d558d55863e65a46142ee27452ed302d8080b44046b7a4a0799e4f7f0ac4a167

Analysis

max time kernel
99s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 844KB
Sample260710-zespvsbv4w
SHA256 d558d55863e65a46142ee27452ed302d8080b44046b7a4a0799e4f7f0ac4a167
MD5 3f1ffb9f0ff9085738a82e90b9e43b48
SHA1 3e6200ddab3cd7979266cd44e1af08cf9e4bf740
SHA512 27cbaced923005643e000bf4762cec4ea974903e9d77f2402d15fb3f2c7b4f2defd61e5c38b02354a2a749b265bb1b45cd61754102db0406127a89ddab5e668b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFb:A3k03kHRJ
TLSH
T179059D13EB9500E8D10AC1749AEA8A23FB757C56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4660-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c503-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4660-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5644-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c6c-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-426.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-511.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-602.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-718.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-824.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-914.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-983.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1044.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1100.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1137.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1281.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c503-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-40.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c6c-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-225.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-426.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-492.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-511.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-602.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-718.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-824.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-855.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-914.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-983.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1044.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1100.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1137.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1169.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1281.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1330.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1343.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1388.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5644	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4660	2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5644	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_3f1ffb9f0ff9085738a82e90b9e43b48_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4660

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 844KB
SHA256 d558d55863e65a46142ee27452ed302d8080b44046b7a4a0799e4f7f0ac4a167
MD5 3f1ffb9f0ff9085738a82e90b9e43b48
SHA1 3e6200ddab3cd7979266cd44e1af08cf9e4bf740
SHA512 27cbaced923005643e000bf4762cec4ea974903e9d77f2402d15fb3f2c7b4f2defd61e5c38b02354a2a749b265bb1b45cd61754102db0406127a89ddab5e668b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFb:A3k03kHRJ
TLSH
T179059D13EB9500E8D10AC1749AEA8A23FB757C56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0a1ac5d58353d3780d0fbef51ca2aa0093b4565680c90b1ce43617a38260162e
MD5 addc4697beee55465cee0587367e79ef
SHA1 fb648455bd475ce6d8aaddf5cfdd9b2c8cf5ceed
SHA512 1248778ebaf56a7e8da80192c6fefd01fbbf5817afbd5771af8e46e1506c52e1c95d53636affce4cb361570dcdb50acb4c79fac57bcea22a42e807364a469ab9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbP0Le5ji0hmxNrM:A3k03kHRJ4Pji0Aj
TLSH
T14A658C17F6A402B5D067C0B9C5D69A5AFA71384217308ACF1399C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 859KB
SHA256 ed1db00544d29bee3c963bbcc4fb0e545d973386a6c72eb57d9df5312edb36c5
MD5 e963c9272e869cafb5f025ae1390825a
SHA1 1dc53115c348d530984b8b593606591f72644fbd
SHA512 495972ef0eaa9b06bb0e9afd2ecf62e4fe6db3d177b80dae473b2c69fa6cfdd50527d2a311da66ceb1263dd4f70b93d87a277209d39e68398a72ec321260a525
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbRa:A3k03kHRJ
TLSH
T18A15AE03EB9500E8D10AC1749AEA9A23FB757C52176097DF2368D6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 892KB
SHA256 fa8c849ab63e26137003b43f4e044d06ddcac60252a2d69c15d4eca40d6d4b35
MD5 b89279ea36eba853f1b2c986f5ecd103
SHA1 3aa4af264685d3a4d80d59fc42240c27b39cab63
SHA512 f48abb3509bdd97ad4329f6d1657c42f512945f887f6d54978ffe4869606144ae4a47a0b2af447256f6293cdebd4f9ff2a4694982d0604a5aed7ad85192b587c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbyb:A3k03kHRJBb
TLSH
T1EE15AD03E79400E9D10AC1749AE68A23EB75BC56173097DF2358D6152F72BD0AF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 868KB
SHA256 7095d8aa3f018adc8bb40be0818d4dc830f47e16c3de7a2a02b0d76b8a77310b
MD5 d236e681f7934f142d9a002b56e1d71f
SHA1 2e83e557f2f2cc7dfb660fa2dfc22900dc11b1f6
SHA512 c7f0f61a2716e652f94cb1d804138763d49ed9bed1197b252433cfcd8ef4607faf6368a9466ac7f88f5f2893c8b0cc48aab6e8df0329e6b2a96253c36b08fb12
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbo6:A3k03kHRJm
TLSH
T1AE15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 868KB
SHA256 bcf728f18fbd1cf367c5657bae84348db1683947b8ac453be7cd018925db6979
MD5 35c9c98a129c1ab472af332772539d7b
SHA1 1e43da5f7ae2f1b557c3be4aa9775075ca6b5922
SHA512 5fc3e3e82d618dd30278a91e7e0cda9d646a88696adc4b43a6fa4a05c842a46991c34bbb8d2cd96a2caef73a42be89981d4b3faf51443bb9a44478e05f2cf6fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbsN:A3k03kHRJ3
TLSH
T1DC15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 868KB
SHA256 9ac5d816e367bb28b2216cfb10d35ce443aa1e37e46814e35c1dab774a02df48
MD5 196652289a2b75f8139c8db264071de9
SHA1 ff06219632e623edf76d22604be7a6b195a2d799
SHA512 3e40d1448fbd45b1ca8d1323c95676d815380451b198ef10c565675852dd953a219ff3b5e7719c64512bb9dd7443aeb146c70c2af4316267a1ae4ecaeaf71770
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbif:A3k03kHRJz
TLSH
T11215AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 868KB
SHA256 e2a311f6a9e1ff23fb3a36966cc42def667b22ea86165a5c0e1ec1e28b504a76
MD5 8284cd187273741a46851cecf1ccfdb6
SHA1 3c5447d92e8e16b8a7b6641455c84e7fdb5db36f
SHA512 b82e9bc72956c2d77df6ec65d8ddc64bb2e6caf8e978c1e022a1d93c0c4e90af9580f0044a9d2568f5314e1acb53cb5ab1a79dec72e1cf84c15e733a2b57379e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFb8o:A3k03kHRJi
TLSH
T1F815AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 868KB
SHA256 7d0ff8d13e0383e3b374bd5b6b4f71474d1de35854003f43d6aedf57224809c6
MD5 33b37b7eb9c5f9bc2cb7cffe1ffb1c87
SHA1 1cd6457b1cb620764d0b5fee3c81db04659f38d6
SHA512 da9c6a8ab00ff91f3543541cdcdcf60bc463b488f276783b4a19b23b87d09bc338e47fa97fad6c874dc36f7c355ef8fdb4325fab276e895721995f93f1347146
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbcu:A3k03kHRJs
TLSH
T10415AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 868KB
SHA256 9c82e72104037b1d825cd28367d918ec46672e5134d3eced224951141f198dcc
MD5 0bc13d99eea37a8be3cacda3f24ae94d
SHA1 6aa84e13c80b516c8d19492c686ff8a0a13ff5db
SHA512 0ae5e3d178c57c5dc94c7ffd1ea74d066a47087c40c875c91bf7a0747ad2c01a51ae7d63dc1e8c8d57dfc4bcf534a68d145d7ffc0ebca480c9f97e72946a8345
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbg9:A3k03kHRJx
TLSH
T1E7159E13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 868KB
SHA256 edeffd82b5d7ea0987273f719743015e0ed7f0fc9e0a26e953a29d55318c2fd6
MD5 33fb043c85eb94a19fc50c02954cb469
SHA1 f9511d6a7bd2a2e88656d4d1b798e86bb4365d7b
SHA512 d3c219efbf53ccddd9089359993b02018bab42185669f66b612f9f7ebf43ffcf7c222cd293dfaafdcef714aec61266be7f1ec798ca5dcc2d6e6973e2af5e23e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFboc:A3k03kHRJE
TLSH
T121159D13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 868KB
SHA256 e7a739e01e4eba86894a32038a6849c407eabc262462e2ed6a5f22f52940a598
MD5 7de0c6f318024c1861106dfc1e6d52f1
SHA1 2ddb61b7eb94d395582e98047a71d0fe58d38ad4
SHA512 162b254fd8b0ce7b92961fc18c41738edc15fe31e4f6ce702f54805dd02105ed806521de5e4eee63f48c2e7c905f24e867a1d049332d8d5914ecc869fcfa4653
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbBp:A3k03kHRJS
TLSH
T1A8159E13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 868KB
SHA256 5543eb12dd187199f6ff80b87c1991c264682666be3cee22077018f5fb377524
MD5 622dd1c5b68f99071c0b48199094af26
SHA1 bd37fa360fa3d1d183fbb51623338f6b88ea1ef7
SHA512 715d7b6a7518a414e456dcf251e4baac3d82ba52dcea2aef570015d2ca73bb5be21d203684b04598f7606bc3b1a36e5c920a34266ba873b81135e868c62a56d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbWN:A3k03kHRJV
TLSH
T1C915AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 868KB
SHA256 54f78f60800addd7961023eaad17a337056524d08f1e1c848434474b77b3be21
MD5 c0e44409ee0af51c053904530da1ee36
SHA1 776d2aacd35414360e039a32c4d0568d1275a7b3
SHA512 8ad6d2158c80325586ecb381d7e0b8ce14a268ff5fda5e122eb8552ed5337f8a1cfab4ee176536dce549bca908cb1d1542d4f1b4febfb39861772aa239c0b80d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbaF:A3k03kHRJf
TLSH
T106159E13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 868KB
SHA256 a6dccf1010bde548782d50f0d7de292b02f2deddd14dfee7880a91dab7aefd4b
MD5 0bf1724fc627b40d7daa450e1be4c6a5
SHA1 6a1e101de43f13ccaf3499d7fd742de85586d96f
SHA512 6f66bb7d690a916904eac7b6d48ec114682d005eeb5488ca31b674c57c5a7caf604a829f738448bb4848cefc8b12e1c26c963812bf7f884a36b48eeb571eab5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbvC:A3k03kHRJT
TLSH
T13615AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 868KB
SHA256 d092f64afe642c3aa73d89253d0890adc11ab793dfa38b79e756f8991cd04426
MD5 9ed1f272bc28d883c1e51178879ba306
SHA1 5acf074ca3f09d9c5027474d76c33c90bd65bdfa
SHA512 926b24814840e18a75ef28ca63c084ec4b2069da7f4cd39ed65c1f62a973e0a695e4ed9d0ab980b62c032f34ff823588fb4bc2997e5f4c827930f75a27276603
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbQw:A3k03kHRJW
TLSH
T1B615AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 868KB
SHA256 22dbe21629930e1b30deb2650ae30cd083afd0c97665d47a156e743ea77adb2f
MD5 fc2670bffd2c1141303db7bf3f50d25f
SHA1 68ca944b04fb7a0284ecfc255b5a0d8b2f40a654
SHA512 00d7526f8e8a5204570e348815700161ac8366cbb36d3621d2a9fba0f9baf4f74cd582d7b79e83c70063d0d59d148de5739960d433199f47eefd083cd07d30ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbvT:A3k03kHRJW
TLSH
T11415AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 868KB
SHA256 b0f3b2b041cf2e2b430bc2b80e05a8f2459478b387b443ac8422fb5fe8cacd16
MD5 c2766d0f0c5e474134aa01cae4937ac6
SHA1 c545dac80f0b53aa055e05135d764bf7ad819b9f
SHA512 ef20cb3d6169b74ae634320218f0b244017f61023d45b0aceabb53509dadb18cbc782ba323553bc19177f391f59600982535adc36f2b874a78ddee44d859eba3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbpu:A3k03kHRJx
TLSH
T1B9159E13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 868KB
SHA256 a89267f3c879ea177520074dc47a752bcee1658c119f3333ff08686cb4bfd933
MD5 d849a4518502b6ec6d02a8e904fc3823
SHA1 74a8bc1cd1875e20498ff0d6dedcb18aa92931cd
SHA512 5fd48c1fbd094487d98b5388fe5747a66d9e39ffd25e08d7c2a2a71233e4d6c0970b94454c2d8d77199c28a2353d0d2d0e0712d6ddb0056a7d4e84cbed58b474
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbhb:A3k03kHRJQ
TLSH
T13E15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 868KB
SHA256 b0fd482a64b70b0f13fd96e59a877be5041e675598b92857c2992a3c79d72dcc
MD5 e500e473ee443b28c7e4bc7bb6ad464f
SHA1 9cef86fdfb6676eae8270bb3258e173f2bcc5766
SHA512 336e9cd92aa8659b10b4e80f9e20bfc4f1e2da124d38f1b721a471482ecf7a94999bec868a53ce72428d03e7cb8b293a133185e019c12c7ae6fb9274bf719c79
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbpf:A3k03kHRJA
TLSH
T12615AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 868KB
SHA256 70a7bf5202af80e91b4da568bf02a94d20b14e5505f9d23b9f3913521507e24b
MD5 5de99b8a31eebb7bfa4f01f38f765e9e
SHA1 4e27849dffa2627dddc9c0bf57521fe1f338ca3e
SHA512 eaee37f284632805a00886e32982d39ca8b790574b28a39461ae3b2a92b8ed4fb7653eff57decfb1fa911029acd72fb9bbe5af0c3bc871a4943b6b0796362de0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbSK:A3k03kHRJg
TLSH
T1CD159E13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 868KB
SHA256 d5198976183c5d3576cc7822b16774c8427801a9585a786668f7e9df696ddbc9
MD5 9c9b265bd448f885a97ec8b15e4ddf9f
SHA1 8462c836d8823c281015bd3428f24e43ce526874
SHA512 327be839202b1deec09c4579428a382c31d8ff0deec91740beed552ed3fb0ee9803dd28ad22986b848fc379fa34ef09e008eff365aebf848e51904d5a3e6c820
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFb3k:A3k03kHRJJ
TLSH
T1D315AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 868KB
SHA256 097bb412439c08d15d26a91c69846de0ae79873480ab1aa13ab01b15077c45be
MD5 1afdb12c5cb7b8fbd8a9074f0847a77c
SHA1 0a2b7638743350d1de713d555b63711263d92805
SHA512 f4b380308717b59c28753d6dab3d9a0502109e1a9732139a189421e05c3417f0b7aa3066891496d90635998bb338d96368347ead7dad75fabcce04c6bb9c5ec9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbA0:A3k03kHRJ8
TLSH
T19F15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 868KB
SHA256 3e115fccdd75a2c8440a08db05963e3a7c4703e8948a03ef9796fcdee6426080
MD5 4f7faaf31922e7dd51c6a4933445e3cb
SHA1 71d55c69c6795dc58c06cfa4b2b2f8020a71bd4b
SHA512 b43db42c551b0ed52293dfda6a2b963e9e8c91acae48ca80c5e44c4489247bed081d40c1b424f2b8e89deb1230c7158b32ba56730eac177122e8a7513672cfbe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbbg:A3k03kHRJB
TLSH
T11915AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 868KB
SHA256 5aa4ba431eda5f9429512a4d73552439beaa914abde94da432391373101bdd3c
MD5 5b45c8c8cdf09ce8ad9de0a71008de2b
SHA1 4756e1018495cfbbabbfe81c269cc28b246864d5
SHA512 a90ad713c8b21f6fcfaaa9532fcf890b8a6f3268f090adbeec060d07857673a328cb1e14e84dc052178bb813743fb7b30c2653649cbe72e41a819e48e32c509b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbWr:A3k03kHRJr
TLSH
T14915AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 868KB
SHA256 46508e4fdcf452c6a7a59b403317e5431c1a294cca694e04978ac55dd0c5937b
MD5 beb22d6279281c3a1f85a735184d35d0
SHA1 e405102af645f767504f0d8d489a6e6b41b3f82d
SHA512 0c2d0206af39798f600ffae0e6cea4c9147335f88533087fd86edc33eab7f7b350725dd35457ba98dc0be1daa98cb85ff5a934704b5c1ad3ff23627e84a80b6a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFb8n:A3k03kHRJd
TLSH
T10F15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 868KB
SHA256 2032cab84550c0ba846d300853a1479cc28788d4b066c752ae3f2c0197fd2ae2
MD5 cacd7676ba98a9a58c3636c686d12f05
SHA1 f48726d03e15f38e732a1488e1b30c729d9deb4a
SHA512 98fe3f34f5752cee4e077ed77a176332b5625098768d7b083146bae66ca0c5903d7dafb501f2f03e565297d14205aaee5e71a170f6ff15a9011c047a11430353
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFb6x:A3k03kHRJj
TLSH
T18615AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 868KB
SHA256 9735233ff6659a4372f5645b14a485a3f0e076d1f825495940790c335bed5808
MD5 98a27fbb4a7ff40d625565da0602ee7d
SHA1 76770fd27c087e4f534367bb2dabfa5ffecd1048
SHA512 6aeaa805c1f8089ae7cf1df080af3590147372edb3a5b1c51d3ffd25a3d397ad49e4e035196d97fae060d71beb5657a1e02af720da418a9e447ff6869ccc10ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFb8A:A3k03kHRJ8
TLSH
T18C15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 868KB
SHA256 e0d49bde67996cc0151597ff14136f972baf2d1420857d34d3e3b488230e70aa
MD5 dbfcfce716e8a23978e4b386a8e15811
SHA1 7a614725b2a40ba0054fb5b90bfe6993becd9d6a
SHA512 0ce8c6bad6f84579fce0a234f6cd38c85cf3c2f3274b98ff07f1a4727425161f63a193527597cafe558f6d0dec0b2f8b1f36ec81543f76b102586f6f39c5bca0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbl9Q:A3k03kHRJ9
TLSH
T12D159E13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 868KB
SHA256 d52061106667cc3035164931447071daff74583631aacab36d569400a3f7df19
MD5 191f28ecd06cd8db8a95df8a997b7b29
SHA1 f71d4fb01cb9a1b6e4e5f1623c4cfd1b44291157
SHA512 d74e8a696cf485276c7995fd462f5d5f1519334a8267acc5257e350ad971a613a8e4792591e7c33b7e6721fe3441ea5a7104280111d4fcca83ff867c11c66be5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbQ4:A3k03kHRJi
TLSH
T1C315AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 868KB
SHA256 8fc3639e3e50f6e1b6d5107011bcb9016172fffd3ab652e932f4162fcbf07297
MD5 8e5d24139921114f58b150ba93c58d54
SHA1 a11be5ec931230c667e6197ac2fe99d492495135
SHA512 35de3ed77f20c72dcc74bf4e7f4f15cb9bf47504a8cfc177d9dbebb1df59bfe9bb67c1c4a6f73649a68dc256ece8be6e1032f239c64587ec580ed65070f020b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbTu:A3k03kHRJT
TLSH
T1C015AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 868KB
SHA256 a6e79102cbd66bf6831fad5b55ac6a6ab9ab393260d85083485f955ba4d46853
MD5 b884fd58c0e3e6c6f71d617dc4a23e3d
SHA1 28cb392e574db15a1a3e95a856254a34f39e6de9
SHA512 41d25191441a552422656602b6015a9c9ddc205acdcd42e2b55cc4e58c6666cc16f287e3a0c7d344e0fe4f10754fdc09eba2d9bc3763d4f2cccccc004aab93a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbOj:A3k03kHRJd
TLSH
T17C15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 868KB
SHA256 2f030517199bbc579efcd49e5f5b39d76ad707c85cb7150683d0603252ebf43d
MD5 49251d5bef7a456233214a84c0e42d39
SHA1 3df9e22e2541b5572af85da0360f99214039aa19
SHA512 0c9a3cd3e873524033b084acee6d9f96effccf6644a6cbd5ba26e5c5539cab90c803aae624d9b624aece0e384a17a15d35f6ef78949b160b9bfde0c7e9e2dafb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFb7g:A3k03kHRJh
TLSH
T1D215AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 868KB
SHA256 dd754fabba023a330c8a28adff0e16f0239f51b7814686991350f25e6531906a
MD5 8566f020f23c9b7ac98b1c62e0faab9f
SHA1 e9d3cf0eb53851c282aaacf4c6bf0dd470839a16
SHA512 4b9ba950b493cd1ebccd198195fe81eed7ef798187680c552f525ee18cd358216f31beeb4a7d7b9003ba2f821095acb8faafa97ccd3041c7359cc1c66e266b94
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbmI:A3k03kHRJw
TLSH
T1B415AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 868KB
SHA256 b1084733231c30b318f59d160d07888948ca512e77c22c36b21fdce4d506456f
MD5 a82523ab04c53992086f44111db12bf3
SHA1 a9e6a94b73d177faac441bf50860aaa3faa55982
SHA512 d2c78e616d6441a6d70688d71159b1d9dafe2f5ba3ab43d6ea1dd6c2c03f59e823037f5bd67368366cb693e4aeb20de8745483b5ead2035b9105c2d04d3d5154
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbUo:A3k03kHRJS
TLSH
T12D15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 868KB
SHA256 62803295015960c6ef615c88fb92b4a0cf0df6e0b4fb94d082fcf23104ac19fa
MD5 2de5569fa78dbe433bec10e885fdc0bf
SHA1 f59d284602e656bbbb3ec748cecb71f924f5ca41
SHA512 f0af90fb602bd0979b4d872c5651b4aa4ad562df466a26e30311222ec9b819bb627011d7bf498754ad743e2017ad1b805f6fda47ee897ef10d33bbc547ae95ce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFb3+:A3k03kHRJX
TLSH
T1B515AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 868KB
SHA256 aea791820e29a22538a41b09af255e338bd7c2f0b70d783f99b0e04a34a2cd7d
MD5 86b42564765d5da7c6f45781c993df60
SHA1 802d7d648af518385bcc49919e47a253d114ade2
SHA512 b165c71f24b059f7c8ac665d1b37992acc252740772d8a96dd051705290b7bfe755ea1c94e7ea43a1bf45db9002949461f44576618aa3908bd71a79e3e128883
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbNQ:A3k03kHRJD
TLSH
T16315AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 868KB
SHA256 6c3859185d52d493dd2e9de05e489aac72bf2421e0b62d2c5c1c267c799b83dd
MD5 2e146092e476147684b41ce038b0a768
SHA1 01454089f5dcfaffe603f5bc12b56e9aca43ce64
SHA512 04e6b1395f48743816671a32dd307575aa483fb499646e84125b2860aa9e14f76b56fb017429b4c136860f32456bc723dd7be2e7c929ce363055cd84cd000298
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbCX:A3k03kHRJX
TLSH
T188159E13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 868KB
SHA256 18bf3537024e5becf9c683a11548fd85d3d9e891b5da95ade46aba826fc3ae13
MD5 3f144f1362bf6c2b9504625d887a0cc4
SHA1 7a57a661a6fa652a630ab06c471e1c794c8a22ed
SHA512 f46647aa6a3df934cc295cef80b592e12cc406c825a287d151a46ec3975f1aa903eda7023ec7f9145fa200e55e68a90ce6e59934bc31e8d138d025e43b63a2f0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbkL:A3k03kHRJ5
TLSH
T1F115AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 868KB
SHA256 016866f57fcc1b8cb73ed829984965c9b7976251659d3e4e7bf2dc8bcceb654b
MD5 363f165e24fd2fa00119e5ca050029be
SHA1 935985e4c4a2b570a6543a5730c13051b0f85aec
SHA512 3cc770c3879a7e179b888f18e3dc3c1272e96e0e22eba089a3502c08e8654e5aa90abb26cdc415c10415337329e3ab2a9611def3a74c253e6c6112f0b87273ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbAM:A3k03kHRJA
TLSH
T17515AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 868KB
SHA256 ec4abd319c474a9088217a09c565019dce3cf6fbfb6e41eca617c27816ff4e76
MD5 bca58b9ef881b446b0e159be06a3186f
SHA1 550a78f208ea3f83972a9fba316316b4ecf2e48a
SHA512 23a12c7c37d131ce490009c34a678a3cf4a3a5086a6dc4c54e55a3a3c89417df3a95e1ba2db9702b722cf8e66a4f0bd92b8de0162465a420331f376f2e4b8040
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoQFbhh:A3k03kHRJy
TLSH
T16815AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4660-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4660-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5644-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads