3d2b5df67fa13ca251e73fb1e91b4fb897121d0fef4af8ddbaffc70e63e9b95e

Analysis

max time kernel
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 910KB
Sample260809-s5ahms1bpc
SHA256 3d2b5df67fa13ca251e73fb1e91b4fb897121d0fef4af8ddbaffc70e63e9b95e
MD5 fa469f012ec29899b301d1cd00334fa9
SHA1 238b77f0526f135d98ec46fe481e77b6f469b10a
SHA512 0b78f430de9266754f3262ad6148bde2b38aa24d832c239934b09b602ba786abea48cc0103c5e2cb15fd7f5161e4170d6f29972bce15843ee3d1a7dc9639a627
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ra:A3k03kHRJi56r
TLSH
T10F155A07A6890FE8D11FC1788A968A62E7737C111F2097DF1354AE153F72AD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5848-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001400000001c4c6-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000016cd1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5848-76-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1772-107-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-532.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-600.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-632.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-723.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-999.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1042.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1122.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001400000001c4c6-5.dat	aspack_v212_v242
behavioral2/files/0x0006000000016cd1-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-532.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-600.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-632.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-723.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-999.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1042.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1061.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1122.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1772	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5848	2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1772	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_fa469f012ec29899b301d1cd00334fa9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5848

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 910KB
SHA256 3d2b5df67fa13ca251e73fb1e91b4fb897121d0fef4af8ddbaffc70e63e9b95e
MD5 fa469f012ec29899b301d1cd00334fa9
SHA1 238b77f0526f135d98ec46fe481e77b6f469b10a
SHA512 0b78f430de9266754f3262ad6148bde2b38aa24d832c239934b09b602ba786abea48cc0103c5e2cb15fd7f5161e4170d6f29972bce15843ee3d1a7dc9639a627
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ra:A3k03kHRJi56r
TLSH
T10F155A07A6890FE8D11FC1788A968A62E7737C111F2097DF1354AE153F72AD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 621bb3c2d3a775899f8d759109683d22c79fa0fedbeae1a316ecc8b3ac596cd7
MD5 725804ff460b200d83dd928d0630ee4d
SHA1 c14f4f81b042f742ab32a6852359cd0920e60b5b
SHA512 32655445a27038431b86a326ff24fbbf8572bcfa057545af2e408678ccc4eb653db01fb8255cdf6b0571026c62a19bfea61307a6b70f46bd345f77c77ea5cf59
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaP0Le5ji0hmxNrM:A3k03kHRJi56rePji0Aj
TLSH
T1EF655A16F6A44BA5D06FC078C5D29666EA733C410F3097CB0354EE293F67BD19A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 925KB
SHA256 3ae828bbaa05638d5f6ffce7c2b0fac789a41032d8238c73ee2c56cab2eb135c
MD5 0a9f44cd9e666a3d72365e4537f6ed5f
SHA1 63e398997cf03bc8ad3888fdd3150c3fc6cdf982
SHA512 6719e6f2bcc4e48055b9953b5dfe29f6df556358204847304a7aaa76135bca749277cc1381ed3f0c3a827fe15f892efde8cd310521e39c6a386b1949da00a105
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaRa:A3k03kHRJi56r
TLSH
T1BB155A07A6880FE8D15FC1788A968A62E7737C111F2097DF1354AE153F72AD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 934KB
SHA256 bca798f2ad02a622325597c98649255aa737ee1d74ad12497baa1443fe8ee42e
MD5 acfeae5b454a335587a3c1d98fd60bce
SHA1 d2904f1c42195fea6ad887c04f3ca9481a7fc3dc
SHA512 8e0aa25749a1376a7f5c73c8b77a4c3c37886704ac1deeda0e3a7b89e2de57216f1070e4affcd7a7a0d793c883f75b91150e13b100446909ce13f00e17ec0d64
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Rao6:A3k03kHRJi56rI
TLSH
T15A155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 934KB
SHA256 23081ceea6eb1741f0fcf84ed165936b17813333386d6a2fb3e2588e510610fe
MD5 01c3fbfe7a9fba2c772032f14a838ebb
SHA1 3bb84f22fc56d034c26553df3d238372e59ac048
SHA512 b60be40afacb5f6c6f35dae80394f420c907b375e88b4432b2f39c11a78a869d87a4dcc60979320bdfe974f1b1fe931c4f05770a3336af66e03e60079d3e0f01
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RasN:A3k03kHRJi56r1
TLSH
T1E1155A07A6980FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 934KB
SHA256 6b50ad289cd28dbc666886ac43340ad51824e14f2666ff78017ad63d65bfa78f
MD5 86ef57976bf35187529fb53a168d019f
SHA1 3f832500fc7486fc967bbda35cdedf798c25a9c9
SHA512 0bdfbadabc1c8b558644ea19df342c653c179f62f6ae936cbc9eee109f7c52243bd4142f3b5c88a51ec2b8570a308ef6e898c45d5877bc3bd0075568bdd883e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Raif:A3k03kHRJi56rt
TLSH
T1FF155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 934KB
SHA256 e4b1afa3c2048c4d6036839058e0ad798f2a144d3d1c0a751bc4148df0fc47b3
MD5 0d9d76880929d04aa163ba0754030ee8
SHA1 cdb0e9fe09096aefc1572a40f76c9b14905ae64f
SHA512 cd8b0d779b127ac7fea918cb15f3f8560d5d381a90dd0c691dbaa404cef7b89796e1f437d83bce964d9ad237c0283722621cc2a049ac56591b19af7b45cc1950
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ra8o:A3k03kHRJi56rY
TLSH
T1D4155A07A6880FA8D11FC1749A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 934KB
SHA256 cfe965bec7188f79bfe6e36059e43d482e3e86086d3a8e7b90f2428e4b3a15cb
MD5 92d0ca8e733c6082c583fbb5c2449cbe
SHA1 c7b3eb6770eb5ca466f9c1c3ddb6dd971a598e49
SHA512 aaabc1e8a43814f2d429e86274dfcf4b0e189f39c99289d29e5d4d9af762e094eb5038cbf28abbd9e0d1745070df5072d602a8c3b422d728804bd9daefc7ef19
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Racu:A3k03kHRJi56rq
TLSH
T1DE155A07A6880FA8D11FC1749A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 934KB
SHA256 1349c4a8efd2d0b2f33c7e32145ee8c0d43ac0249b28e9b8f446068fab35a91a
MD5 ec32b9153cc8e3679fc08c40c027506e
SHA1 b16cad974d69ed58c3fb10c110f8abe372641900
SHA512 fbb8ed35780150c5b632c65c389cc794d6c395f1027e0bfefe0d8ce1cf4063f5261d16460ce642a18bfa7ff11c2c34dcbe45522857845344164fb9c4dedd9c5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Rag9:A3k03kHRJi56rL
TLSH
T166155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 934KB
SHA256 8325c98a1c4910cef27193e7ed4a41ff07d274dcc940eba51c34f960ccb1dcaf
MD5 15e6ebe7ece52a6e1b8232f662da3453
SHA1 9b481c2a976de56273f376c99c7c9e08a9bb24ad
SHA512 ed01b2a08dc1befe89d16f795fba8aa21f92f5066cac8c34c9493111ba5c4aa7c9516a68dd6e5935e426695f93496992a6e5a494342739d9c3cbdf1cdb4bc21d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Raoc:A3k03kHRJi56rC
TLSH
T1F5155A07A6980FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 934KB
SHA256 7b6dfe17b3636e7f6c2353f1136926e8dc5a2ee0d0a31d3bb6107ffd7c3f667f
MD5 d28503d1931ece7f9ebc7862357c3a00
SHA1 7a9bb4ae969cbad2671584b4da3f2e4cc0360979
SHA512 c985ad2b1aeb355c28cd6c8fcfcb3415eb248afd4da925adfceaf2186b2d19674b5590dfdbd6c807617a2f039e81e0c29484a6c5ae535be92bf71e5b665c4660
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaBp:A3k03kHRJi56ro
TLSH
T1FC155A07A6980FA8D11FC1788A968A62E7737C111F2097DF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 934KB
SHA256 af37b6271e0d426250b32d8ba04f499679ee8e31ab349266ebd63baa1bc9fa2b
MD5 73d8821dadae6d939409720bfb3b1ce8
SHA1 b8397dd5359db0d2de7d90c21c5be5f0e57a62de
SHA512 6ad92302343f18213860e3121efc6aa285e8735bdd6983e73dd69832de476af4b34db09c163323748dcd2bd694a34a887c3de9e0f12367fca66f592434eab366
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaWN:A3k03kHRJi56r3
TLSH
T15D155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 934KB
SHA256 a53e0bf701fc5ca7dde8da580e87b4244d500f0472a18c7d7a4869e9c6bd1583
MD5 a52d84014923a4dfc55c628140d605fa
SHA1 45c47f3966cd49b7bdb2881943efdfc79e10792b
SHA512 f8d782f1cf82272883ebda08370f5a8fabc4143d36a3f70e0e4410badb1e285fc617c8ae52880cfe52b05916ebca48ad08809be8f22189cee18939d11b3c1258
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaaF:A3k03kHRJi56rx
TLSH
T153155A07A6880FA8D11FC1749A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 934KB
SHA256 e99235bd3567f1288a4d9918f3ee3f003e2782e73864f03061ca1a01be15a33d
MD5 c28138d1390c6e5c19a658a8a9a8736c
SHA1 c15233d2936e55c82127cbabd52b3f6dab3ca537
SHA512 4634b6451685a86a724d55e074df89410c00daa1b254060bbd4507eb5c8c8d0cf201977bae43bcf768e5bdcfdf1907c54eaa741e917d463ba3e77fa0c5109405
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RavC:A3k03kHRJi56rd
TLSH
T11C155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 934KB
SHA256 697229ee8aade9b46ed7ad90f780fe9aea87905c562cce18082817fb709a0f8f
MD5 44b00d0e8f2f74687ddaed005333a6f0
SHA1 d83505ae09e5f85557331dc81a44ee85a6291c58
SHA512 dafd3cf559ee7caea10c78930ce0c14d767e93864d958bda2ed662c361531c3fce9c1e28282a9175ea7d66ae701ebf99d75a88f4637163dc3d6d3bb638d0ed24
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaQw:A3k03kHRJi56rg
TLSH
T1D1155A07A6880FA8D11FC1749A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 934KB
SHA256 a445f866d3d65bda38d4eed216beed200f8eeb31580a8b934073df7544469132
MD5 c83d76bd011ef7da7c34a2a571a1c3a8
SHA1 29d90f1afb23f09d38b8fd35132d084a8a1e2339
SHA512 4deeff7dd1384bf373432407769063d993bdec3319f7226806799091372bd1ea3563df603f176fa104a463d50232bc48db9dc7ae1c0cb996ca64b47a755e8768
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RavT:A3k03kHRJi56r4
TLSH
T162155A07A6890FA8D11FC1788A968A62E7737C111F2097DF1354AE153F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 934KB
SHA256 d54d81fecabf61b6aae9a2f55a7fbb9fe1b884f9ee73a774ca0ce8632154f583
MD5 451239af4fca5e953aa1ae80401ec66d
SHA1 4ea8551c627477d916931d0de234a794616accb9
SHA512 aca5edded26e7d1f704994be6c07e08af29027336622ce0c99dd73e337e765a755b618e7da9925545ff4ba03007012bc16371ad6cb5b257986ca25861cb7cc74
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Rapu:A3k03kHRJi56rH
TLSH
T17D155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 934KB
SHA256 f33c85c7cfc1c95d2ce7c99c758e2192c0c0a72f071769f58207e6b4a426a8c4
MD5 c5148bff96f576cacb86837ddaabbb34
SHA1 4a79a58859d7faad115a0f4100e91abee1fb0a3a
SHA512 5fd9b7418f1d2d9ce0daa1ebf5e953810e93cf83695276f46136c473b1f2992f727b786f86d683440b42aa46e883206c08c948da934720195a815c4821068bed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Rahb:A3k03kHRJi56r+
TLSH
T150155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 934KB
SHA256 86aa47300efbf34808ae4b500f674cb22af4822b6d158a5ab0f67238e16d68bb
MD5 f36e0cff2c4859394bb8925c712c01e4
SHA1 580ea439bd63511917b348588fc942b1ba17cb70
SHA512 5e908adc7a9e4e8d5631ff182ab9b307ef441eab1db72829249d09a54e251d811e52ddb6c718150229e0dc55009b11760abcd9d3232006474013f91f28ab2845
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Rapf:A3k03kHRJi56re
TLSH
T192155A07A6980FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 934KB
SHA256 71c63b7e8df32990a5acf404a1df3795a7fb8741de679fe96c972716d041091a
MD5 7ca37b4cfe2c095fc4b1c888ce69cf23
SHA1 26dfb23c148919946c44fb9a51125d8b031f9ee5
SHA512 665f56ba837ea390e7dd8cb3a0bfc6bd2cd786c46090c3e7d1abed8ea006d4b79fc45ea55d262d9d598bf36f45eee5fe0cf9806697db8ab8b9fc3085a6fe1b1c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaSK:A3k03kHRJi56r+
TLSH
T1D6155A07A6880FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 934KB
SHA256 18c267f94ac9b12069095e67cab6f4e242fff2229ee9f187326a4cae77732b60
MD5 825bad14649bbee350295f924d8d6bfe
SHA1 86f7f994662b513d89c9ce2a323dcc73f5dfa20c
SHA512 d9774ac77734340ba75b0d1297c3e26eb4553f7eccc7b347e1cd0cfab1c817d6bb5c483f799f317dcc48a45ef3d76d43f0ff7f9b72ab26ca47ddf95f28c27e76
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ra3k:A3k03kHRJi56rj
TLSH
T15C155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 934KB
SHA256 dc1f805069e6ca95601529ba985a7671f9bd8fcc95c1a7217a6c161684837436
MD5 a3e09b6ea2ccfed34d6da472dfd8be14
SHA1 189c4359815224860c4740d18b1ced69b848bede
SHA512 c6e3e24b29f60ca2b34a83b3033ed3e5258aaf141c612fe6b0ac9494874e11772eca35da8ee7c6c924e7a7f0edb0cea8edf1beba2ed1ad3609a9844e153e22b8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaA0:A3k03kHRJi56ri
TLSH
T12A155A07A6880FA8D11FC1749A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 934KB
SHA256 6cc95aa6187bf4c9251830639819f23b3115342649b65b4546071515e6233556
MD5 fba0e5c2203d397280774eb1a6a65c10
SHA1 79cc9c59b84e4874e65bfd7f240dad61b90cbc0f
SHA512 c9530961dcc936c111bb992292ce07bfa560785f44b81713cbae1f3d47976a7995ece11d4df0192fa292927eb08be3c256f12d45d97f97696899b16420918cf8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Rabg:A3k03kHRJi56rb
TLSH
T15C155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 934KB
SHA256 62ffadf2b5564372d0a26f45b2a07fcd10806683669fd52a6d197fdd226f2996
MD5 6bbe5c14a7c08ea9eea3dc8074db3a2b
SHA1 097495f9c382c922fb80442682d77a26d6e97b9b
SHA512 f3cee33dfef15da2b863940e434513bc72db87c8f4d5a027a16a3d7a74c2bfb47a6bcfcf4902326c794da5d895cfdeabf641667dc77e79bb2c545f32ce6b1e9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaWr:A3k03kHRJi56rN
TLSH
T10D155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 934KB
SHA256 7349ceb8b0a1425203abf6e1acd63dda61b1adf248ef165a4d744ec70e637e36
MD5 ec7859eca3b74a8eee7c019a2de7ce2a
SHA1 19cd78f2aac1ff6b97e55091f12b515cc771e79f
SHA512 32f92077174f3ad247469dcf9ef285c29ff2bb121b295ae6d3291b13d34edd5690c3cce199bcb2caf57264915304b5006d8a0f283f4b8be6763cb57d91b750a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ra8n:A3k03kHRJi56rP
TLSH
T177155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 934KB
SHA256 a8b2ffa8486544daee1a3a2402a35211e6f5a3e5a17e06ab4fb087dc3fa4d39d
MD5 f4612b333fc36ffa4fa2c0ad47308814
SHA1 106cecbf5712a84555deb55e064378786cce8eb5
SHA512 dd51a5bf366cd53222518ea0d5ae03c9022ac4e3df4f557b1c8e6e25ba229aebc95c5aebbb3ee439b6cf68b2af5d156ac501e505c85b18a5e5ff16beb85847fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ra6x:A3k03kHRJi56r1
TLSH
T1A3155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 934KB
SHA256 53bafc1bd7d4b57177f947cb25a7b0bf94e29da568510ef5fb4a2cd3df57a601
MD5 4beae83a605eaf271320f915c65cd21f
SHA1 62dc46b8f68c113d08b8e60c4990d392b5fcb147
SHA512 45ab85438b60a1c42f38570ed0475c817b8ba95c73dd7a069f2dad80316ea3e3c4e0769fe1f52480fe85c601f4f1cc4037212fda2845892a96fed3da10dc47f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ra8A:A3k03kHRJi56r6
TLSH
T153155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 934KB
SHA256 f7d0f6c56c453030b4230de08a2904499f9dfdb41b1863fec5b7409ad50f4cd8
MD5 61b47ed89664b0685f5a06d5a27b57d2
SHA1 be8d5e1fb027daa64715879d72f4eacc1784612a
SHA512 61e3684f4e04d8f450e33458ae9641f2f44f4fc726b3a7aa89b1ea69ea332dac9cb26b733dd155b0295e0451a5a4133c7d280dd7209709dab8ce356b5df847c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ral9Q:A3k03kHRJi56rH
TLSH
T14F155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 934KB
SHA256 796aebeee44d1d7c3a951c5dee8f233c079dd44823b6cbbdd5d01cc35ecc6586
MD5 77c7d8f8d621cc0c15b1567502389303
SHA1 c1f68776dd4138bfd1a8e898b5af1999e98cbb3f
SHA512 68881aacdaa677640d8e60e26c1f13dbc2a6a2f81f190923ef29a4b86bbb2628768da641bc5267f3f8958c22627994089807a3d4bf687f9cbe0f7f1fe8b4c7d7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaQ4:A3k03kHRJi56rY
TLSH
T14E155A07A6880FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 934KB
SHA256 3df50fa9b4b0a387f308a189ed2f081fa2b45bd77f6067f3712b46ddf0db17f3
MD5 ee354c958d2de092321caf2e22a87bd3
SHA1 4194242b3030123b03598bd7276294d12b706f9c
SHA512 eb25233545b69608ceb540d4ff1a6a3a23778b9032a2e44a9e61006b8fea2fb993ff6eefb2b5915c61f1a74d701a4ad2112baef27e9fb28a650ed96a18e566ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaTu:A3k03kHRJi56rp
TLSH
T160155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 934KB
SHA256 8b9743257415c609f23c22b754287668233960cabbd4da68e22dbda66a146c03
MD5 01e5261576ccb69b4369bfe2448c2038
SHA1 d587e8c3705bf4166c73d1ee0e345c83bcd66a6d
SHA512 03f54398b4f3c3a97a187fef46b0fe9d46ac664e5e42d126632e91f70dbd93a50ae0eb18d62168e4f3bb38fbdf1572f86c2e4dd3354e5f42f7b9c1028564ea4c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaOj:A3k03kHRJi56rz
TLSH
T1AB155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 934KB
SHA256 c797f7b56c30c5eaa314b38ebfa756953e148e44eec0f6b2451fcebc6e9ae3dc
MD5 91d23289e1d5a7c55ab1c567611b642d
SHA1 1335ece2eed941bff8afae4c74ba309082085287
SHA512 e4df3fd93970e5368261d995476eddde72c8f39d555041960c78395684602c77587d936fe4349be72971a284fd7286c49097e84b7795ca82967a0f55bee32fed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ra7g:A3k03kHRJi56rb
TLSH
T10B155A07A6880FA8D11FC1749A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 934KB
SHA256 d54f777e2c4d8029d843bf61a0116a9741e37de88ba4e140f871c2d56d529932
MD5 15b307f72d4c8b25763ebc9cb5a3931d
SHA1 4032e2aa6a3bdb5aad64b01e2b4008c0866bf834
SHA512 aeb1b6d669777315ce0dfe05b2d2e2b8ab56d6f6cec6fde3e45fa6f979df7e53164aefa105113650a5a4ee1807b6c396621ae98b2fe9b55e61f08b7caa08dd60
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RamI:A3k03kHRJi56rS
TLSH
T1E0155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 934KB
SHA256 f0115e744ad46ae0e1d18c2d2949ef2fb6fd7547a5058fd55ba0f887fe936314
MD5 78815455fa22e6d13ef3a25743007316
SHA1 6418694074cbedfa93ceebee2f6359f6cc081522
SHA512 e0f6291fb9b51f0532a60949b1d875b5db902ffb29a92126791437bcf2cc71179c4cf507c8bbfdedae70b6db5871628ed6764ae74584f555a804ee73a96d52ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaUo:A3k03kHRJi56rw
TLSH
T158155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 934KB
SHA256 3ab63606b3d694cc7cacd80daeb25c7914e964a80c0ae315d6e539cdead241c5
MD5 e4836cd181a848030c44cac56927c0f3
SHA1 01664351e586522823349cde5fd7e5711242a21b
SHA512 9c0f60430c8893f7922a54362a91d5c29d4089f5396606eef9acf9e9e3fa738d1f51140745f412ae6d7297e1a09ce6253b7faf7b862daffc8383c390bb31d388
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ra3+:A3k03kHRJi56r9
TLSH
T1D4155A07A6980FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 934KB
SHA256 bbb5996a9d5e29ebc625043283e1c347d9ffa14e56c73ec00b315a4b5749339d
MD5 7a8e5ffb40153d956e668853faa1f6a5
SHA1 7592c5997d9b88f3f50498a3dd3a586ee94598f7
SHA512 6277341a311847dfa2e6b85753b5674632bc3c83d546e5e4f8bcbb170c10f6d222a9f9c7f3665fd06f16bd767f741bb8f9a15e1c67919bf3a3fa86288b134b46
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaNQ:A3k03kHRJi56r1
TLSH
T1CE155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 934KB
SHA256 d029324782020f1c6c376b72156d8b04d5959fde4e2daaa4d1d291a7d130a331
MD5 209c769864d23a8f876600c9978f942d
SHA1 43513a173fa431009184f754963056480e60c4e7
SHA512 410a91d6bc63efcb3e6ddb94545e2d0828458f370a25d0fc4c57c5013e64845c746986a27c0d01e4ec0dd71e0d2dfa2837afc9d279b4980e902d16809692fc56
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaCX:A3k03kHRJi56rh
TLSH
T153155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 934KB
SHA256 870d2e7fe4a9c903746955054811729d00f63b1a0195c2f80c43bcc697c5c023
MD5 8efc9e44295303d28d9e45c30b6c1d5d
SHA1 80dba12973e2885ce521bf648efd11d5747a1aa3
SHA512 f1e6a637c119fcd7eff2e4e96711b65a6abfe4d873afba9a66d9f5287ee1ae2d578d0aadb74559aeb8a30072b02ff0a82ac7e4591323c411f469320d51812e2b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RakL:A3k03kHRJi56rr
TLSH
T101155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 934KB
SHA256 ce238203b79553b95fc3375b66cb2cacc8db237304cdb1478d7a0998cd8c602f
MD5 c8e0dd148ba1f3266832d346fba1c4db
SHA1 d53456103e6883e77fa8c4869142696d11f7a07c
SHA512 f060536549570690b9fbef2c990cfd1c6d4741b499210922fe864ffa1250a2a1059282434eda52115e9822f9619d7dfc2b90120c4f6089034c119cc44c5ef248
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+RaAM:A3k03kHRJi56rm
TLSH
T121155A07A6880FA8D11FC1748A968A62E7737C115F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 934KB
SHA256 c4785ae6c76b6a9a044e7141c4bd551067a8334179c35d385f65d3ba1b16837f
MD5 b640565361b6dcd2f156572df3e771f1
SHA1 66006293b5e74263d6132446024b858c6289135a
SHA512 8695b6a793fddc93c75e1488ad2a70aa2f10ebc053e4f677f13fc0a9e92cbb4a7486fd102a8435a63d7f4a01c386f1514643314590f25f720580a4e14b654e50
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Rahh:A3k03kHRJi56r4
TLSH
T1E3155A07A6890FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1772-107-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5848-76-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5848-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads