93e1de0cfce2598d0d1cd3211d9363d2ae13991f1225314938d6c21d955aaee2

Analysis

max time kernel
92s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 829KB
Sample260811-155b1sha36
SHA256 93e1de0cfce2598d0d1cd3211d9363d2ae13991f1225314938d6c21d955aaee2
MD5 ccade924620ca3102bf22cef46a9f0c7
SHA1 a217eaa2e337f724cf10e01c824646062511ac2d
SHA512 ebcba69c43b0950de8420ebde0c34a04caefe2196a62d761cb0841f52ebfd2b508e3e96df85935d6874b9e5bb221ff602b2c79d6266dfb77d952834593e17793
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994a:A3k03kB56r
TLSH
T158056A17E6850FA8D10FC1749A968672EA737C025F2093DF1354AE253F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3388-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c629-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-45.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3388-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1076-203-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-514.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-715.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-974.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c629-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-45.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-222.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-514.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-715.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-974.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1085.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1129.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1321.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1076	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{CDB16BBD-CB19-4D7F-84F7-16B278A1D844}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3388	2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1076	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_ccade924620ca3102bf22cef46a9f0c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3388

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 829KB
SHA256 93e1de0cfce2598d0d1cd3211d9363d2ae13991f1225314938d6c21d955aaee2
MD5 ccade924620ca3102bf22cef46a9f0c7
SHA1 a217eaa2e337f724cf10e01c824646062511ac2d
SHA512 ebcba69c43b0950de8420ebde0c34a04caefe2196a62d761cb0841f52ebfd2b508e3e96df85935d6874b9e5bb221ff602b2c79d6266dfb77d952834593e17793
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994a:A3k03kB56r
TLSH
T158056A17E6850FA8D10FC1749A968672EA737C025F2093DF1354AE253F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 44165481dbb95d717e80fea2b35ca3a7d20a25c8508b28fdc6cc323ba6fd47ae
MD5 fcfefa6fd30316d9b5f874171ad02ef0
SHA1 a7737b0926e19240166e725365b38e667327f2fb
SHA512 9794707cd91c81d9d38c6411d59f017a8c148f12b00773b96aac5a55357472a77df298c0645b0d417f414cf8dd0eb40e0c5103b57cfffff3d9eacf4269006188
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aP0Le5ji0hmxNrM:A3k03kB56rqPji0Aj
TLSH
T1B3654A16F6A44B65D02FC078C5D29666EA733C421F3087CB1354EE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 844KB
SHA256 6d496f9cfc5895cf6caa47ee87039f144c68d460beb39a4373cea704f9f2f1ef
MD5 4fa31fe1b4013a738139397b9f9d74ea
SHA1 0b8b4a9a3d91485076f65c41b52a7fa260909ccf
SHA512 a256a5982ce694f7abe0fb96df8069f4602caa03796e63fc3e11e3ec8ac2d88e01d56405343e32f80b90cfecd2531e806326974569fc9b854d9cf6d981e4a994
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aRa:A3k03kB56r
TLSH
T1A1056A07E6850FA8D10FC1749A968672EA737C025F2097DF1354AE153F72BD0AB3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 853KB
SHA256 0f0ad1fb4075d38cff9faf63570dedf819555bd1c7f354ccd37ee1f67b9ed7c7
MD5 b1a63ba5c00a849244e320a9d7394394
SHA1 582d20e81edf79aae3040b468e144e8f13dabc96
SHA512 e922fb1ce39e4b5576604f5f03678089e65dd1b7d49b520e30c391647e2738f869fae1761c2ccf19e2866b68ed9cd32df153e5cab189129bb900d920dcf44405
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994ao6:A3k03kB56r0
TLSH
T112056A17E6850FA4D10FC1749A968672EA737C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 853KB
SHA256 b3fd8e7e62af9f7d522d7f416c201b77aa2f9da36eaa754b64a3c8432f03c9a9
MD5 ab5a6d65cfdfc77e3f7a433f93ebfc44
SHA1 6a5509b4f4662c9da42e7a90f84dd706b5deb7ce
SHA512 bd70c96c5ef06b89747f0f6e12e508579363739e9e5345ee8ac0f383eb3549914f2582df874f6140fac7dcffe542725adcb099f4209d54aa85acccc49b3eab25
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994asN:A3k03kB56rJ
TLSH
T1A7056A07E6850FA8D10FC1749A968672EA777C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 853KB
SHA256 6eef0e252819ddd2b3a1cddef5511f8c3d90aa294059702a354886b7d9c1620f
MD5 77ca467b7227e2c1b92fd33b7cee4a04
SHA1 6a89cb3675b936b3e63f418d2d600d545611f8fe
SHA512 f462d64aa632dfe0fcec22c4892b8d669fcdfec34be79a7a0fe16687188b44cba5b19189601aca452838d7cc7913aa379580a07c81fdb04795efa3be0aa99b2f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aif:A3k03kB56rJ
TLSH
T17D056A07E6850FA4D10FC1749A968672EA777C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 853KB
SHA256 5a0a55256b578bc629cb4288d6d0c5773b87a036f1f64c93627f5f7ec44d611c
MD5 3b0182b9afbc277886068d0e18c26141
SHA1 230b2345790552ee626801f78d9d4e686f05cabe
SHA512 8d54fc4f5ca3d783a313fe37b64a02017d555a2fc567799dbcf1ac848ecc97ab6520244dc1d3c9b18a7a2084e1c86413434c73d01929a2acf86b54e1ccc57b95
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994a8o:A3k03kB56r8
TLSH
T11C056A07E6850FA4D10FC1749A968672EA777C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 853KB
SHA256 2975c3180c8e3189ec2f31ec0ab18d0e52d788a99cdef2cac47342cf9054662a
MD5 266a903aabc93b31da4c76e5bd1e4df6
SHA1 81dabd0a0082018a3eab0b941cfb24451b6a15c6
SHA512 eee7bc6e00080d4a768a4d4844b1cd39423cfbd597a41ffaf23480ad6e218b99fa38274b371ba78db992b2cf4cbee909507ccf3aae819eac0b4e1a6f3ddf2f77
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994acu:A3k03kB56r+
TLSH
T111056A07E6850FA8D10FC1749A968672EA737C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 853KB
SHA256 54e955b0820c0c60861ec6132fc6939b4f4808901651c7361a8010ce487d83f7
MD5 b6cf3bf85ce7fb3f31fe32e776dbd954
SHA1 61b93323dcc946ca6b8c6caa631a72a9b7633f0a
SHA512 0eed33c2c2b606d81ffbdc99e786db66b88b91125e4188ece4f18eb38aef5afd62ea8844f323f018a831fd6f060b9fc2a65eaf08a1c0a0d533952571677e2c3b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994ag9:A3k03kB56r/
TLSH
T1C6056A17E6850FA8D10FC1749A968672EA737C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 853KB
SHA256 c87ce371efaf2052e29941c3e103b366abbd0c939779243179c34bca3a3a24f3
MD5 a563de8190cc967caa9779cf68eec6aa
SHA1 19466855206e6fac8698feb6ebb8202b2ae4c203
SHA512 6a01639e2e9e307cd172853e14d06bf7001d85d8eb3186c80f35d3c02599fe2fca08a3420d31c4869dae7a59246a0c7ce6a1b3bd609049e3aba56e1e3f4bb605
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aoc:A3k03kB56r+
TLSH
T110056A17E6850FA8D10FC1749A968672EA737C025F2093DF2354AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 853KB
SHA256 4bf077d6cdc92be02c5052791ec7a490b77f23374d73195819c6fe9bd8e0db76
MD5 4734e8822efb1871edeb652b7b7d0d86
SHA1 49c3642ad17ee30c0c65e775015bb5c13c489fe0
SHA512 63372ff939ca1a9b222295a4ab48146497ff826bb91ac4dbc825522c21c67213b9a257f8efb3625c9a4de88800537a4af91fd61bc78138f033dcd0c5c4a1cfb9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aBp:A3k03kB56rM
TLSH
T17D056A17E6850FA4D10FC1749A968672EA737C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 853KB
SHA256 c5183f32f65748c4ac9af680c59e4f254ce5ca4a2461270c8f46ea1bc3086397
MD5 7e173c965de152e125776e55d70be307
SHA1 a40475f75c3b9b73be8f0b378200d477d04aa0a1
SHA512 9a664e4ade95a3824cde0be913204d37fb76a564f111eaa019d20435cbb9c208a8d4476dc07910c3bb26001c06d24bc1c0662ddfc13b6a79936ea703fbd3dcf6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aWN:A3k03kB56rL
TLSH
T130056A07E6850FA4D10FC1749A968672EA777C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 853KB
SHA256 13e1108a22947e2151d097d2027b205c50041aea1a8fc33d1009514551109057
MD5 0f0267d74f2e5493e7b56317428b119a
SHA1 29a19f3b0828bd570c63b00dc85cb4d2fcbaeb26
SHA512 a543e2104bfd8df841aa97f9c211cb380b3907296d88d4e2be03a2a8e491b322bd06a4d00228e70c6c899004d7afbb01838ce7a2ffee0a9da2daf56f32a1d127
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aaF:A3k03kB56r9
TLSH
T14B056A17E6850FA8D10FC1749A968672EA737C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 853KB
SHA256 5a42c8995e24e6bc1ee760c28271e1fa99872a0b5b54a9a58977eec5ee1b7ffc
MD5 e04a0774db873406427f29ecead88acf
SHA1 7ca5e43d0f12a47760599189d268b971fb081071
SHA512 7843f6cf8cf571bfd1cff3c1d01e5ac33123e5cd9da25c67220ca7e77fc9590b9a2d3cc8b947e8041b795b308158eba19fbeff256df0c366242d8077942063de
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994avC:A3k03kB56rh
TLSH
T101056A07E6850FA8D10FC1749A968672EA777C025F2093DF2354AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 853KB
SHA256 3018ab5c7b326a51ec27e93a8573e4e07dbf1da6a91f6d175f471fae1fb313e2
MD5 b2ed1f39867bbeeb75b0a0fa31bd1738
SHA1 1d74b9482943f759ffdfd568b18d2cd0dae2c374
SHA512 15676a8060c163c2e008913d87e1de563ae7fec0e52954795e5e6d22ea96b54d3727edf8f97af960a37cd3bb458b2cafb6f678709eea5f94086dcd97d0328abb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aQw:A3k03kB56rs
TLSH
T1D9056A07E6850FA8D10FC1749A968672EA777C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 853KB
SHA256 adb8bc70fe13791d00bee38c57640f126f625d0afad6f79349731da822291b47
MD5 cf596d91b4d9ea170598da66c98d00a8
SHA1 fc0173110edeef963c30219f8b95234f147a250f
SHA512 633b9a5dd85b8d6e08d78706b2d860eba561ae5c39f06847f723de053963277fd0eb5c0992c7eb6e1cfdfcb10c21f6c9caf6a898bbb388472957580d57b30683
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994avT:A3k03kB56rU
TLSH
T127056A13E6850FA4D10FC1749A968672EA777C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 853KB
SHA256 f3eb2081f01b9afa2cf37f0f5324108ae4af89dbb95d0b651c08c55892c97fbe
MD5 2e3b4330953302126ecbc302087c0c8b
SHA1 508083e1c80f662db4c15ed9048045a9627ae005
SHA512 3fb8ba374b0eb0f8c5505ab8d482d07f46af7b0c9d6cffaa15fcc9e01336f2b5723c37c871e59ecf733bfdee15662a925116216eae94763f7f12bda4a797f84e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994apu:A3k03kB56rD
TLSH
T1B0056A17E6850FA8D10FC1749A968672EA737C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 853KB
SHA256 2515576bae9f581252333c549180e55b0745fc2a07d77a3893304da1c8f5e527
MD5 25c19624982e29d6f08421ac02170089
SHA1 dcd85fe7ae259097e470700759cc6be46db5ec29
SHA512 ed9c24b673367e2254ff5cc5550855715411b9c45536fac2413732a742f6ac4995dc2b647a2d547323bfc6348295bceb9fde8288a977bdc5f7f2bc56e58ed0a8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994ahb:A3k03kB56rK
TLSH
T109056A17E6850FA8D10FC1749A968672EA737C025F2093DF2354AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 853KB
SHA256 9e16b3a7ab201d1de1740a7bfb8af8357c2a75a2ca6f002d7b63bd6513871f9a
MD5 4d6f79e48ef7a308db9c4da15ecf45e3
SHA1 586a64a556cd7b1385b706adca1db1019420e59f
SHA512 550143ac2b39c073fa159c757b469622bc43ff08b5da72e9c75a8ea81034f574096062d4643998e7d66d342050b83658ca3827a3acb0422af7dbfaa55a6884cf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994apf:A3k03kB56ra
TLSH
T1A8056A13E6850FA8D10FC1749A968672EA777C025F2093DF2354AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 853KB
SHA256 2f3c205afeca5d66b47b3e43b4b155cb13fd975d85223febc31f02b55545a1a9
MD5 480fd4154a3b7a7afccdcea89a6d2e7b
SHA1 cf3aff6db7223d94f0166a2255d3f2bad5938861
SHA512 5617b501c102d2c94b472227902f149c57256e9e6c93352881c1fbbd495c8718b9e9d22cffd7775215b3f2f9b714b02a5ed3cf647f4e52cdb9c92cb1eaeff304
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aSK:A3k03kB56ra
TLSH
T188056A07E6850FA8D10FC1749A968672EA777C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 853KB
SHA256 715d2069485aae243bc0fec525d6fef0b1ac1a97dd8456dee1a8c721f3ca2f6e
MD5 efaaef51aa7f949c99d4b9c1cae22b84
SHA1 426364ebd45099b67fba01acc388ced357d25a2e
SHA512 de9a6659a8895c7ba2090ed87c9e2d9c06dfb482b315813830522690b032678aa28d3dedcc7ea2b89549a77b8d781dc9271d01078d9e454d8ae516c2dc7c346e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994a3k:A3k03kB56r/
TLSH
T115056A13E6850FA8D10FC1749A968672EA777C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 853KB
SHA256 349003f32bd11733e57f03a2cc38fdf7015b36ee42074c5e64ce7d2ebf08b5c9
MD5 e1c41c296c77ad63f0e01f29b3ccd0f0
SHA1 5033ddf5a8237e21d96602400b8bec34ed86dace
SHA512 961096055af42e7e1884c5e0081ab11d0467fe889075f8ab9eeb57c26fa23b91e1a2e52440c65828df1cf9dd9be40192d1881a4fabd47bef4eb9e19b834a20e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aA0:A3k03kB56rO
TLSH
T1A1056A13E6850FA4D10FC1749A968672EA777C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 853KB
SHA256 96a411e81ad90e6a62b676ef2162efcc945fea63de660b438a6baef1a69d870d
MD5 7dd4d8e461a5390cb7b275cdfda9494f
SHA1 fbb1ff6809d33301907e7b481e0025d69336a4bb
SHA512 66900eca752738746e4067815d9b4adbc58fc56c25d96b1af9cfc98f966796d902916fef7c9811e3e06afd3fb91af2dff844f9084d29e0af572c01d00d373cc0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994abg:A3k03kB56rX
TLSH
T14D056A17E6850FA8D10FC1749A968672EA737C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 853KB
SHA256 3e8b8a59c935b8c5ada7d0a27d6e46db339be9001248246b0fa88ecea52e3cbd
MD5 d522e76125510b39d5ecfd517dd52171
SHA1 3faa464b034612873e0bea6f52d586464b570c35
SHA512 fdcb80256fbc1a935eee612510392db67124f38de4f5697ccbf4a1fd1c11187cb39e36c8776d4372d7c972afac7dfeb4805e2b642589be68116e5b011283e8a1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aWr:A3k03kB56rx
TLSH
T142056A07E6850FA4D10FC1749A968672EA777C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 853KB
SHA256 e1ca7b76ef9b17ef7a6e63b7833c936ae88c6f829248bc6862c31be333343cd0
MD5 b088af8db338421be3e5405f3e6efb09
SHA1 49cf6622a952864fcc4b58b048a9adb0386167bb
SHA512 c1b3fc4e6da6117f59dd7d52541f2bab0493c5bfc883adef8e000bb1001b4702a3ed77af92a16074f65b7fc8c3fd19a7327a00b5b97040083868abd26b1819f7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994a8n:A3k03kB56r7
TLSH
T1F1056A13E6850FA4D10FC1749A968672EA777C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 853KB
SHA256 ba7e3314f901c09cae816e66e99e967f52188f43da7a324a97b3f0c0231cd238
MD5 febe3993993f9ca92b31f6c58887b193
SHA1 c77ed9eb5362f758fd7ac35b9ffa860699b84cb5
SHA512 f86708cb08acb4324ee07cc173b7cd3ba7c0a04daa5db6a716433bb0e48ed75b8b804c025bd524d2e89e18a87f729d82c268b1147065b2152c8fc91dbede24b9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994a6x:A3k03kB56rp
TLSH
T160056A17E6850FA4D10FC1749A968672EA737C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 853KB
SHA256 38b3d7a3dda4202b3a009ad1597d99f4dabf324ab3fcab0dd46837f8405efa5f
MD5 21fea0f775ddd41d2a88387ae5cbfee7
SHA1 7b7567f71920e85a972bcd423d45e83b7ebc040f
SHA512 6ea8287fe90cc2da97c1ba12ce5801a9494d7ae861c18f186bd0d0d0c36147558ca2ed757f9f1ea5f17050f45458c1413a80b5b50b1f52259e2fe6fd2acc3680
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994a8A:A3k03kB56r2
TLSH
T18E056A07E6850FA8D10FC1749A968672EA777C025F2093DF2354AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 853KB
SHA256 23bb8190afc63a254c61c0f850cebae46f47894eafe5c0eb37bfbade23657a71
MD5 40510ddf754b3f244ac8d4724ff3bb26
SHA1 3c3bd99c294cc55f9d7c3bdd88933a5ae73882af
SHA512 f4b749d8d3567cf5d3c67ef70d08a5bdd4909b4a137a130134041e9488ae7f875f38b2c308dccc5c449b78f785197e553c16bf28d055cda29acdf6c39207c319
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994al9Q:A3k03kB56rr
TLSH
T10D056A07E6850FA8D10FC1749A968672EA777C025F2093DF2354AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 853KB
SHA256 9682beb9ff4e232b50dd0f23e1b67ad467cb533f47032e7092cf82c4fdb6dc1f
MD5 ed57633204a5d3503c5ea4ddcefea9fb
SHA1 7d13a6f4f2e3add0507664559a698b230635ebe8
SHA512 981d1d88f8421be9ee53bb02caf7ed857ff24e74ccae6560ec6d626e1dedca3110ef0144c2dedc0609b2d874c26f2f29395693f24c10bbae7b380620a51e7b8f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aQ4:A3k03kB56r8
TLSH
T113056A17E6850FA4D10FC1749A968672EA737C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 853KB
SHA256 ba99e2c8a5fdfbb9ee707b42b0e198b004bf3bbde92846564f3a6bbc5dd64fed
MD5 7982c7a04c45ae59077a25d9cdff3af1
SHA1 aaf23f1b2c97506d7de67c7e72481d5ed3a80fd5
SHA512 e2ae5670ad338cb3ad476eb769e1cd3f291522dcb807bb5fb30921e83abf685ab07f5342605ee15cf3a96def824463af32a5bbee0a189cacac9f0fc06464e76e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aTu:A3k03kB56r9
TLSH
T18E056A07E6850FA4D10FC1749A968672EA777C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 853KB
SHA256 706408835ed56a16e3bff83c925d7052a3100f22849b47780a7dd8d24f74a1d3
MD5 d969f36be97d24c791e0740946c7c743
SHA1 6284ba3fda8ae0027b1e1287b9e61579a7ad52f6
SHA512 1d899195b438ebcf20c3cf197a4935a4505c2053a6ef38dc040235fec610c54b483a69719f8e07947a921b72de10fbc379e5971edb0192f26d6bef54cf4b563a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aOj:A3k03kB56r/
TLSH
T14B056A07E6850FA4D10FC1749A968672EA777C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 853KB
SHA256 2f1c1caf379b7001332ad50046635a30267edf8d0ef997ae544eb1eac033825e
MD5 a8c2e2f208b5053b3445183db5e58061
SHA1 150036c2b766a06293eb1c93c9c3789c66d28bd0
SHA512 4a1e6f77bfcbd6503e753b288b5c18af9f45410ebe6ee4dff27d3b62c25fce386615ee0844bb1c4b0e040532d17b5395aeb5353575db861d7fb9abda22450b19
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994a7g:A3k03kB56r3
TLSH
T1F5056A07E6850FA8D10FC1749A968672EA777C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 853KB
SHA256 84813ead66310f33ab80245bb0b93a7c4b40ad1a8adbafaa52231b669adaef96
MD5 8074d26093b86016bdf7d14dd45a33f2
SHA1 a88e553db5b035a0672a01db0177fd73a9c85409
SHA512 4662db9089e386ac0a00741559b2879ad45baeaf693784c646818e352febb2845bfd586bc9238a2f52d74c2a0df88ebf2886457365dd9d849913033e97b0d9ab
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994amI:A3k03kB56r2
TLSH
T1EA056A07E6850FA8D10FC1749A968672EA777C025F2093DF2354AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 853KB
SHA256 24a232addbe14efe6ee94bbe205ed73c91d5bd9f394f79c801ffe5cc82071189
MD5 24e21e59307ca9b98ee6217b91919605
SHA1 f59f765e163203981483eb4e40471e3d2a619251
SHA512 012b8c69d7c2635df798aedd8ceb9b79f5b2e54697e3c2fc8bf54d9402a058462780ace25cf787a28212862446370e7a96a9a967fa768145b2bfc2f808f021b2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aUo:A3k03kB56rE
TLSH
T1A7056A17E6850FA8D10FC1749A968672EA737C025F2093DF2354AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 853KB
SHA256 5f5af98bfb388a3c08d3191557a3f8804c897c789fc1ec63e09f8b1f6c37e378
MD5 905d0ef0f30eae46f96a4866aae5d181
SHA1 328ddca08238912741788ed6d67f97b0be77646b
SHA512 8a5ca446c21f942eefae615548a1a1313ed407379bb80a57e71471afe94b632e0894b6899ee745a6969ebf4e815ffcd81b61466e68362c4b2e76c9a0253c5772
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994a3+:A3k03kB56rZ
TLSH
T198056A13E6850FA8D10FC1749A968672EA777C025F2093DF2354AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 853KB
SHA256 36a2b9c12c74637fc2c7404c32393d9279296af6b24b4b43b656ccee8b5f4cd1
MD5 f58d5e7dd7a8fbcc94b8f3e8484661c3
SHA1 0dc77c4cd4952d6e71f2121728418e99a4421c85
SHA512 cb49dc749e8a1b3e3ec2b8136aae651d8f2b8baaf5d2d10f4be3aa0d95d85534222f5536493961122eba710bcee4910c72aedaa048a44da1610c1838e76ba42f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aNQ:A3k03kB56rp
TLSH
T1CF056A07E6850FA8D10FC1749A968672EA777C025F2093DF2354AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 853KB
SHA256 c8fa90bbe323ae7e88f6c8b06f010b5b82066a7ec38d7a1c1d21156b6018ca2b
MD5 dd7a7045b608b915ed30a9c36cec20d5
SHA1 82ec25548bbf701910b959577d34e71b4c7d5797
SHA512 14a3d0decb72994afa6181ed7a119f37dd8a377a7b9c6db46d4070520cfa6ed69626bee9c4543b1100baf928fc424d8bb4d04c67d658396a4a826a1e620053c8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aCX:A3k03kB56r1
TLSH
T195056A07E6850FA4D10FC1749A968672EA777C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 853KB
SHA256 3c2b8baaed864922e44b3085118897027358600552e7411e1568faafa0c57e65
MD5 2558a0eab4a086e1803dc2fe7c363357
SHA1 ca21a2c6acece6305e7d16fb4565bf8c9d813683
SHA512 e825db7df686fdbde4ad53627cfbf0b0fefd20d778e6b37426207d62e3ec22681026ab38256d32b089d9cc2a76b00b760b19eaf747eeff1cfe5a307a834e217f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994akL:A3k03kB56rn
TLSH
T197056A07E6850FA8D10FC1749A968672EA737C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 853KB
SHA256 a465fb0d9eb38e5c24976c813c4e4598c8859cdef4df72fb305889bb6fc109fc
MD5 d6c77e764e72db02bfa034932d3bcb3b
SHA1 d773208c9ff6660872ad67b5cc496d787b4f2d8b
SHA512 27b226e052591a5d7d0a9af85e2a827b71bb318ddc3446105b21fbab15d551234ce913365450df604d7b444f72b238b594273f115caf774eb38ee58b006211af
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994aAM:A3k03kB56ri
TLSH
T1ED056A17E6850FA4D10FC1749A968672EA737C025F2093DF2358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 853KB
SHA256 ba2ddb937d68895d7170dd537aa3544486a2bf08462b262e566e336f37899e49
MD5 dfeed296980439a483b4cd8b6712aafa
SHA1 5ba36a840460c5f615b4655f102d0053e1c59db7
SHA512 e7262af923f8ec273fbd1fa53cbf58fa69e2c9619aab70d659d6a668c9c1ca8693b57839337c0325ac84e4df7acfcce989f49c9dc2ea7b1a6f5e69662c8454a0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdolc994ahh:A3k03kB56rc
TLSH
T195056A13E6850FA8D10FC1749A968672EA777C025F2093DF1358AE153F72BD06B3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-203-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3388-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3388-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads