7674f63cbdd4215d8ad61f335a5794872030f8d03c59911afa4dae64358d097a

Analysis

max time kernel
102s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 12:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 868KB
Sample260807-p7yfpswbph
SHA256 7674f63cbdd4215d8ad61f335a5794872030f8d03c59911afa4dae64358d097a
MD5 7134ab29aad64ac78942d549e40926f1
SHA1 e8c6870cea2afc3f68101a03c91845cfcc74a104
SHA512 4c55b4b87825f4a8ceab9503f62adcb3a2fcaefe2aa83c908a5a89256a8ce30d8dd13e99ddb24a4a878c647c7e43f504795d34a6daa0da9b5ff4f8147cea958d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzC:A3k03kB56rD
TLSH
T15F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/2956-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c57b-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2cc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2956-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f6-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4860-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c84-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019844-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-438.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a54-512.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-603.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-719.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-826.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-876.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-921.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1082.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1152.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c57b-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2cc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f6-40.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c84-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019844-226.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-438.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a54-512.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-603.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-628.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-719.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-744.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-794.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-826.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-857.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-876.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-902.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-921.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1008.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1045.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1082.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1127.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1152.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1343.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1368.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4860	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2956	2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4860	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_7134ab29aad64ac78942d549e40926f1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2956

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 868KB
SHA256 7674f63cbdd4215d8ad61f335a5794872030f8d03c59911afa4dae64358d097a
MD5 7134ab29aad64ac78942d549e40926f1
SHA1 e8c6870cea2afc3f68101a03c91845cfcc74a104
SHA512 4c55b4b87825f4a8ceab9503f62adcb3a2fcaefe2aa83c908a5a89256a8ce30d8dd13e99ddb24a4a878c647c7e43f504795d34a6daa0da9b5ff4f8147cea958d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzC:A3k03kB56rD
TLSH
T15F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 aa69b6c2513580490e975f7f0eded9daa56d187a8d0499044b44ca7a2d1bd8f0
MD5 f781ae5eb368d9309527efea7fe79368
SHA1 e596c97e776c4dc576e90d8deed0ecd338741cff
SHA512 e38972e570b945871d241728c4c1dd6cccf623182cd2f1a3b2839050b65a75f0c9fa639a073eb298bb2d2f022fabe3fb2c4eb3470cc46e30835dba469fd19be6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzC0Le5ji0hmxNrM:A3k03kB56r/Pji0Aj
TLSH
T169654A16F6A44B65D02BC074C5D2966AEA733C421F3087CB1354EE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 883KB
SHA256 f0ec7000338381adaab05d8e8b03ff2e5a6ad940352f9e08f2ae2b5f810937a6
MD5 373d396b819903e26d42083d6122e0b6
SHA1 b4eb0e29771b3e8c8c8752c7c6d9432c2744a33e
SHA512 ddadf9f112f2f48aa9dbf1a1c41d599cf33d8366f90e94bd118915d969cdb2ba4e40591f3fa508354114e20925f7416560fc90db3583971243b5dc6a9c0a9393
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzMa:A3k03kB56r
TLSH
T1B7156A13E6840FA4D10FC1749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 916KB
SHA256 e7014c21928e551ae56e01c7a955f5154e282e1fae8b51d286336b2b3ca5bd0b
MD5 098d3fe5567ae55452c3b1171fe8b2e5
SHA1 f4fb4e8744e44575bdb057d84f8cdc00cb712a98
SHA512 a8115d53e16ad1cf8eed0547db161136327fd93dfaaf981c98d68f8c776fd4e5ac8939913d16e5d3d95705e435f36f54817b46f0593411b7462ff54bfce789cb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimznb:A3k03kB56rib
TLSH
T11B157B03E6840FA5D11F81749AA58672EA777C421F2097DF2354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 892KB
SHA256 1883e343bb758a442a1cdd6db2c968534ee8306bd64f9ab6c9d974c371cdcd55
MD5 e8e9233880ea8be9ad7a6afd805e1e0e
SHA1 e399e81e22983e78eeef516730f08c59fef50b7e
SHA512 bc619e3d01a2d531b53725fbaa41345975d0125227439a5febc1889549af7bac90ff64fa3b6f37175a3c015f4344df7733e6139405e82aea6e92483ba20c2b4a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzl6:A3k03kB56rH
TLSH
T10D156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 892KB
SHA256 761cc531905b733468a35254a5528e80a4eacdeba360faa0bda33547285dde90
MD5 21546cd6c07ced685bc4e8525fc9d9c1
SHA1 7c26d5a70ecd4595f6ea887fedebd6469cb571c4
SHA512 80c2d7b10135797932c22b4ea09cec8e1a94a55da0322bf8b22afe2319043b129089d2d4004e9f2afb2abce53fad313fb1f74212c06033ae10652a6b7e847cf0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimz7N:A3k03kB56ra
TLSH
T191156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 892KB
SHA256 c6289e81074bef39fb68eb459f73939cd377d67aba43c90d85900f182c04b7ec
MD5 477498babee6cd7297b531e3d2b7e376
SHA1 5375c002bb828caeb5857e680ecc59e885c0313f
SHA512 d2c00cd5be0b49263cc421b187cabcb140c8b59536e2f88353c05ee33a25dc0874ccb17c4a8fcb46acc3253346cdd2896343e69facc30e1cb70f0ab4c4cce260
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzZf:A3k03kB56rW
TLSH
T1B9156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 892KB
SHA256 353982e9e2bf47d64b21a4ec6d908facccc74a7ecea39d225d335a217776186a
MD5 6c8b1e1106b762d3831fd838e08677ff
SHA1 c5e6bb299f500b0a9f6f1f5165bf7750fb60fea7
SHA512 d704c32163f61a97902068ec6d082cae615c2b706cd0df957f0e4b40ce3cf267ad6d0517f1607661f6b9ffeeb399bcfb71771ac265daa597bdcbc6d921610334
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzbo:A3k03kB56r3
TLSH
T1DE156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 892KB
SHA256 835849708b5387431431cb886807a75099db5be04cd0b5d112418c691810c9ec
MD5 351a913e8b54393cb937da41bee56b5b
SHA1 41d775affa74a72c33fc8adcc732f7f1c2ac722f
SHA512 f79c6d2a7272138eb06b13a6de2a40ce05d72efa2678556dd1f5542cb87edfc2574a8fb1bb082d9721cbc385edb4e26078ab1eab825e2d6dcf8449ee30735c1a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzPu:A3k03kB56r5
TLSH
T154156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 892KB
SHA256 2fa8a1c2f78c3e7d5e9abd57e7df1fce6ad2257bd22b37d10f885287ebd19712
MD5 f1e600238625a9733638b9cf9ac7be38
SHA1 12829c068d3198562480bb0b525fd88df97b4133
SHA512 797b0836aa2a833e9ed24b0252e4ef3001baa7b74ce9f13abd4eccd6f5f320839dee2544e19b289c33ccffe34aa70c38bb79a3e9668f0520c07b90f18d52b12a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzd9:A3k03kB56r0
TLSH
T174156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 892KB
SHA256 888e1dfa0e6eac5e29c734fef42d4e6c86df02097c303115129500b58f027e43
MD5 2b2074aceb623be488e5b31d077a773d
SHA1 2130af0b8c879d008b7ea4ab59da8002ac0e5cb3
SHA512 0108db17c3b359bbe6243f8ec469e6ba5b9f2e2cfe88b7674e093d3c13c4ff3a1008b89be84093aacc4a7140746ef94e65757041aa189d7f8a49f61f3c195051
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimz5c:A3k03kB56rd
TLSH
T1BF156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 892KB
SHA256 6744e1fc801df291bcb0412027a1ff93660c82171ddc6f9097f07fd9d054aead
MD5 177ea6a4bb55b419b192d16831be54ed
SHA1 b55b793a60d86e6713e217fe64f76abe67f1429b
SHA512 f47706b4ae8c092cb3d3e7333a81e2af1a44371389a222589064b62538f52198dd56aea82075886dabdeeb167b1e3ff6e470715e89993b3c26f8b2b60c465561
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzyp:A3k03kB56rD
TLSH
T17F156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 892KB
SHA256 be5a6b1bac853170626b72e581021ce2c071e8055299fae3f8b27dffef2d5dc0
MD5 03306656671de05694a1d77d766b264e
SHA1 c73a06ebe2cf12e32d9a8962ad6573faf79a9a14
SHA512 8ffe6b5d921a47378a2245b8127917e61514e3c0dff5fe4ba7cf210ac6907ac4e39c4c5cc99efd494a81ffa3ae869b8a602f1129e5fafa93cd7bfa8df76feb45
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzFN:A3k03kB56r4
TLSH
T17F156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 892KB
SHA256 6a837fa686dc451688daacfd217fb9e82c267cac33c044cbe6915fe1286630a4
MD5 2140b70a819e4c90c8dd9013d0bc3f59
SHA1 e925194485459bd4ae0fb0026963c8f8600f0e28
SHA512 f3405151471b6aa990c981fb9c7736c08c1303560542ffe4f7641d88a403bb2b8f7bce92d7d0e82b80905ee38d8b6e6cc794aeeab77874f851f23f5c0a2d21a4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzXF:A3k03kB56rO
TLSH
T1DE156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 892KB
SHA256 0832494393aacf4e54cdd647b261d563238454dfc05c8d58a6e1fd2a1e9ed918
MD5 c7132bfedc1d986b8aa9e1aaef21e71e
SHA1 5b68edba5bd91cd35205cf40cfbe7d63bfceda7c
SHA512 63bc9dd8e1a5c24875f13aff945e72202619189a1ff59b18b4625c0455314f7b27b9bec8cb2464dccd9ee469c027cfa90e5253711e649c7696d28f1e490740f6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzoC:A3k03kB56rq
TLSH
T19A156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 892KB
SHA256 fd9f93fa7a91d11dc6d12325b5b2eb2149ea623c09615420b1a665cc8909f8f6
MD5 054ce117a67709dae8b798b44dabc7ec
SHA1 681c12645d7dbc2db562fd3bb91720d18a2cf426
SHA512 2c9b425444a8130d5cce9669ec25597c5c22d82aa4e53576803efd4674f0da19600c7e836a69429c254aa7f64874d0821be99e7fa1cdcfa12a0996cd97e7320b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimz7w:A3k03kB56r/
TLSH
T1CD156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 892KB
SHA256 216b43b147ad0a3ed7c30049c6c6f545ed41db6d418a4745319bc87d45a0385a
MD5 d4a5cae84d336b15689089fbd264e16e
SHA1 9e3dfa34c6d79a509bab8dfa42881bf356acce6f
SHA512 a7ab76f84ff147bb4bb9dc5927a52f0635c83973efee8fbc3ef6cff68382c58cd80aded8fde61b669486d7cf3edf6804883f907febc71b4da0da338a68a192ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzCT:A3k03kB56rb
TLSH
T181156A13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 892KB
SHA256 00eb222ea6041d2368f62d5f1ee0779b50ddcdfb6926721464679438e19a894f
MD5 de86c40a9151d75dc6853995bcd34080
SHA1 286ffd465fce78eed4a2be29684e5cfe0d9cb083
SHA512 85bca2a8dd23e386d6eabd53968226df78a034d9497f13f2f1603081c487176ea4f94635900d7391254d9ff6375f36eb9abb934c2181e59384ae147e55d0797e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzSu:A3k03kB56rc
TLSH
T134156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 892KB
SHA256 f82253ba6870c7f8e95b6070862991376c7f5267357beee9f85618bd7c36c3a8
MD5 ca3db6d559474583bccbb06fd1c95e9d
SHA1 b344fa4bd312b7fa66b151bbed9a7fd9b0be7de2
SHA512 f359d26e58a2c6a2d9b290e33db762317cbcd3a67f0c80a0647f350051b58e74d4638d7bbbb07f54a276b07bcafedb379f99f64c98e56c6bd307b806d8f74748
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzMb:A3k03kB56r1
TLSH
T108156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 892KB
SHA256 2620a64740efc7d65688376171ff549bd4bbeeb9a762f0ab36acc6e50370185b
MD5 8d7e399b300bbdd04a7eb712605672c9
SHA1 46cac88de6a31b2939afe76a217455b7f1b13ac1
SHA512 19dfa3bd696208ba25e44ed33afea7bb4c8d0734c3ff02ef5a56e18c6a020388b9ec4ec520787bb64cf2f0ae0ecef7f081e4f4fde8a5942aeb23b3478e7ee97e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzyf:A3k03kB56r1
TLSH
T177156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 892KB
SHA256 9da807675aa13c044a61edfe12f4536b9a000e53bd1326fc9e6600052f325d40
MD5 5646d8ecee4ac6110204233fc3768547
SHA1 ee0567c58ab70af94c8e7b62dbd21a43e0c26f53
SHA512 1ee6eb1dfbaa00f682df14a7d7a0233429a764b1a9dc0e3c079bb035fb7f15bbf66106cce4372c73ad558bd37767fbabd58ba3c1faa1c124a3dd24e7342bba61
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzfK:A3k03kB56rt
TLSH
T1D2156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 892KB
SHA256 4679521dce0530e547af3b9abd9212f208049c034fe9bf8f795cfe3b5eefb72b
MD5 2b576186f8952ba93fe51da0502231d6
SHA1 44fcb77888117f3744c4e04576985a19539edbb1
SHA512 ea9c5f91c30cb48912a789025bd9bec227f1e49d5762d29f2ce6d7a8f58f8a2b6ea622bea03fc05453a05175abd06d1daaa07f2a455d0daa66cfb195dd2b1ee4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimz4k:A3k03kB56rE
TLSH
T144156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 892KB
SHA256 55b6a76490d80eb513ec2748435b57df909644e4831a0cec952d6c7f67216887
MD5 fe8a340f0faebf8b985818c1afe3b970
SHA1 ef7c7bc8784219ba188eaa9a676011f905e8bb01
SHA512 70bd6f38726c8b4829438c576ccabb4d569f5dec8c0f2799e57adaeead863c1c6d5b10c4acaa3aaa355c715ae185490a4f5cc2efef19d1c0115750f08431d68b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimz50:A3k03kB56rt
TLSH
T199156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 892KB
SHA256 98443c3209b0af57b7d8d713b214ca7920cc5e21d76af17fe94539c765022787
MD5 c834a38d898d90cdf8179b459b9afafa
SHA1 df19eca1a4dd67d11a2c26d37f404e02586f7d9f
SHA512 66a579b96bb9f7f57ef43bf6d267eca8ffbf98f0f9b5bd54544b5d6b21a4868e37df14dbcf3994f10db27d716484e12ad08228e66231ba0ba8521451a92a3ddd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzsg:A3k03kB56rc
TLSH
T1E9156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 892KB
SHA256 643a3f3315d7ac144d6653bec8ab9a0fe4970bfe3926a484c0a05b4da3debfd5
MD5 468a3d6a9b2ff323ad6a10c8c0c2053c
SHA1 7ad04c6529a5ae96ff580c386077a1f72acfed34
SHA512 d7a2f180958a12838e16920b6394f8f9975e8f7f62dbcd952cd484f4836177887c59d5acfacd22cc7397fe7f216418a8a0f5f45ef208549350d99f946f083e57
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzJr:A3k03kB56ru
TLSH
T1E9156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 892KB
SHA256 ed0d0a455fd1c1134498234e236eb2147ed884e8ad7eee48175f4075ae721d40
MD5 5b5065005d34d3585bf12b52038f820f
SHA1 71739c5f784d8cd74552d7c16a98f333e4ab6540
SHA512 ca613c4767974bfdda41cb3225691c64dd65c7b7c5dc10c5591d0590373be1d9f5eb2acf092070504038a58f4a1a3b64609c514330ffdf1d94522414673350df
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzrn:A3k03kB56rY
TLSH
T198156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 892KB
SHA256 27f0ae56436111d3f40b513850603760791d70c700d93a6abf08bc768ad2ecbe
MD5 c08da53f15fdc0a0d582db49a987bf0c
SHA1 c498fe0582732ecbbfe3d0ba8cbc33a3c0554fb4
SHA512 f6acc27636cc5c257064afe7711b40501658d4e6f534fe1709dad4b31ac57bbcbcbae0cea40a18ffb257e6605310b3e7af72f23e2bd40da584f0dc506dca93cc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimz3x:A3k03kB56rO
TLSH
T193156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 892KB
SHA256 75f1083269b50641e1c3b1561113b9e7426411aef46bbe994fe78b701f8dc8b9
MD5 b70eca3fa3693dd88da27584e5dbfdd0
SHA1 5df3b0ff56c4d97f792e7b83138c9227ccd5775b
SHA512 fc8210a74f27fff3cfb06e7d964d8a202be84131c788a4b41d73c76568fab703cc8f589b9b90536dadeb03502c9d36d69c163d9d6b0cb0abbe1a87182dd13781
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimztA:A3k03kB56rF
TLSH
T177156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 892KB
SHA256 61d37aa4efbeee7abb97c3ff726d53a15f44b434c3d0e5d05d37a5e6550e48dd
MD5 b339f4d20d479d403198ce90c1388a28
SHA1 e2e030fe538cb69e25c995ccb2b3f95dd5b2da91
SHA512 bec64827998e44a4843df6cf767fe8bb2323aa73c25653bd765e76d82a1db48b1e6e90204977947297822d3b504cc7553b298d8ab79a17c86395036adba1bddd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzm9Q:A3k03kB56rk
TLSH
T113156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 892KB
SHA256 882df5aad4198a4fa3b79693c905083ed5e7d859b04bce04a1a5c5112fda6dde
MD5 d505045a3f7a1f73276a4872eeb8a982
SHA1 68260c035f22a30df506307455b55ffddcdbfc97
SHA512 b1a4d8337ad4bccee2f5bc36643cc2a2dfbccab59433d7ee8fea7c8bd543df66a5f761bf4533c40929427a9ddb78e1b6f18016b056f307339645ef87cd33e1e0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzD4:A3k03kB56rP
TLSH
T183156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 892KB
SHA256 7f7025e066351afc2e504b4c2de845c6d3febb7b98a4be33a816418db9850794
MD5 789ecec570abd42d896fb7e236891ffe
SHA1 802c08b98a8f6159b7da3573580af13a3c4a1a8c
SHA512 751a18379cdd7a8e4a45529d756308328e444cb32b8129cea2246e0660359b9926413814810df2a85a4ddbfa75bb3eb6d340953c1544b1b6a86db0f17e013f07
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzqu:A3k03kB56rC
TLSH
T17B156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 892KB
SHA256 f5b4e6c4a7803273e800226dacfe427bc879de81ca5b7afb90e639d3f1d9c4e4
MD5 7eeb3733aa0dc09be653ba56fbb3c993
SHA1 759d564b1b9b75eeb3decf3898ded34fb0320ade
SHA512 5db7d5bd66babbcef60616b4087a43e6e10e8b6f7e5f6c956a1b0fbf35cf76a9410d5d20efe9d648285600fa738ed7ea6ecf76de18c065eab391dfc3515cfd19
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimz7j:A3k03kB56rc
TLSH
T128156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 892KB
SHA256 9e6b7850ad18bbc13b2d40ad7c8fa0916e0ab5a8e1fc50dc6a5b8e71d2038ae1
MD5 da8363f848dabdcc54f691f717b9ddc8
SHA1 2d62261f44c5a6a59fcc5bc4b0208c894d54c0da
SHA512 ce679a742d1eefa9d9bc5d16f259b6b60d159202739c6fb2627ecf90acad42aacbf6fea9453f40a0eec1cdc116a996a4db01b87045a609326ea71e7d609680fe
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzGg:A3k03kB56rU
TLSH
T16E156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 892KB
SHA256 79fc2e4c692192f4c65d82d52ce5e71ff17f78c8501c216453c75ee7129e63ce
MD5 7bc513ed3f370a5e1fcc3bc9c6d8148b
SHA1 8c1365e5999df9ed187310ca112e396bcfa456f8
SHA512 4f35335edf0a7d5b7d8f109194cd429f10ede95451046b1f72b4cfeb9f0360dbc493589fb210b130c72a45640e4a2806b5a49c5384a74833b4f415c0d860ef2a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzpI:A3k03kB56rd
TLSH
T1E3156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 892KB
SHA256 499a207c025a915e8fd2e50ba0a17fecb09f3632507c85ed6a1386713acc93c4
MD5 3eb310ccf511b06fd9e63e54d978e02e
SHA1 e6d72f7955aa9b0f7c09e421201e60f9b082c586
SHA512 0dbf2354685914294993da8d017c46a3afc4fbcd1f92c3befda3ea2cb74ddb81b547de63c541b0a4e792f0ec80ec291d97e2d4c42851c077cc0e79b0fcba2c57
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzLo:A3k03kB56r7
TLSH
T113156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 892KB
SHA256 8c0d880b9b398a60f6a162b3c080ce9f2210774113e383c44649bb3a20fca469
MD5 c490f3f823ba114e0de2a83164a8f540
SHA1 1e84e1c6e1c604ac27b0842d28262924e37a0227
SHA512 d6a03f08191f8481598011c1327408ce4357d84955a668aaf9b3adb82f2b9f6f7c39e8c657099410ec57d28094bf5afdc17f9f8d281c3ef75abc926e02528304
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzw+:A3k03kB56re
TLSH
T1B0156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 892KB
SHA256 dad70228421b5b087c8e2d727a5c87753a01f3d692aa604215deda1f05ea327e
MD5 5a9b38106ca2546d0c14005d75f54c5e
SHA1 fa456a633a2a89d213a90c52885a6455bdaa52e5
SHA512 debc27e9458a62ca1c38544883978af5f3819a5270de527277f7d1b408b892347342f255a28eba4f27ad9b2974ecad0afaede989945ec33f8afff662bddbacd6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzIQ:A3k03kB56rK
TLSH
T138156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 892KB
SHA256 92493fdfa02f53d910a8f73791fad91f1b67086b6481232b98669375eebb68bf
MD5 bdda53349cfda6ffffe4fa88e369afbc
SHA1 9c5a40f7974598dffc3d59df704755909956bed0
SHA512 ec1ffea011090f950dfc61c65dd96c8daf7e4a5394f2625796cfb35199410840dd7b4c26ece17369028fb36129481a3ceacdfcb52f249ba91706f0f5673b4716
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzBX:A3k03kB56ra
TLSH
T1F7156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 892KB
SHA256 e1ea4772d24ad42b1d9de342af9ee97c515867cca657778ca255da1f4c6e2acf
MD5 45b71cd93b7a0bc68953a38d641ed95c
SHA1 bd9855211ce48e9c8c1e227060d431c7d74a789b
SHA512 fce11689ba9320d29a3ba48b21e10ef1725a3af8f1b8a70d9a14e17c6c4068478aab0a79bc712d580a045ba723c443d57e8a1e392d60d84d95c01ef22523b7f3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimz7L:A3k03kB56r0
TLSH
T1DD156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 892KB
SHA256 f0d83c3b54125dcaedb265614e1b84ec4e666f1a1aa218253934d5cccfbb42c3
MD5 e208cb4d5abad87118f991b76370ed2b
SHA1 62bf580d375bfa79ee4c74099a9f209221315445
SHA512 33cd1547df90cfa48ed3794ab7a398e281385dc4a74b79c18349398a45a887133c63fff02373ffcda37b29709762368508888c6563024ff0ab6e7cf6e1a492bd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzBM:A3k03kB56rV
TLSH
T1E5156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 892KB
SHA256 a846da4378d9446519c97c637b52b0f6a0a904d295116e2498bdca100f90a324
MD5 8b52fc3f8871dcb9a7961f668c229681
SHA1 fe18ec0eca217c351a4b263ccef2a534866cdad8
SHA512 db71ba1275c370b28e20abf660f398a41672f6db1b3410044d6f5134d41fc7deff29e7fc72727967b65f39077391fbe3c60d4704ac16980f1601bc2248330d6d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYimzqh:A3k03kB56rv
TLSH
T15D156B13E6840FA4D10FC1749A968662EA777C125F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2956-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2956-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4860-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads