ea8cf77389db7db1b82f00095c950124b146b2d91f5f1e912ef8586399f1e74a

Analysis

max time kernel
103s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 879KB
Sample260718-bfn63abt3j
SHA256 ea8cf77389db7db1b82f00095c950124b146b2d91f5f1e912ef8586399f1e74a
MD5 55601622b2d4258824f8978f77a85fff
SHA1 d94a39dac4f9336fb8cf02a7638a856718e0b894
SHA512 2f245ff18412a92b493a4974afbe74aa2c4a498ea38a777bedb0b15395932c17d84276364b5396ab025ab90f5d87ca78cfdfdf3dc008072fd8c006c172b042f0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugq9:t/sCv7rTiw2RYwZCUsocugq9
TLSH
T123152A1766EC4894E5A6613489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/3304-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4be-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6124-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3304-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c87-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000a000000019c43-83.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001a0cf-81.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-267.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-418.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-485.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-516.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-607.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-632.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-748.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-829.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-861.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-880.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-900.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-938.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-957.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1068.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1124.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1144.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1188.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1201.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1298.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1348.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1406.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4be-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c87-59.dat	aspack_v212_v242
behavioral2/files/0x000a000000019c43-83.dat	aspack_v212_v242
behavioral2/files/0x000400000001a0cf-81.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-229.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-267.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-418.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-485.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-516.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-607.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-632.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-748.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-829.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-861.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-880.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-900.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-938.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-957.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1068.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1124.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1144.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1188.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1201.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1298.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1335.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1348.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1386.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1402.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1403.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1404.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1405.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1406.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6124	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3304	2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
6124	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_55601622b2d4258824f8978f77a85fff_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3304

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 879KB
SHA256 ea8cf77389db7db1b82f00095c950124b146b2d91f5f1e912ef8586399f1e74a
MD5 55601622b2d4258824f8978f77a85fff
SHA1 d94a39dac4f9336fb8cf02a7638a856718e0b894
SHA512 2f245ff18412a92b493a4974afbe74aa2c4a498ea38a777bedb0b15395932c17d84276364b5396ab025ab90f5d87ca78cfdfdf3dc008072fd8c006c172b042f0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugq9:t/sCv7rTiw2RYwZCUsocugq9
TLSH
T123152A1766EC4894E5A6613489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 41859ecf201d96dff41379253550159fa22b3392894e77e889963cff94a15ae1
MD5 25b18cefebbb22edb67591a0613eb9f2
SHA1 fb613037a6e8f027dfba8c9674df7b63b4c2fabd
SHA512 2486fae6dcfe543529e2fa529de671ab58756df8c8a9bc36fd67d7d2f5536bb5734b0b055d0322813d1e88176b56665fc9020551b35fdcac48dbc6a66ee1ea91
SSDEEP 24576:t/sCv7rTiw2RYwZCUsocugqJ0Le5ji0hmxNrM:x7iw2HPji0Aj
TLSH
T11D653917B6A84661E073D174C5E6864AEA72B4461B3087CF12A8C73C2F63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 926KB
SHA256 321488c091ff1d727b7a45dc45d1adff7029767e282bfb8eac69b42f35f2e141
MD5 9d13dd64b83c22b39b7daeec081f3260
SHA1 8cf488d9ef2fab340e889f420bef36702d646b65
SHA512 fd870737890bd7fcce773878ff7992986cb06a5d8082ee2db05079765b98712c978a6fa5b3d4793dee255882a2bc7c95870d6ac1c11e15fd3d60b9ecd08bbcbd
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugq4b:t/sCv7rTiw2RYwZCUsocugq4b
TLSH
T1E0153A1767EC4895E5A6613089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.1MB
SHA256 69ebeeef5b6ca13dd0141ab310c60b3f75a9db35050ca12a6f1a712785118b71
MD5 4ba764accc2633406b9caed6b2eafc27
SHA1 ed6b51c097249035a7a5bf6d575f400dfb319d3b
SHA512 d141ba862da3068aa8f4b0af72b581353d7b0811b9a398f57475dbd24069e075b3c42e7b405af8fa044a685843e5715cfa61330d2606c3913ad44d938682547b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqzmw5HEjsChNVBFgl0WDm+Cp:t/sCv7rTiw2RYwZCUsocugqSwukOW6
TLSH
T12C354A1766E80895E563613485A68616EBB2F8561B30C3CF1278CB2D1F73BF0BD39B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE$

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$
Size 1.2MB
SHA256 7546c19e3d7712ccf674f6ba893e451545604a3bc0b871023a6d1525e29956bf
MD5 d244878499b3b0ae3b2cde69ff79aca5
SHA1 be59fae39ea693dd014a9a079a01e410840e19f9
SHA512 d0dc81aa99e2e4c59bc52f369da777fa29504806235206cf7274f8da3b99b18f832feb9183dbb72d29073cf0102e98b50e7d84368593ce99ce3128c217322507
SSDEEP 24576:t/sCv7rTiw2RYwZCUsocugq+m6r/eYmetLpw:x7iw2padmetL
TLSH
T186553A1F66EC0495E4B7A13489A68605EA72B865173183CF16A8C73D1F33BF4BD38B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 902KB
SHA256 5f43810537ceca81f0a1b3146e65a6122606eff96ca058fe3bafcf7a996f13b7
MD5 d0b5f7545e0ff773c8ba95d598c88452
SHA1 ca5f7b1b8e5ff11648e3de0f19a1f4ef726a306c
SHA512 d7df8605fc94d8775eeb4a57054802fda2c86b6340d6964174857b8e157a18ed29bdd545b4ff661474a67ca1b175ad83b4d79611ca5f55737da3d71fab37ab65
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugq66:t/sCv7rTiw2RYwZCUsocugq66
TLSH
T18E153A1766EC0895E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 902KB
SHA256 33a4df16df48bf595756c0ababc03ffbb1782993baa1eb5683dcef53ff148a0d
MD5 1ec39a859f9d78f2bec41d44441e2041
SHA1 2a8e252c41b129fdf836f36359773828088871e3
SHA512 7cbbf593226ee861b67d0d7e84fc02d8cd579c691357387a81266ae09965b79741ad11cc844e48b6a3f694d61f72fb6852eef89fcb50af69902e070a746970be
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqyN:t/sCv7rTiw2RYwZCUsocugqyN
TLSH
T110153A1766EC4894E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 902KB
SHA256 67dbefbcb270508d2132bf6da87db7d536d57475b5c0fd6b381ddbbf1d551ca5
MD5 26d8eec1b7db53ffec544d5117eec55b
SHA1 c49a08d3666700e6936ba22f8c33759463b27041
SHA512 dd0ac1d4dc5f0f5f909349a2d0da27d98109d287f99aed216db0bd1cbcaacb8d78185f457a0bc95a8f86f509ddc2b0331667e27713acb24427f4992749ec4b6a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqof:t/sCv7rTiw2RYwZCUsocugqof
TLSH
T109153A1766EC0894E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 902KB
SHA256 3dac64bea1cf40f2a6c57bbe9a34837d6dd74a71000807e80bab05210ff0b4f6
MD5 9afa6f8b43d53628b9a0831e6f7710f2
SHA1 7fcdb1b7c50eea1598ef749d8cce7ec80b913858
SHA512 38617a5a29addef345b6048d26da2cc607da049734ce5af860e0beb8b875fc415526fe0566e57accc2b62c4bbaf444d999bda959f5e46e7589647f859a587c00
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqCo:t/sCv7rTiw2RYwZCUsocugqCo
TLSH
T146153A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 902KB
SHA256 e5dad3f710a25d7f6ee1072dd28f22bd734939fec59639150a2271ef5425f043
MD5 c98ab4a8407a4d133783760d6b01276a
SHA1 621c0ecf828547fbaad1dbfd2c343af7e1abebc7
SHA512 024e0c6486a47c0ea795f81d9e72814da99777452a37bd7ca772b7b585eb79c6d9212294c75302624809d90562ba282a571e9f52b9c92004f556300392bbf956
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugq2u:t/sCv7rTiw2RYwZCUsocugq2u
TLSH
T142153A1766EC0895E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 902KB
SHA256 3450b7871f126b09f5e5c76f0476c788f2f04f657cb7fe568160c33f4ccde45e
MD5 df3caa29d9a567f0748d4b6786af13fe
SHA1 a6f12f52ea44730ab3c59477ccd1e158f6392c55
SHA512 a70f74fe18b7cc4554f3e35c1a79a392ab1d8de24f01eb66b4ab138b2c242d35ca207f119bf3e078e32431ae17ae73dcb29921fdd581a6d59e6787a7b01b12ea
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqq9:t/sCv7rTiw2RYwZCUsocugqq9
TLSH
T185153A1767EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 902KB
SHA256 e51415ee97ac2c4b85bdee4e00a88e3daf2dd40ab008c0df0d0ccf07c56bee11
MD5 fa7018f4812c23f37e3ba4a10a5be450
SHA1 3bc93bc771a058f9ba1793ad369d72c8092173f5
SHA512 b1a59da94d67ad3ddb33eebef69d091b49b9f9f4a42943b94b9105aebdb1c0b55233c410c51c44e396cbe632557f4ec7d2f12dfd424b89bb4cbcea1ac0fd5ee7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqqc:t/sCv7rTiw2RYwZCUsocugqqc
TLSH
T1DC153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 902KB
SHA256 98fc9e84b934a3c4974d70971edd660b015efe9bba9abce82069f8d2702a2a93
MD5 345771cfb325c5a53c4ae4297cc9e9c5
SHA1 0c1700142d5fa428759fbca6cd16459c73a6aa5e
SHA512 00c84e4b5b4f85e7f476e4029475055677906ae0d94030d018b3c1c7f2bcacfadbb59b8063c549fe15ee58559be6c465733dd19b7106dee8bb8f5e243bc9ca5f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqjp:t/sCv7rTiw2RYwZCUsocugqjp
TLSH
T1FE153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 902KB
SHA256 053ac58ef08011ed58a863e8cf50315fbc850e8db18c967c00a714b537975328
MD5 f2f08f8357310cc899896891486de619
SHA1 28bc4a86baa51a95b2a71ec5168708a08d964351
SHA512 7a4832f481085eeede2f1a6ddfa6fa164d05ff40ebab02227d4e8ea472734a9fa2ab7b40b45be267b2e534b72037e7f2d9665970dcd4f9b35378b34254cdd2fb
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqE0a:t/sCv7rTiw2RYwZCUsocugqEN
TLSH
T112153A1766EC0895E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 902KB
SHA256 03e84d5c46de9f85a3518530570c548385cf1c3b9cfbc514633c3f25326e4c07
MD5 16f9eeee7a9808f83c5f35005f2da0b8
SHA1 82d0708b509469db2613b6694fb7ceea7167b5a2
SHA512 76f2399c9e75d7aa5cc3b39299d959dac70a8f082227cd7491b69293bc037ea2d290b17971cd7550a514684e11c01a95726d13d25d1283ac7dca040fcbb9dd2d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqsF:t/sCv7rTiw2RYwZCUsocugqsF
TLSH
T1BB153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 902KB
SHA256 2b21bcf23410a8ba80dcd6382f98fdb387f15d98249dc6a965bf3347e78b14ac
MD5 c9a55672ac3c16bec3e5e0672725e2ec
SHA1 8c77875ba52837d9e5dc65b94365a9a3fc6e6c03
SHA512 0cc0a0111d123b24a530bf17112573f8b459c8205005f6d5e7b1748e75865b4ba93d7cb1dc13f489f360d25d13741a6c4fe5d9769f66ebdba2036df0e363474c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqZC:t/sCv7rTiw2RYwZCUsocugqZC
TLSH
T115153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 902KB
SHA256 45d90bb13df41e5a34bd6f139447f45568686fc202463a4e10cae7529e7b9e52
MD5 1ad9934111540e7e19a937fa8559e7c2
SHA1 50494a7de54b998244d9906299421e97661c8eab
SHA512 f91fe11f3f617bb59c76b48823ad477b445eb2956fc8abc5b4d1c2850a8c77d117c4d6c732d98099139d2ef66753f83e8298ff93018c3f5675be3b81bae7ba9b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqaw:t/sCv7rTiw2RYwZCUsocugqaw
TLSH
T157153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 902KB
SHA256 178826b39458d47c8799ad766c8ea9bcea50d93e01f440a78ee232440a7e0535
MD5 86114da2474d613d4142b5bdf8f777ff
SHA1 2d6174c294c57f225725324f742c65aed0f905ee
SHA512 293c725782e4712abc36d1160f46ad88ad8b82e7a58852d0b7559c224ed82b1ed48c7194d9e958a5d639f47fd97ce2e4522bb489aff68fe1867701719ca01019
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqhT:t/sCv7rTiw2RYwZCUsocugqhT
TLSH
T100153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 902KB
SHA256 1d1bd1804233656d510abf9c2d272ea788906c528e49c0c23bb931a5204fe300
MD5 758fc6023660d078234481fe91dee579
SHA1 75a89a6249e0ed48529068bee8cfaf3ee64b1935
SHA512 0e7c722e274aab5daafd5faa7bb2b0517dfd7ddf18b70badd33bbee560c06f590c1ac5807332a75079cb3e23643b6070c6b0b49854c2d9b78277d926f19f87f2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqPu:t/sCv7rTiw2RYwZCUsocugqPu
TLSH
T110153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 902KB
SHA256 d8e12632fb44583e7871ea764eeee65ce0eac3269f7f023bc19f032682d7e54a
MD5 b0e461869bbf7a38c9da1feae9178c40
SHA1 5da61bd59f23b26c2339edee55df12780607e114
SHA512 a0672de91caa13ac4690a359c8379c109b54a73102f3c258321f34bf07fc864603e08550a7f372252bbea2c058c7a816d5f14556a93c98f6dda8743d9be9c81c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqzb:t/sCv7rTiw2RYwZCUsocugqzb
TLSH
T107153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 902KB
SHA256 08cf008b97f2b2a6b4f192b5922c24199e09bd23a31eddc792271b2e720a7f62
MD5 207ee3ee744986416a30a29deee513c7
SHA1 e6b3f9e4e97807174c5f7d7db13609db2b9521d3
SHA512 cd456ac183ed6f4443d7ffb7be240c506bf8f8f9c78adb27ceb2b7e211ff7aff31283531fd7537902fd0ea5a955a11eadd07a74ad1365a80c027b2731c959a5e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqHf:t/sCv7rTiw2RYwZCUsocugqHf
TLSH
T166153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 902KB
SHA256 707ecb734366d65bbb2f2e1aa5e8838ca4e771ccecb61205a40f452c748cfc18
MD5 18e5bdb2d6f8368b12098720cc267051
SHA1 c2f28ffad0f24865a01241ff5fe1766542a7590a
SHA512 6f18d23c91f22c64cc3dc06f7893c5e891e880dff05263a98628325fe98dc24d3a0f4471bf800ce86cbe950a6924adfa594acc385ddbe2d9f9339c75f76382ce
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqwK:t/sCv7rTiw2RYwZCUsocugqwK
TLSH
T10F153A1766EC0894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 902KB
SHA256 83d6f5d30bfd0fa4007f303b6c59270c51bfa2c89bba936876ffd09d9f3f56c3
MD5 77564f8c9f8061ae5661cc65ae067f20
SHA1 20c34ca33181bdefba8ee435df0835778d3a54d8
SHA512 f694eef75e2d85ffafb7413cbcfd331244c246171bf06f758e2992e76ebf1cf53d98f3c065c94e89a28934d906856708ee10e45efd6629597f9fc63c6a5a1e28
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqtk:t/sCv7rTiw2RYwZCUsocugqtk
TLSH
T1CC153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 902KB
SHA256 5530d7e9006c4cf91ce1fc9183852c2a43c650be511bd4d1cb8ed3b03e11ffc7
MD5 a2d75767e1c10c06266112f8154b958e
SHA1 71c45abb0c080823667bc032a25cd21e230c0492
SHA512 c5d10f665f880616b23ff4e78a7b1615096259ba2d0dda1c9966791d15a89a2be4f97bec98e0457b4bcfb1be979be368921657c1f56a25148cf9056427c8fd33
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqy0:t/sCv7rTiw2RYwZCUsocugqy0
TLSH
T191153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 902KB
SHA256 15814ce5625460f7aa77c64dae441d7d348d157c63e03d81dfc708fd920f720f
MD5 f58017a20881bd8bb6874ef428095ca8
SHA1 e43b7465a3cc0ae10c7d0de87232b55960ddc7b8
SHA512 407a6174fad8bff891855cb9ce7273956677d285479750aede9fa964d0dfa3a2c01a1674151ee03a2a92e20e92233879a6dadaea54fcf0e5685c8ca44db0d7f1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqB70:t/sCv7rTiw2RYwZCUsocugqBg
TLSH
T18A153A1766EC4894E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 902KB
SHA256 74a7785e7f45a2d67636394d6f6182db3398f500b5023a9040b3246c638e2de5
MD5 65fc1d852ae0e554ac52a4ed3eabaea0
SHA1 77e832aa4598ae0d561a1b53e4b3b515c49a3697
SHA512 3ec3bb005bb8e1e59dfad8a15d5b095132844ddb31e2ca2c2db7d0c896e8f888a02755eb431937dcb3984d2d44aec7be2ffe23c85729653387930c8956474b46
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqor:t/sCv7rTiw2RYwZCUsocugqor
TLSH
T1E1153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 902KB
SHA256 362315c6410d4469ab3777a92fd35429424faad321e2e5ca8514321885f86d38
MD5 8eeb09b906c9b2272be3eacab09f6f37
SHA1 b98711439787aae86344b96563e7a97adc28a09d
SHA512 1602cf6b099b29a60c856326f30bef58dc2b66e4a1ffca70d94044198eca5dce79731d8d8f62b32fa64cb0adcfb7171a33dfe6951b5f89e0248b3c5c18f24bca
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqGn:t/sCv7rTiw2RYwZCUsocugqGn
TLSH
T1FF153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 902KB
SHA256 7b0488daf9e5700c2bd075181c7a61c01b359567d4ab5f3267e43b5cbb12e3ae
MD5 0f2029286fccaaa099145862531d9db9
SHA1 756d989ace7b3e5bf3916e4db31bdab0c7997c2a
SHA512 3328fa7a7ebef48b9b358a699266f9e212b7b278d80c6dc02f4956a17bbd6286d21613b06360d7591bbe7ea041bb15ea4e721c6c14a6f00fc40bb2d2b689ddae
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqMx:t/sCv7rTiw2RYwZCUsocugqMx
TLSH
T1BF153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 902KB
SHA256 0757a45feae53814cc4e2d38bedc1f7c86bc3c82e53957fa5ae939182cf15c70
MD5 586eb3eae11aa270c6e39b4597cd029c
SHA1 33dac870b067fde03f2a0d69dd43844576ff4b71
SHA512 ef27275bb799f12da92e8129ff34ce0328416d60017ff31699dcebcb55fa83098815dc1d6e99d145fda4ab90bc29752ea4aaf0dac186db3806f2166c2aa5b139
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqGA:t/sCv7rTiw2RYwZCUsocugqGA
TLSH
T16A153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 902KB
SHA256 f16b90647f996acf6e262a2a06c3b7d2cce2af0057b62937f1a48d4688d610f6
MD5 f0223da55c3eb9c2496ab7c598628107
SHA1 c8688fedd3efc70831a56aaf0204327b9a8eb552
SHA512 226c75a8590dfda91ff1156900510c6ebd85898977ecfceb3e01351a8583b2c1325a71a883022e850e00954bd60553756917c0eb937011b6eea428ae2a72aeaa
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqf9Q:t/sCv7rTiw2RYwZCUsocugqf9Q
TLSH
T114153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 902KB
SHA256 f29cd20bf0f4050fe2af35f8ce4994a91a1ef2dca56786173141dc841a4453ba
MD5 5aa766e4fa77608ed672e42dbd89c36b
SHA1 00535cc4b767d8ff0eb7ed43ee9f70c7558ff663
SHA512 a6fa22701e344aba18da03080175b128dc4b30d2e82336287fab48e9445c6a65b72d5d96f8d8c832fd1ed197232bb99871885b4612443262e89d674cefca398b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqW4:t/sCv7rTiw2RYwZCUsocugqW4
TLSH
T1A2153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 902KB
SHA256 d52d437ac72438bab4cabc98222455c3fc072cd76d33c543bfdfbb77b88816d6
MD5 82439149e57940c141463d00aff0caf0
SHA1 a4766b4d1aed84f32b3383165356720bfd27b828
SHA512 f58ba8fcece966b521e01d1effc9c62a14be11725e8be6d4840b8b0ebcd4367797e865b8aee54e91f980bffdcfe4d6c8a3e2ed63f664063593aafe85ede8b68b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqFu:t/sCv7rTiw2RYwZCUsocugqFu
TLSH
T14A153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 902KB
SHA256 85c3dfaef457e723a31e714c2c45f036b1ecd9fa54e566c51740b7e18cee2704
MD5 fc01f61a625867d1899e2789941e7935
SHA1 47ea874cdbaa01195228218c9dda40e60cc0dd9a
SHA512 6858ce17ccbc35d145eccef5dd694569d9b8f088862365278c2d4d254ce9a19fb52dca190f4b2bec8b67a9646b24179b4e6096b581270898f114157e8d6e5e0a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqYj:t/sCv7rTiw2RYwZCUsocugqYj
TLSH
T17D153A1766EC0894E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 902KB
SHA256 7092b472599b31739db889353ae417457229562f7c168598cd71980d30b9fb0a
MD5 4d185af94682260f8347645e22a74f88
SHA1 07e80710c9662df3888377f9508e12a4e708fa63
SHA512 fbd121f4d4ccfb03d79937c21b78659d9dad47190fec2dd340a3a4bbcfb63b900b26786418c4c7b57cd3feb6bca5ece84b24bf455f36a2d951656cd080c7788d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqpg:t/sCv7rTiw2RYwZCUsocugqpg
TLSH
T196153A1766EC4894E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 902KB
SHA256 ae4b55a70fc3f84bf0189dff8aed8682ced5589b787df89dc767ca0579fd8f94
MD5 59a51e4649cdafe20421194eb3b5e4c8
SHA1 ccab8acaf01ad82e16144e13313ee3c171e07de2
SHA512 aa82e1f37355904ce7577f306867f3e27b9ac5bac824eaa39c6dcc3a89a6f84c1a3a71161651a498595c0e022845a10c65687d912ab5fa6aa5edfe1caa306b98
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqwI:t/sCv7rTiw2RYwZCUsocugqwI
TLSH
T15C153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 902KB
SHA256 adfdd5202be99dd0d6d819a5fcf8f344706da6130c21158f959342cf1d4e8a33
MD5 1fd5e964c2c756219ef3c8bdf86b683d
SHA1 2c2403b239dde828135317e734f4547e6b64121a
SHA512 e3f85e2aac68dda28ba8b6f2c0c30575dc3ca381a1821d43c9886bf2fd47a1039746e4f9ecd96e0b01932eebb56c4ab3657da8409579e43707dd4a81fd90a827
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqyo:t/sCv7rTiw2RYwZCUsocugqyo
TLSH
T1C9153A1766EC0895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 902KB
SHA256 39189e7197f9f47b2c4a19130f3b7b73734d62fc1edd3c1af8a1245813e36cd9
MD5 decd2b5ab7564f5969d5cf9bc936fdc8
SHA1 997ee0987a9b234762f2195c423e53ea75a89e3d
SHA512 69e00ded1e4fc7666da89c192646e0aa128d2d8319c35de263f371180d9156696e3e154d70505613704764c6ecce4c707cad5da63874c08966e9f185ba75c79a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqp+:t/sCv7rTiw2RYwZCUsocugqp+
TLSH
T190153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 902KB
SHA256 f221f633c57bba1c3fd6e741f63e26dbd79a2468dc3f09e4cab1403bb8dd1b78
MD5 d498b69ef8a0ce1d3f244b404eb7e8ac
SHA1 e30e1743ac77ad298c47412659e2a3e7a2c2a157
SHA512 6dc8b6b25fe51cd5a118902e4f8e2ea4bc057ef711e4284412bf62293e5dbb9213619b668db484903a6254c82bc7e41771d8a7571a97a87eca93df42268d456e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqXQ:t/sCv7rTiw2RYwZCUsocugqXQ
TLSH
T1E8153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 902KB
SHA256 ffc20f3d8131c8bf091811f301783c3addfa2c91cd8db4c9591c1e30ed096a52
MD5 7efff9283e4a2239aacfda0320c0e789
SHA1 b0809029b023dc6ef3b4691b53439a9236c1004d
SHA512 85563977f4824bfd52d2420d62ccc443cc46a425fb735884895610a1f2041e385d8611132d04f75e5fefee439c2d5809e87bf174267d9141cb17e74e5b2b17a5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqsX:t/sCv7rTiw2RYwZCUsocugqsX
TLSH
T149153A1766EC0895E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 902KB
SHA256 218189572ce5b2fbf4ae14199f126b7781dfa315721143443a0a5d0e8cb06f4c
MD5 5ea8bafe95d1d3bedf9ab9d9e5f4b423
SHA1 3d58dbb425066da3c6319a26a1a03f5f2d870ab8
SHA512 8ac65a7d25e6f3f6f46cc554c1ef0a288fb7e362942778c33652e487cbd32cd649bc3cceb8e944c5d8b04664124e464784a380fbf0d291228c78d30e388769a6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugqKL:t/sCv7rTiw2RYwZCUsocugqKL
TLSH
T131153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 902KB
SHA256 9b7d6b4a60f9c78405cdcb960c86a1641d890be7492b1f2d348cd87a7a00ce9e
MD5 734c4b318797f5f1564db852ea03818e
SHA1 05c876b5ab4cbc63d7b6d7d4ea7bbf39a36bafeb
SHA512 62b9d9570bf2eebb8f748d6d899e5058d1f05e82109338b52a312da7ff763526544fe0e7e3a12a92c51875506c9e5e48ade15e970f8ef02fca76aaa273f0449d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugquFC:t/sCv7rTiw2RYwZCUsocugquM
TLSH
T137153A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 902KB
SHA256 d65b74e567da4b59773514de3d92e915a90a2fde431d7f3e3f6958d5b84fcdd9
MD5 899f0c0f83632b754646a7b2418587aa
SHA1 6d07f80c5312f7d717e5fde6d5056b0b958a4f91
SHA512 4843b5752060f5b9718ae19c99e72df5b0e1ac5600f99f154f73b89fd1738887f1b5be806c58dfe99af60793434e949f242da72114ef44796496113d0408790c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocugq3h:t/sCv7rTiw2RYwZCUsocugq3h
TLSH
T159153A1766EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3304-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3304-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6124-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads