa873b963c1c85edea345e5abf
SHA512 2af1781ba316c32d45e4f910075b72620d9f5e66571b00034c9eb06a89968f74ee0bd233239674744bc970be4732d2b640ed87ad3a935d9e52b1d355ede762a8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxLa:A3k03kHRJ
TLSH
T19115AD13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 877KB
SHA256 9264c661c0d7ae6b1fd9825d1f006e72a43e30a7d8897393bc8de9e4e35f948f
MD5 ddc634e7f9127ba3f355c5a329eb2b2e
SHA1 0827f2c672d488d80488cedf4dcf616bcbd56bb4
SHA512 9db9b85cc7dff6738d7eb7c5820eab0f80083b0c2a1f387d0fbd8abb9f44148e78b382035aa94b1223f1c75ce02f8a5c1f48e61121bdf6cdb690af09afe3e217
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxK6:A3k03kHRJz
TLSH
T15E15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 877KB
SHA256 07e520c1de2a0d0410d6a91bd299c7b49c10ca7fc94b53441835c666534a1e90
MD5 4d2c753e3b4feea108df437c807f52a3
SHA1 4dbb9ebf7c665999399a0c24eb111e1df1e07629
SHA512 48cc9bd4e4b996c8a0aae8fa8fd4391095be0fa5f2103c4dfb30683050b062404751e2f5a080f06c8ebe4427c6140c21dffe1eaecaf7d1080f74b23f82312d3f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxiN:A3k03kHRJu
TLSH
T1DF15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 877KB
SHA256 153bdd671ccc0c89ff7bafd8cbc925740d30da9fb7ad059783da44d571d8bfcc
MD5 952f924e70083164fcaeae49060d4b04
SHA1 032eb9cf651c11d124eb8a3655f2d0723fba4320
SHA512 1df95efc494f0579654986e6f5df89379be1c36e8a915e32eaf5a82e5f555da16ed806141ac1d7be016d78b00ab3119934e71de6890fd950364c3a1370144b4f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxYf:A3k03kHRJi
TLSH
T18A15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 877KB
SHA256 053ec398fb83abc411ac332159d34cd76e9e235e2071bc4fb95957f951f588b9
MD5 23cf4477fa78c80e89f5eed8e9c5ab47
SHA1 05ad35b58a2fbb5cd84e0b7ed5f1a86a188481c0
SHA512 b53d88681ecb6a90ad19e94851ff9d87084a3cf08fec6a5dfa1a7c2b3aab96a3ea536025f5ee3edb24aadff5ed20e21329ac1d533cc5c6e1a9e00767c58a9cd1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxyo:A3k03kHRJr
TLSH
T1B115AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 877KB
SHA256 5dadd89a537cbe89a47b725349aff1d77ede58661c2291da8c97e9384a6656da
MD5 91bd0746c73643c2e3e2491fe31b2b3b
SHA1 597b029b07a8e93b85d0a55e439b991a125f5dcc
SHA512 10de27a4518a9444800aa82f61cf1fb28baaf5f60edee2b1651d8a374cb3d1c1454f5322bf43df77a2eeb56857f15348db4385d43b98c8e193f68d3ff2575878
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxmu:A3k03kHRJN
TLSH
T12215AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 877KB
SHA256 26698aa9a7106ab03c8f6f383e0d8682d7be01e3b48438f779cea62371611805
MD5 04c9bde0ff3b39adc677f144b01d1a8f
SHA1 974795f29a1999a209d1439abd6bc5e2488cd442
SHA512 fe52adc25874ede39c55536f297bd8fcc774485b8606ea5385fecfe7426a2845db51c1e9a6dd874d267adb61e37751eaa3a595cd0b19d3836fb4844dca88f640
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxa9:A3k03kHRJ4
TLSH
T11215AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 877KB
SHA256 cc486484348f88cb9638d7150ea345155abbb172d63d249a975c2758c7efe4a6
MD5 2eb8cfd1bea9912d80161e9a3a440108
SHA1 9dc34e462be40e7acdb3bb63b755fa4d6e83d749
SHA512 fa3dea42523f0af7a857be68636d7f852092d8aa1f215305aadca1bda85c858291e1d3736374825a3541cbf6df70b76b12910fce3f96e8f0ca584f2abf04a409
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxac:A3k03kHRJ5
TLSH
T18B15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 877KB
SHA256 ee16f4f0094c6538ec8584a4061e0c1ec9f65b2fa539859f5c434687b367c384
MD5 0e5d931b2bdbc581879cc2633e28b76c
SHA1 2598be80dcf8629b6088f32a9b1f807c221f8c3f
SHA512 f4fb3b563f863517c342c909dc2cbb9cef52a3e9a85a212b341b2c5a09fe959eb055b5315b36d2162bea6ca3780c27b1238226ee1a8986770f88fbbd8d6e8b8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxTp:A3k03kHRJ3
TLSH
T19615AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 877KB
SHA256 cd28d267b072db3fb79614a8dea118ef37da1bdfd950da6b907b974f9b47c822
MD5 4f9365c84b1f95928ec077912df85e37
SHA1 4597fe8c6d233d3bf26b694e7c7e40319e836d3c
SHA512 ec649c92d50f81ef741f991538f5bd142214f1c518e4d8fd7d54b75a202f9387645973dfdae3f21f7604e92ee58e7586bb1b40e9cc13e214f5fca13ba4585d5d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQax0N:A3k03kHRJc
TLSH
T1E315AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 877KB
SHA256 d16254d9bd76be32f2e87604482b9de8735109dc5a36ccfa239c743cfc5f59be
MD5 028ad67a88bac4e85f7996dec174b9bc
SHA1 644ab9eaf2af2068d9475b5fe4c696390c2f59d0
SHA512 0b66d629fd54410ff4991739386ec2514a9fc7e7b3ca7cd9b22d63c6df19076e1c8264da5411cd91929909b57de5303633c074ad5f54c1d2ae4d680403036f94
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxcF:A3k03kHRJq
TLSH
T15E15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 877KB
SHA256 7116af2c099b42b8e4bcdbf575e7c7a86dc4f39181f9f376b885c7a8281d5d5d
MD5 87a27b14808de86f652883a68e168af3
SHA1 a54889ec0f19f213b517bc8fd03a949a13861890
SHA512 b888160e6bbd23e1c2ee955565dd5e63e3bdc648fe9a509aa791e4f8cf8c09085e568d2ae6e1ef87b6fb990cbcb6b31bd131680e04b59bdfed070783ff15ad5a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxJC:A3k03kHRJ+
TLSH
T14215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 877KB
SHA256 5f39725549ccf062cdabed861137c4f2c6e0964023526701a38afeb3d2ae17ee
MD5 17c85823fdc13a519b86eb9e8acee963
SHA1 994d4d1fec2543b7dc3c7fb4362f9a6d3cb79eea
SHA512 35b91339572367e06660b76986db5cfe8905d7fe234a5bf5b5e7d0227838ad8ff103ce1e77edf78d3629c02a07a4404a0de5a769d152715b38eaa2902281c386
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxqw:A3k03kHRJL
TLSH
T19115AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 877KB
SHA256 7d1e5256198ba9db4720df17320e4f65b879d85a26decbc8e672ad48dbf99be2
MD5 a068b6393c36cce8bf2d01226ee1f616
SHA1 06499caf8f2bbbb79babfa948e155208ebb11e1f
SHA512 8be814cce07d68c92aa46361d7afedb3e0f89277805eaa99b7c314386defa9f64752f47d5c2743c68b5205f773aeb2fbcb56748e6cb41726cc85d0b2ef3bd816
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxxT:A3k03kHRJ3
TLSH
T17C15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 877KB
SHA256 8f7c523fa849a64c7b23606c4ea6d0a37b68455fdec902897ab9ccc80fa381e8
MD5 5659bd8da4c4eac099e9e96788f0f23c
SHA1 4a98a6678f1e313cbb02a78d25f5d2c190500466
SHA512 fe7d11c4b5e2e5ec8f7359a7f4f89aebc3085449f83b07dd7ef2b0420a758dc2d0dd040d1f6dcd30ad2d698ba3f0651d47d50ff2066309bbb4d757d046f5e316
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxfu:A3k03kHRJ4
TLSH
T15415AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 877KB
SHA256 c07a0dad8b2dfbf210a4769a033147e7b4ed38adb829376d740614534631948e
MD5 399d752f214e983d8096ef37ef79f168
SHA1 21602dd697a06da9d2e1b8aa1444dd3c97400ec9
SHA512 6106788b4a2a12e22990323320c6844fa33db213d405da04e2056dd5696cc87228f4fb6f4fc3ad0a379b9d808a50bc79f5bf38f3f486ec38109536e230d06d43
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxDb:A3k03kHRJh
TLSH
T1F515AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 877KB
SHA256 9b6f63b3282f5f2cd35026635769771235d60d254cc32164876a2b1e7716f5d9
MD5 7e6e431045a916aec890abe10ae3bcc2
SHA1 5bde40a0834a5a61c7e82836bb88e3a3a765d7c9
SHA512 fd52458cd1e471d14186ed8d1e0b3298fe54162d26e43a90a90f5d67f0dc157f5776c0c215e50a920bd657d1dae5eabfb437909a8b0790a10dab7730a5f265fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxXf:A3k03kHRJh
TLSH
T14F15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 877KB
SHA256 d4331ce5fa949d6f614d772d03213bc0cd8fa06ff849bdb356a1361749d8c9c8
MD5 c90e4a467299acc8830a5278a235468e
SHA1 c171de7359cbd0414a215e08326242fbf8ec38cc
SHA512 e9655364db83f3df7aaf859c0ad65dddf3f7d30be758fbf678acf43f4695c26f2671b2b86bc46908dadf75461370d23cdb995a7b824011ea24e2fd7007752e9a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxgK:A3k03kHRJ5
TLSH
T15E15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 877KB
SHA256 7337fa6eeb72e6dccefc06b27c156ef55b0b985de7a84f1484275b275f4248f7
MD5 7edd290e652ed4dcc91beeae3616fc69
SHA1 3869ec82b31356dd43d08d6b687d10c17b6bde26
SHA512 143c6a4ad0c623139890f75afd5d1dfa5a90d3eca5803ac75916bc317f3570cdd2474e4224109de53c4b653f39621b137ff2d936d864dedacb6c3be66cb21b5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxdk:A3k03kHRJw
TLSH
T16F15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 877KB
SHA256 daed91390dee64c62db052da85931e589412f7ba852f18a489aea9e8bf183447
MD5 686d9dac6fe8663d086783ef25af8938
SHA1 142983ca73f87590d69f375324d6b4894919fa7d
SHA512 e1210b6a9556f9c6b3d49d99a5cd8c7df3074e4e65862fe6e4823c3479b2737ca735446b2a3aa7f60e27b8856e9ca8eb94383568a1301f88aa0583e7fbfc2846
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxC0:A3k03kHRJZ
TLSH
T1E415AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 877KB
SHA256 6a44e59d47395e2cd024b1996a06e961b35b3f6cab579998a125cf4f77bc0470
MD5 e27965437e7b76870cc16b43829b6b98
SHA1 144afdcdad294760688a4d387937b53f907fe2af
SHA512 49ad30964bc5cb48e6bd640646dcc3403bc8771651924078bcfd1a4cc7b859a938c8615ea7247f4317f3d59478dd86332a39dbed36b5e2ecfe249509c5ae0747
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxRg:A3k03kHRJI
TLSH
T12A15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 877KB
SHA256 04aacd9ba34f9637392f3291a241cd8e86089a5cd09862cbab41602e77f9d5f8
MD5 f80545cbd1a915101fa7d2ca545f96ca
SHA1 4d33721949ac13f1dd665373a9b991e76c730ea5
SHA512 a5df542b9c618bdbb39b3dcb2fd653ba8543168bf62e8f22bcec4e1b08ef25636cd9ffec9c471c7a0d9478a5f8df3749cb6cfef7df9d62d5c15a5e567d240255
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQax4r:A3k03kHRJy
TLSH
T1EA15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 877KB
SHA256 33a49e03e4bc87ff7dd90b91f08f293f44ba698001e72d24f66d14bcca106cca
MD5 5c60c5318f436d3781f1d2b58b1c8bdf
SHA1 ff4a2d8bc7c1e25e896861e53e9b5ef91daa334b
SHA512 e2438b57de285d9b80d95381256eac6220a899081cbc76e42cdd1012359189b826a23d91427ef9ef69ac11554ad37557f9797eb7bdfcce6687eb57cadb17d58c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxWn:A3k03kHRJk
TLSH
T15115AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 877KB
SHA256 a58f04faaa1545a83b153123bbf75e442b8cc8742911ebb22fdbf6c93727b7d8
MD5 854bb3e106a0909fac816611d75f236d
SHA1 7a986a2c53849be3c7278e1ebf5ae9a5d5cbac7b
SHA512 74ea96d523d1c6beb232bc35ea2f6aac7981d496fe1c53a483c5c4487ca9b97ff5c121b20fa9f1f46318c125fe97b412a9f83b0f001fc6227f415b440415cc39
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQax8x:A3k03kHRJC
TLSH
T18115AE13EB9500E9D10AC1749AD68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 877KB
SHA256 f7887e857facfa5409eaba4f128c2bb8022955b264833f527bb41b086514ff31
MD5 3cf5852649e4a902ae52d1035d4c5ffc
SHA1 789ebbeeff61f90854b87d8740dc6a7746d3e0d6
SHA512 bebd59bf6ac011a694f220da5ab79e56627c86dba782ec06d3b208b3f27dcbdb65f6f3d36f3408f12b4a36e4cdb1938d00030e16c0156c26cde5f85f516d4c0b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQax2A:A3k03kHRJh
TLSH
T1BC15AE13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 877KB
SHA256 5178afae3f70dcd684fbede6bb1972a293f3e81c5aab4fad1217520be272e50b
MD5 da7c7ec5c57345ce07bc9788f210f17c
SHA1 c0a483230ab4575244d506907d29faba6aff603e
SHA512 97e29bd831e5517716391f246fb9e0baa660ef2e1e2a5e386c4cad5b3ce7eb9a06aa4768f71ad5a90e2536c8113ae5c297908ab2df67b0d8bb1b53364aa87b1b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxv9Q:A3k03kHRJY
TLSH
T10815AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 877KB
SHA256 8e78e1d131e55cdf58a3a19dbf33b217f3ba4eb27d9fcc8bdbc452f6addf2aee
MD5 29a62b0b9e9eb065c0723c3540e0d607
SHA1 a6ee6e875497c55b9de7a5478c4fb57f71ad1435
SHA512 5219ed73d2eed1fd099db28a82cddf8c19afbd4cdd72608ffff33cf963733865a9f3bc2ee680e2652496a3d402c8b3f1bd847147f9eb431684586ed902f1db90
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxG4:A3k03kHRJj
TLSH
T10015AE13EB9500E9D10AC1749AD68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 877KB
SHA256 fb528b32996c8c8d25143d0df704b12913c9515ff0816ebba3b53eb20d2e3900
MD5 d8b5b37ab71160983aa4652afc43f18a
SHA1 9d4e8eab28ef47e57bb111329d61371b74bc2f4d
SHA512 eb718ee051d25dcd775eb89aa1a20e483944a0e3974622e96397f9a3badcdb1a1854af994961da74a32da01c29300b339846bb3fa161209b1a7612ba668f4cee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxVu:A3k03kHRJG
TLSH
T15415AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 877KB
SHA256 45319bb8c1cc1ac3009e1aac90cfda0ee14b6a8cfa8f34c742dc3ec8b6a3652e
MD5 13d0a2885ac459d088ed5400711e9c4c
SHA1 02457549745fa563ee4da64ba7d03fb99faaa77b
SHA512 f4e636d8c8f0fbb97ab99120bfbc88ad82708c5d0137bf97763dad87742a2c01e571a38fa64eece0dfc0fa6cae35741d540802ed33f6552ec92ff7af0dfffc6f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxIj:A3k03kHRJ4
TLSH
T13815AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 877KB
SHA256 05541e563283b1f77d07db9c68b56b6783bbf7f580e2c6abfa104ba7e7f508fc
MD5 94f51b1a7fb7b30ee27adfb56b0a677f
SHA1 ddc8f670b648820cdcf6442ed92e22ef14718ca4
SHA512 54052c0c9ac0ddfd3eda276387399bf6843dfac74d52a1d467b1cc272caf151ee82f11c0032dd72a8e5a1015b2c94bc5ca74c4b88f00789911115f0e08dbe26c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQax5g:A3k03kHRJA
TLSH
T18A15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 877KB
SHA256 9072d0b8017a1858a60c6e84ee0af1fc9ede991ca916dbe3a544698e6e8ed8b8
MD5 d4cc101e47164f884fee45e867b68477
SHA1 9eb080ecdd8404db471363e6b8ec1796e7ead128
SHA512 83a92be5b1b272cfcbc83e145de9724f45f7343ffc34d00e7d5b4d0b1b29ef0fb5f8edfacc2915c4edf3d7337652b280020d135d31425c488597aadc7917a4d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxgI:A3k03kHRJB
TLSH
T1A015AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 877KB
SHA256 26c265e8dee6775fa3740d5779f3250e068f70b795bff10b8ae7b46be6ade68a
MD5 3f1c91731bf7ec1912858b6f51a4895c
SHA1 2863afd1bf2661b1cd32b4dde389c952197667ca
SHA512 71300ac1f491304bb968303441a5cc0303c10acc9389f5c4ea34075745e7ccb32d33a757b43f884e30d88c53f65a059220336dd40a157c770209b1ef2f967972
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxio:A3k03kHRJf
TLSH
T1FE15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 877KB
SHA256 44a0868808b26506fb0fc2a3952b30934b46d24b74f62db54cb151e20661b247
MD5 597631f82c1e5b5322792cac5cd7714b
SHA1 12fa5f0b0fc96992b13dc07b9e0fcb61dd13b062
SHA512 b18e9a1d0e8657feeb369bfa0607fdbc31fe218899a76e9517ddfe36116313692164299a7cb39c609154f1e9e5dbd8d48c07b69d74d47c3f1dd929174db127f2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxZ+:A3k03kHRJq
TLSH
T19115AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 877KB
SHA256 e0260a50b4e040bbb853e8adafdd01ec6a9a061bf7aca32797c7b617c20b3725
MD5 d7bb9c26c0705dbd1586ee6be75476e9
SHA1 4cdb89cf8d9fec4bbfcffd54e09aeb585bff6b33
SHA512 83649158c03c9b1954e4d374f8560dd0a1b834714312f7e04f1263ff061b6a925bb440a776e4e6ce04e47831dfbc8e19c97947c251b5642bf1366972b415a3e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxHQ:A3k03kHRJu
TLSH
T13615AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 877KB
SHA256 4b009adfbb61058bd6171be4d4b1426bf6ed4861c8db85372a129009c8909a0d
MD5 139b4006675625b450c7f0166f3451f1
SHA1 c30a6e6ff8ba0c9af50ac65b2cd4c5f22af8ce17
SHA512 8ea657303e9175b6eb3f68de9d2e6962c37ee5301250b3b758e201d741474d17301e24b55bcfe0c3e9c354ca218f379b3de3cd58fd884cc04e2c623a401f466f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxcX:A3k03kHRJu
TLSH
T10915AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 877KB
SHA256 70a563b79848f79eed350c124316dd2acc6ab9fc8e1b65e5900a258d612899e5
MD5 26311b0bf6dfa64a6578a6f05e4643a3
SHA1 03795c2e6daced11d36ad714736a7cff54c18281
SHA512 337ba6f7be371b4043ed112e58877d0be6898e2c862888576cbec167890e77958636f548bb43c50fbc8f87b62df70fdfe1f5f486425e5a8dde633efb860d2e3d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxaL:A3k03kHRJA
TLSH
T11615AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 877KB
SHA256 ef3ad5747611a2b798be085400fb9838cfea4bec69a416d3965e773d23be2242
MD5 aa38e81d5dcf54efa13db9c3ad99b670
SHA1 12d28bf36d91b8e4a2aff0b74e2a98ae0834a7a7
SHA512 5b79cd1a825ac402a1a18c50873a7345e5adb849fa6e0a0dc006a110e6569c17e176ae53ad7ed0a3e05d37076b24b48b80f1bc5b9182712745f250cebb51a52d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQax+M:A3k03kHRJR
TLSH
T14115AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 877KB
SHA256 11e2b43f4c2c7d13c33c8da88505bbfc7499b44da9c924b623d8be81ef226cf2
MD5 e08f4ffbf015f67d5bd90a12a18b515b
SHA1 978a5e78cb341c88185655bcf108f858db4721cc
SHA512 6ff43ce1eebadd9c02ac6028b8785920bb2940c79e1e06abe57a1eea340e580ca199b32e5723f1a79458f36cc1282b6996c2b127277e8f8350eafb452083d85e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQaxnh:A3k03kHRJj
TLSH
T12D15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4448-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4448-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5280-240-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads