ac406c0a56c035c92f1f72292d88fd7579406b2cf7bc64c73d5f3c431eb5505d

Analysis

max time kernel
104s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/07/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 891KB
Sample260726-2dsdtagd25
SHA256 ac406c0a56c035c92f1f72292d88fd7579406b2cf7bc64c73d5f3c431eb5505d
MD5 01941874fe5805542e4fceaf31dd459f
SHA1 636e364af6348672d61c43b739dc39d42ba13046
SHA512 05cb87bfc0ba2e4d0627f079364b7674ccf12ec472b5a887a83ac1b5248e8e70694185ac473ff71646a520d7f53f66b0def14858d30162522ab8ba95de19fa7a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vC:A3k03kHRJb
TLSH
T16C15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4892-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c489-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4892-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3516-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c71-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001ba83-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198be-426.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-536.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-609.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-640.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-927.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-984.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1065.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1102.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1139.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1208.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1355.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c489-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c71-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-221.dat	aspack_v212_v242
behavioral2/files/0x000400000001ba83-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198be-426.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-493.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-536.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-609.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-640.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-726.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-801.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-844.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-927.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-984.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1065.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1102.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1139.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1170.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1208.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1323.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1336.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1355.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3516	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4892	2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3516	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-26_01941874fe5805542e4fceaf31dd459f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4892

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 891KB
SHA256 ac406c0a56c035c92f1f72292d88fd7579406b2cf7bc64c73d5f3c431eb5505d
MD5 01941874fe5805542e4fceaf31dd459f
SHA1 636e364af6348672d61c43b739dc39d42ba13046
SHA512 05cb87bfc0ba2e4d0627f079364b7674ccf12ec472b5a887a83ac1b5248e8e70694185ac473ff71646a520d7f53f66b0def14858d30162522ab8ba95de19fa7a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vC:A3k03kHRJb
TLSH
T16C15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 ed2a4ecb97fcbab825c123a15f3b37ba4961fa48d8b21711bbcd29730067e18d
MD5 2bf10388889d3bfee0aee9e72dd426af
SHA1 4f0e12cf2f3c0fa45c5025f4eb6907f5b57ff86a
SHA512 ccddb002864f7c83f0ceda4c1db484369f3228635d3edcdbf9e2cf9be8123a2a4943215228c9d5eb8a00cfb9d73a3e5a66152e8db3a4a9907b87b17a7ff11543
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vC0Le5ji0hmxNrM:A3k03kHRJHPji0Aj
TLSH
T191658C17F6A402B5D067C0B9C5D69A5AFA7138821B3086CF1359C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 906KB
SHA256 ad09f9d8c2db63de23db3681e3a8f6c451e3f88e773402a9b589ba204b1d7dfb
MD5 22d067caa3bbb3aef9a9155dfe0ad365
SHA1 0b3ca2edda848b915798288f072575d10ed6c402
SHA512 eaa347f3e8d3000f1d8bb3f1ca4a688a8ad48e4b70e4718d745737260f9dc0fd1f0e5efd3f9230ae281d937e79807b6daaace9ed4c080e735b0371a9bb977c0e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vMa:A3k03kHRJ
TLSH
T13015AE03EB9500E9E10AC1749AEA4A23FB757C56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 939KB
SHA256 219e342b6adc74ffe3fe104d3c061a6cf23956a9006a829871256eb9b6ea365c
MD5 64c80506a4057bb5d0be309df26ff5ce
SHA1 5036547128b4f3718b59ec8a7e7686ff7c3e662e
SHA512 4e50d48d85c299339321796dba00b9e63e5faba66751c1f1354cc0fea7237ad3fe92638feea35b91cf0160af91006da70cf8e34a6252cea9252975229b33ca62
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vnb:A3k03kHRJKb
TLSH
T1F625AE03E79400E9E10AC1749AE58A23EB75BC56177093DF2358D6152F72BD0AF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 915KB
SHA256 1fc521e6a7080a6f65a2d71c37606182f35be9c18ad08291f9e19be76b54388e
MD5 572c5c916d0de43d6c46c1310090d65a
SHA1 9d66e0b1aacaeeee08e9e10614c8bac0194233b0
SHA512 62a509335d89151a0d7f99082d784bbe1888ef0e751b8082f9e0a471ff3f058297247c3aa92f777492701d8070023f11f9885f020d1e54bfaa397543e09f0e10
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vl6:A3k03kHRJP
TLSH
T1E915AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 915KB
SHA256 9f235bf50197322115106201c768980ec881321c3f85c32824a61b946cd8634b
MD5 5c21e3a333c4dd10f7d0bda05fb48d2d
SHA1 605c91466759526c3ede3ba340797413a3030607
SHA512 9b34fbd461c34edce1c2fb46656c4219d181e5e8b6b576750e08bade5c997aa6d6879828dcbba7807fad0dd67604f236dfaa6a99e977996d8026cc96f6728648
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91v7N:A3k03kHRJy
TLSH
T14815AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 915KB
SHA256 c07b3430799a6ec2a9fb13e02daa57017dad65c830b57cbdd2d07d80ca171861
MD5 d167f71bf0b7c304cef46576ade50545
SHA1 012fce451a13084ef9b840787305d2c410a08ee7
SHA512 bb839e786f8a2230bb2d6b126d9453d99d262fcd4fb2a913dfcb9f61bc22896494deccd9e97f0cc7f5a9cdbbe08cd68985d23ed82719a30a18ac7582c59ef535
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vZf:A3k03kHRJO
TLSH
T12815AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 915KB
SHA256 e3385f6a3eae9f08b5aed370d1a75ed8f2a157c47b0ac09ec6b5499d1cb995ae
MD5 63e0359dd99d0f427c21040f1e0c3dd3
SHA1 f82f18647b88d08e3068e14bd5d5b0e70f5c0c58
SHA512 1b1f1771623b3c5088f17fd04249dc40bd08af8f4109bec714f8440e889c9cfab02a90a2e32024f22fd21d58c7869d0d74ca68e08c56d971050523c601902b4c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vbo:A3k03kHRJv
TLSH
T1BD15AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 915KB
SHA256 6cba63785e3ce3691ccbea72e6d7a698e5c7bc6efd8565c7d4c9cf6707caa0eb
MD5 e280cd11f5aed9cba70085b102d17512
SHA1 7d2ebebcbfaa7154d7c5789411a579a643519586
SHA512 16ba33c8701cd2cb82cfd73fc890b7d74b8483c49a5eba221d4f57e12334fa236f3bad157882d69744a8a128dca206c949812dac3c8633aba0a9cb348372b070
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vPu:A3k03kHRJh
TLSH
T1B515AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 915KB
SHA256 b03175eb8a2401eb4ba4f71d63919af390e0a27735e7b3611ebf108973524698
MD5 a736812e1f5c373010adefd3a3d09dd0
SHA1 9e3b39035826d34c3975e37947743531d5316ef2
SHA512 0c7d4d9ad9d895f32adb7bea7bdee57eb682e36bb16a3d8536915db9ac26cf70774712ab280d035b356161ed4ca3310418cd8f3b4c03499628cd92031655bfcf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vd9:A3k03kHRJc
TLSH
T1B015AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 915KB
SHA256 b15ea461fb4862877b522c44e275c17a0bbb478f5935bdd24d2c0f5dd2ea0027
MD5 59cfbf1af18d4dc4cb8867a53b6b4ac5
SHA1 5e6aec832c0c0bfe97b80b43e072c6112876f39f
SHA512 47b26d03586b0f12218b56c86a9e10ff14a8933fd59b70a5554353ac8994e5273972f8bf99aedd9c825f7aa87275d3d656ce908b032b56704a56091b06ca2582
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91v5c:A3k03kHRJV
TLSH
T102159E13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 915KB
SHA256 396ac53479bf040b96e53cd3e5925490b482ef81f1226ae987fc5682fedeadb7
MD5 9c1562597abf47d13d1de625ac23639b
SHA1 81c8dbd69bf41a4896c9e9a68f74a0336f12d667
SHA512 b3203815df893f90d9bd9f83101ff79bab5559488beb381af8265f2a80265169a74002ad416fe8b9e590fd63bab8426d3c4950e994bef76c83e93359f8e5ba04
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vyp:A3k03kHRJb
TLSH
T15B15AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 915KB
SHA256 bbd163178921c2e500ad1e4df8e4141e038e6fcfcf5339dd56a6d442733052c1
MD5 6f45e6840da9d3a7743676852c847ffa
SHA1 39f9d960eaa31bb2bdcb89c225131e66468015df
SHA512 67420c56beae9139cca719a1dc3d19e5cacf686fddd3ff936df75c4695f403008048781c4be6c3e5cf4bdba8f439d6520869067723af28acf7494527d8a79be8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vFN:A3k03kHRJg
TLSH
T16315AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 915KB
SHA256 f7cbd5ae53e4daaeaac6cae1454c1eba5240f5b221afbe347019473b9ecb1fd2
MD5 fed6e23f9fb65bd33acd855314afa2d5
SHA1 381e001878961844f4abd1deeab348dc4b6574f5
SHA512 429ee4534ab1480db23ae3ab0a81ff123e79b9864a69b281097ed6a8b14227de77fe88759e61a4f3635df55231a2fc02ff19000a646c05136f5a005a1a2647f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vXF:A3k03kHRJW
TLSH
T141159E13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 915KB
SHA256 b65c5be6ca68b14877e97c142ca4a4f92297168b1bf513e61d90add09ffba7d6
MD5 359485c90909f3e3e1e18f9b3ae14057
SHA1 a8dbb59f26a61728585b1816f1ffe28197a7a4b0
SHA512 b84998f341d37f0f31b6ea1b9ccfeca323dd174da4acaea81e12ec1dd40794ac671f4627e7ac4c74988bed16c3fb6e9a3dccf07837ac23341af705790f521633
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91voC:A3k03kHRJS
TLSH
T14D15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 915KB
SHA256 8b3a35cebf6e19037e179eac9fb0c6b32cb296071540e28e75a97e105e2dc2e2
MD5 b9e9f03237b07a992a23b1b7aec0ea53
SHA1 f6ca80e0e45fbf8449ac3099f2c3e1182ba26b7f
SHA512 25d643e9400b8280b5d3d970f4c8696f69ec12cf7cc4e193f87a46172c56e5d0641888839fdad4aa90f21f068650d602c05a6212296ce32b4276d74c58d5bc72
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91v7w:A3k03kHRJn
TLSH
T10D159E13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 915KB
SHA256 514c31f04efb2f6d1cb8b6a36575c85589f83cc9348c2efdbe6726991480ee1b
MD5 24f1b8bebffcdc10f8dc67300b3a154b
SHA1 8ceee52469aaed0804b2add937b12b3698c296cf
SHA512 0275c7753bc63de2fed82156cb93df331974bf7498d580a47b79824a28166ba83fa8074c8787cd5db884bacda44b56ef8a584de9355b7d3059390ab627334d6f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vCT:A3k03kHRJj
TLSH
T14815AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 915KB
SHA256 65ae1731c95c1974c369788c4e595127f3d8fa56d2298e989dc1e5bb13900de8
MD5 4a2956f922157bdc9153f3e101a19f12
SHA1 9c8b1b2d787e8925ffc0c0fdd2cd1196c161d744
SHA512 dcc1b38add15419b7b0804ef1caf4b87d0e6338289b91996e497b325658f677582bd4e6d293292d1024db3a5e63866048eeba8d368f282debf19ccc5cc48e5a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vSu:A3k03kHRJU
TLSH
T1F515AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 915KB
SHA256 ce65666abee8587e70c37aab80115cdc44a5b1e746b1ad09b638756051820681
MD5 fcdaf51132ed634133f31c865ff287ea
SHA1 d547787d73ffbfb85817725ccf09252c429d8df7
SHA512 d8d96dbda8ebcb10c06fb94643dbb4349b4a48205707888693a51f64a908045f117381cbdd7608a2f5ce53d1bde311fb1c74132aa91f3d4dae313e8b1915a15f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vMb:A3k03kHRJ9
TLSH
T1B715AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 915KB
SHA256 e33757e11318d7df2bb51cc0673942bd7366ee0f05572bae2184fd59630b7981
MD5 6b449b8af0ac1e706062ea8d4ce2f909
SHA1 83c8e9c05e4b7362aa17590d5ca1078c3c55037e
SHA512 292aa66a39c1deceb95ee4f09dc546d33ad8b1c471703459f13ec1a11f8cf5abf48abf4c4227fb29c5c62f4d6b3a1ded9bfe4cb3348f185347ffd1ada1334c3e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vyf:A3k03kHRJt
TLSH
T1A615AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 915KB
SHA256 c2396276eea4d20b39ca69340fbcf354cfd5a9a8910bc0e25ce03d3f46927e15
MD5 02096c41d69abe0a5424465e28e8bd43
SHA1 22d0f9617b220451285952a3703578e91bee8509
SHA512 bcaa3756cca8e6d3b8bef46e4fbd4bf3376f04e6c1fe4a5f38f981bffc354a0e7fa1d59593eb036277aafc8f16b35941380264c92fe9c0f13e31a5e83d4174c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vfK:A3k03kHRJl
TLSH
T193159E13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 915KB
SHA256 bfe480aba732b9b18b570052bca355d994b08ef4b0d215d2e3efaff7ae139e8a
MD5 394a64d9ccb36e9c66dc9756b51bb1d5
SHA1 ef37120d32ea99faa9b5f782d6076850009136fc
SHA512 bd95325992dbc7e79fc78dba646e89fcf0993e5f4b3679b55f35225bb05b2828c8cd8a7f37d8f1c8cea03227bc7b71513cfb5f9793f57a35f5d5eb0d97027837
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91v4k:A3k03kHRJM
TLSH
T1A715AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 915KB
SHA256 c1230fb471cbad1d603012a4884ed67a6af04697fa470fcee4747073b66458e2
MD5 34c9d5739b81db9f6044fa8748396392
SHA1 14323dcc84cee3a7af1fd55b05e24c5a79e0d1eb
SHA512 1f07a67865083d16abbcc362feab95102df69d977373d432ac4c57c57502ea2f1e2640c4b37e2d92820227999d38feb50655e88f67acd05e73ba55bd85f86e6b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91v50:A3k03kHRJl
TLSH
T1B815AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 915KB
SHA256 849f61f1f4480a157c833a1b95ceac7e2546daf5a791ab4d4d7afe692b35943f
MD5 b9d927b1ec00bb7d69b3f86cb968b123
SHA1 c61cd93bd48717be4201cc6821ebb799c9419e8a
SHA512 a9dcf4c3723e2e5b60499b4329638bd8c6c53840af057ea565ad065ae55aa6e6811e39829ebc2c6a88c48b8cc89966b2089d9f8a108095fc6e9630d7da5408a3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vsg:A3k03kHRJE
TLSH
T1E615AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 915KB
SHA256 bdd899a17f732b08e43184d482d8eafb3e4af7fc001cd2edf4969a4c652c1dc8
MD5 0a83281b7f8dd985c51fe7a02663b5de
SHA1 e9a9fb2361eb843b7a5909ca7afeced7b736c8ff
SHA512 75281a9591f47b607f06a034470a911af254c881026a9982908892fdfc8ba3d74074a3f515007c67395d393fd5ed1a082a23c7a4671f58030a29d7251c4c09d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vJr:A3k03kHRJW
TLSH
T13F15AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 915KB
SHA256 8b37e8fadad7d238740d5a810ad854245c4748d45adbfdd648a63421b65dc70a
MD5 0a39193d5717afe146b6ce260c2fc265
SHA1 ea79e66bb22b4adc8f1e0a4adc850df2095d0bb3
SHA512 969d218ce33ed6b65c4b4b54262fe2adf3a924ffcd5456cf31b498947b2498f77bb4f51da8db82b4f72195e84cea87f230c4ef9613aa299babfd5d1120f15733
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vrn:A3k03kHRJQ
TLSH
T18615AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 915KB
SHA256 3be92ae7e7888b88983e1169cb063e1f541e7598dd61c54b10cd8236f9dba86a
MD5 d9068e0b4c524cd20ac65416d22426bb
SHA1 a5f66aeefbd159e22ac2e5e561a9dce8ec902699
SHA512 b3c75929a20b3d7132de563f1c4e3daebb33b7f010fd0f45daa9b05956a6d1d2856b5c2fcde04c1d0fab181180d32088358fa1cf177c718fa0e00fcd9144d3c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91v3x:A3k03kHRJ2
TLSH
T18815AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 915KB
SHA256 7cfd32c24cc6f426a43993bb8feadedfcee2dd86333b671a4097b2bdefde8cf0
MD5 5c39b7cc9b512ce5e9b6bb4e963cac29
SHA1 5117f0290616ce901a9de8f398aaf9e3f483bef5
SHA512 ad6942629acf20e37094b3c74382ec38001a8fa4744662109c4fd8f843b6813ae132ccd34a156610dbfaafecceeb02369bcdbd9033ed240f9b67dc6ddf618e10
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vtA:A3k03kHRJt
TLSH
T12215AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 915KB
SHA256 aca2eb7adc7626211ebde5a6121d0966b7107753f54ddc65a45f68474dfbd3da
MD5 767df536a97a0a63b3549d2f8e163754
SHA1 27facab51fc4d9b2e06348a17b023c0f6d1aa31c
SHA512 c87c73f29aa88f06e77a1a1ed11f938fdc4c9d12d12e0538fead448201ffaa327f8ba52010f3f4d2ea77109d17d68d921d277b2864f158c2867877948bde6452
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vm9Q:A3k03kHRJ8
TLSH
T179159E13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 915KB
SHA256 637e60b67df6e3bb809c0dff605f787e18c6fe69b2a51db752fa5233c1c656c6
MD5 97c60c0cb5723740583c84ddad5716f7
SHA1 e0cb49d450133c7d0c1189973c0f84bbb54d507a
SHA512 acbbcfa8212ce46c581aa181b17fbd029b78830c0e97d5b19cb0e8cd4e006ba8b27f81340f443d9505e443be2fa1ca9e6599cacc7411bb6acb4dcc3a18911bfc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vD4:A3k03kHRJX
TLSH
T12015AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 915KB
SHA256 1de18da015575fd43ea02c16d9a8107636edee8cc6b42be773d6c38f925046d9
MD5 953df7a7deddf4a67fd9ea889be8156b
SHA1 9a8f92637b41d97d155b41dfb381b3dbd12de25a
SHA512 6d30fbcf9bc9d9dff04f5f1f7203f63d9d5f7f85a3f753cfb575066037d3747929aede4821b3f5ca95b827d1a68996a4665fa7e0c0e7bf8846632c599207e9e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vqu:A3k03kHRJa
TLSH
T1F415AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 915KB
SHA256 f53ed25062d32486f390f3abcd57cc934a949f7ce9b1e62c5977fa1b76b77cd0
MD5 0ab9f87d78111f139f0a4de0be1e06c4
SHA1 72b24ab47d76db2512b42ef592b3575051c44b21
SHA512 cead654cfb4f2856f78bf0cfd9cd4c61668957741275f536aba1807d2e56e1627957c8bab8351837465fa3f8bbcf9a8af1f73f38fd92dd4cc56a94f81b0e6bfa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91v7j:A3k03kHRJ0
TLSH
T10615AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 915KB
SHA256 7aade16bafc7318f446efeeec2e11408806cfc24f87421b99c7c65b02652b9d5
MD5 392919b046dfa4ffe06f4a9747de8071
SHA1 f4151f17cfb951feeb26f3f87ea16f244e812b71
SHA512 437dadc80a96eb47e516b102592542e22e515729811e82d0268cc27a426449cb0e2fec079cccc7fb0a709708d51a9ada99c3f0e3f4b9222d330576315fc3c4ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vGg:A3k03kHRJ8
TLSH
T12315AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 915KB
SHA256 57996cfbc08933b72a6849d1441f029d06930be41489f396a46a0cf637e4391c
MD5 c18a72e6a14c357772de7282604d36ba
SHA1 8cde34e118ead5d0b3b014da8366368c05056302
SHA512 548c5451b808ba0ad833c24097c8f11e25bb6f4e6c7592be1c5247bfb3b514380ecd730eda07d2525426ba58966c82a5bbbb66dede8b4a327fb261a05257c344
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vpI:A3k03kHRJV
TLSH
T12615AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 915KB
SHA256 5060bdce7c29335f3d3d46340c81691b54020403707a5281b8629790ac50dad1
MD5 6b0fb5e4adf70b3d3889a6cc2c0dffa2
SHA1 1e52cc49c53a097b716ff2a0036e83b23010be69
SHA512 bbdaa38ee58a0b0b9436d6cfb0837361d23235c705caa450989d1325a4d18fc7dc8f0da9d041f905a9ae4ad642bed7cd24438478de6a945aa4e896eb3ac1ccca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vLo:A3k03kHRJD
TLSH
T19715AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 915KB
SHA256 7152307b3601d10c496514e58dfa5d484fe3ac7b9ae1fae7f868c8d7ff4d35da
MD5 02f92d62fb588df05bb30c300cb40690
SHA1 5f20f770a21bbcbb2533c96691944840bcde9e78
SHA512 3f40edc38dd4985754183e22a79e0506ef0389098d1c4754069a797de83b350a75b1d6e346a91cf8bae8796324528b0a80eeeb2e6aad9f484fe58911fc32dc0a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vw+:A3k03kHRJG
TLSH
T10915AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 915KB
SHA256 4ea15927bbfb606a1da9c647d4d4fcad3a2e7b8f764d9508ef03698643375ed6
MD5 ecad88b8cba6227f981c17c7ed4d1e5c
SHA1 fdd38f774ad225752b7a3d282f3c38bedd461f77
SHA512 35ac4b9f71e769ef6051c901a9c9e781bce8e5f0dd6484d6c4eea846a689307aaa9208579b2f47206f22c0c76b68e995e1dd72b3a20296aa1000ffcad1a3ec2b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vIQ:A3k03kHRJC
TLSH
T1C515AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 915KB
SHA256 d62e1b6898ae399e46b5dd3ddc14290b517a1008dbce0fb61dfaafdcef3f4677
MD5 c66e3698ff8e4d0d6416afd3cecefd03
SHA1 8c64833b4401bcf0d18d59433d3a5dc50a7e89b1
SHA512 822f1aed86dfa8b8c1df8cfb6bf434f8dde234af0f1911e6a5fa72c6f610d463d7084bb72a861a7b2caadf60eef5f3aa8f1193dbe3ba2154ea1a675f8fecb64d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vBX:A3k03kHRJS
TLSH
T1C4159E13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 915KB
SHA256 c30c2699ec30a3069a8885c0a601e4cc756e442468ac6fcdde18a17bdc95a9bc
MD5 6bfdc22bd9b8ed6b5c355784f3e1acdb
SHA1 78fde8e36f7fabc4fb3a80e1fb6205d0819be790
SHA512 4d47680affbbcd053a160a2430dec34867b4a9ebc2f390d69de947d063c9acd2480db22af12a6e92646bb7a1bebd1fa6695b16a988d59895f21672e82bc0d5d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91v7L:A3k03kHRJ8
TLSH
T15715AE13EB9500E9D10AC1749AE64A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 915KB
SHA256 cdbabf4a900f4fa6971597c18031648c57b8c9e40ab559918bd13cbef1c27ddf
MD5 b0b341cd55272bad3213d8a6d697dcbb
SHA1 f717606d96d323d73d9fd638156260146df97413
SHA512 9b0692233ed779ee1b5b739f262dc3597f6c12c8149626ccad92cde265e4750ee775aea04613e46a2181edeec8ae5dc02c95e198c535c9faac9248392f012d1f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vBM:A3k03kHRJN
TLSH
T18415AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 915KB
SHA256 b6b89ecab44d0b83ca64e4c61afd18599bbb66d588f7947947030335043bcbb2
MD5 78b80fcd1f60577f3b66f3d481500fa2
SHA1 095ad728af92ca370d37cab01fb0b88b68c62739
SHA512 6198c257ba883a2cd1c0f91d4f05b0526d556f1990a4898a9ada4225bc2224490543c1cded96b382e2d34799ecc33203e07f9fb50319b0d32bb690a140722659
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/91vqh:A3k03kHRJn
TLSH
T1F915AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3516-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4892-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4892-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads