55d398daa4eeeaf1dd27985f8653676f2f63dd6da869349037268e02eaec475e

Analysis

max time kernel
101s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 912KB
Sample260811-17yx1sshmb
SHA256 55d398daa4eeeaf1dd27985f8653676f2f63dd6da869349037268e02eaec475e
MD5 c3c206e696fadfac134aa751305e9e31
SHA1 a787846311535f9160dad660b4683720a5bd22d1
SHA512 8e20a947ae196f761481cbb34ba4e56e3ef0a0a3aa4bfd20717a9819f3c108e88d89eb2b9bf91ea2f86117424b50b55f493149caec91e890ac48f42c2ca040bd
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoc:t/sCv7rTiw2RYwZCUsjwSZGoc
TLSH
T131152A1767EC4895E466613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/6056-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c586-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2fd-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6056-106-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3784-167-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-648.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1216.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c586-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2fd-39.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-222.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-648.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1079.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1128.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1147.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1216.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1319.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1365.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3784	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6056	2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3784	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_c3c206e696fadfac134aa751305e9e31_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6056

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 912KB
SHA256 55d398daa4eeeaf1dd27985f8653676f2f63dd6da869349037268e02eaec475e
MD5 c3c206e696fadfac134aa751305e9e31
SHA1 a787846311535f9160dad660b4683720a5bd22d1
SHA512 8e20a947ae196f761481cbb34ba4e56e3ef0a0a3aa4bfd20717a9819f3c108e88d89eb2b9bf91ea2f86117424b50b55f493149caec91e890ac48f42c2ca040bd
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoc:t/sCv7rTiw2RYwZCUsjwSZGoc
TLSH
T131152A1767EC4895E466613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 fafed9336c8506fb0ff225c5c49f305d28d6e4781de60d345e00b1bc3bd92418
MD5 82dd5b9d9b84c4157aa61b2e7f6cc42f
SHA1 84445254ced085cea52056d8ea4787ac1e5e9103
SHA512 eb8ada9ecd52856311cb887d7f49ce17c3ce524592af09abdbf896eca733554077441c3feeaf6358bc4b97e8e83a75e3d8f783f00c9c53a65c20723311a0b165
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjwSZGok0Le5ji0hmxNrM:x7iw2T9Pji0Aj
TLSH
T13A654A17B6A84661E073D174C5E6964AEA72B4461B3087CF12A8C73C2F23BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 926KB
SHA256 7747823dd126fe39f118a18f94bc8315abe331f156c892e547d7cb01b42f8f56
MD5 051f3493808d8b38a63e7e4103f8a548
SHA1 db8d3f8798954456c3b0adcc88abc55f2e06d3c1
SHA512 bfeffa2f1f3afa8a3a444bbca92fa394ec823322249fe97577a50aa855d46a5aadbd31f2ee077484eef9bcbcab44320b73558f216a1b475e3d0b4a9f23ed652c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoOa:t/sCv7rTiw2RYwZCUsjwSZGoOa
TLSH
T18515291767EC4895E5A6613089B58606EA72F8551B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 935KB
SHA256 a06296d7d6cce574c855b0d95c719d9bed4cdf5040711cb51bd1f45580b43144
MD5 665c508198ffb148de6037bd615fb5a4
SHA1 0e713186a7b026b4e9ee9e792b2f9211ec91203f
SHA512 5891d77079b75679e01dd4dab7782e21f2520f0eab09d6d5f93fb51fede565a14a0d4adffe6142e1a7291fd661dc8de7c0f6154426d7a530db6f641ce5c4cb5d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGov6:t/sCv7rTiw2RYwZCUsjwSZGov6
TLSH
T1BF153A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 935KB
SHA256 8a1bc61c56eb96786583d833d2baf0242df3fdf3942c20b75a14f46b49c4bcf8
MD5 e00a7d6806ec7055cc3ee2735393e417
SHA1 02e8f8be1c5918bfef2b2760759354195b87f812
SHA512 0bd38ee35fc407e4bf0b67955b099011691555a4c6eb5da341fbb3dda38fea096737931fd8b9e78007ab0d1a6936d259f037dedbb18f0195309132597519a071
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoxN:t/sCv7rTiw2RYwZCUsjwSZGoxN
TLSH
T14E153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 935KB
SHA256 a5d00544327ed86613fb3aa6aa433be72deda11d886df3486dc32b52d352a704
MD5 bcdf6e681f9fcb83e4102184d19378f6
SHA1 cb46b7fd604f88b35f12d324b394429b95fefccf
SHA512 bbab5c5e9106fea48f97d53114366650f6ab0a70cce4a6d33f05c16febab20d453b6beb634ea197781d14d915a4b0a19f156978dca6a2410065d9046f8014a1e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGonf:t/sCv7rTiw2RYwZCUsjwSZGonf
TLSH
T182153A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 935KB
SHA256 b9d927a7f746b2865776a2deaa832dee4af55a5392d48319903c4917a917c526
MD5 163d8f7addae8b609da3817ce5744716
SHA1 cc20927aac2d75a40bbd4c9b50db4a53bd9370fd
SHA512 a68bb0635b893441cabca912b9c4edf5e72f4444a33b02d0560386def81ebed1e950c892419f06b0af62c63b3725aa922a162500e00b0d41bae8ae27482e05c0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGopo:t/sCv7rTiw2RYwZCUsjwSZGopo
TLSH
T1DB153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 935KB
SHA256 6377647ac581d20a0dd2a9704beea9c7b163829c22d3ee5f2f9a3cc642d77110
MD5 fe296b2c6c234f2679cad21b0aa84de6
SHA1 4f49f37bb0dde77f866bcbad3fde7f756c130915
SHA512 d6176aa5ea721c8d44a89d92adca59771df62fda4d20eba3a1c1f70e237b2a5d38eaa3142f61bbd8cc0b31850f70f605c23861e3116da4a2aa124b1ba6505927
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoZu:t/sCv7rTiw2RYwZCUsjwSZGoZu
TLSH
T197153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 935KB
SHA256 67d8016738f43c003cbe3c32019965fad56344aed44e18642b92290de314b7e5
MD5 734367e247b925195f9a09379e78507a
SHA1 ad852dce77f8c75c8679c875051e151d10255826
SHA512 c61a661e77ea5b598b75e401a2bdc3b48d015f05895c2ea0a106764c9cae6fc029ea5f86e0ae05c1a695d544715547c95ccbf7ae65287bbe3c6dc42c3550ebe2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGo/9:t/sCv7rTiw2RYwZCUsjwSZGo/9
TLSH
T17F153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 935KB
SHA256 40d34f6ab3620762653edb1064df09ae529c716efdb36f2b588d048f9a8ac27b
MD5 03c865d9830bfad4608b4e03f3af3189
SHA1 e5645660009a86fa050fb63fbbde827510d5c26f
SHA512 048ebeb1cfdd9e8fa10333488965059979e09bbf0b04a5fa48535b12c619abc6e0740887b16adc4ff296f6dcacf4b0c2607b6ed17317cec0fa376dcb0e21d470
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGobc:t/sCv7rTiw2RYwZCUsjwSZGobc
TLSH
T12A153A1767EC4895E466613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 935KB
SHA256 15d86f2b80b85ccc72f62db21b5d0f687fc4349e290d41e4c94ce59c2086e47e
MD5 922a5e906966231cfb91ae4b93694b68
SHA1 24508a8456138f87d34229a316b0aa4ad1dc1195
SHA512 30d179b5a73651012566701b5527033890bce14432f6c9638e9a8cf25bb69de2876d634df209651047678b962e2268aee83e497f562860566974859744cf7b99
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoEp:t/sCv7rTiw2RYwZCUsjwSZGoEp
TLSH
T136153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 935KB
SHA256 60978d63de79f69018fad2b2446604418e7d0c958dc5848b3256646b247ebc63
MD5 60e5f5f9ff9045205b0740388493fa3d
SHA1 d6b70fafd018ef8ca557cd818edab7ee19e9d02a
SHA512 c83d0e915a1df552b051f9844503e196238db27e81b82f463d0c2aa04c10c92b7d78233373f374a607bf8fb9c95e9f3cf92919bdb35c76ee59c3ef030737d83b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoL0a:t/sCv7rTiw2RYwZCUsjwSZGoLN
TLSH
T1E0153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 935KB
SHA256 a4621032fd8ea2b6511a19a1b86b2345b95d39beb04706a956732517f73cc097
MD5 b6e2332f2d931b35a4030c841465b677
SHA1 5c1448a7fd3c10d91b76e963c989fb8c0d4a8cb5
SHA512 5f443eef4e54f4ef7473bb94eaceb57a1166993e7f19897bd2d12d501b29780b476977b3112e69affb35e0e8f227d7627d424c4f02f938241299d0138422e628
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoZF:t/sCv7rTiw2RYwZCUsjwSZGoZF
TLSH
T1DC153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 935KB
SHA256 79404bb61117188423af433b0486637a6e7631f0955575a5bfa741c9f3bf7e4b
MD5 41321db986ec720011ad9deca85e96ea
SHA1 2fb6c3359a453aef244920dbaf1d084d0fa4b867
SHA512 1aea6abb97d7bdf66495eef98961c8aa482719af57ddcb758825382a247f1554c510a71e610aee23a2b3204ba526d819db610226d9ace63cacf0f54b326246bc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoyC:t/sCv7rTiw2RYwZCUsjwSZGoyC
TLSH
T1B3153A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 935KB
SHA256 3518d6dfff0242ccf876fd1cb3cf3973b354c1fd1c298caf0df40802885d5a2c
MD5 5c48e4b3f9ef673dcdf1001772879d2a
SHA1 8f9616265f66b59a8aa8b498467766de85f7a94e
SHA512 67787ed60e48627005033845122c33c3f66bd72f9b1c62d9232032034265b52d49f7f67473fa0eab70c0ec6bf4210943310d47f334de7bf7cda78dd5813440f8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGotw:t/sCv7rTiw2RYwZCUsjwSZGotw
TLSH
T134153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 935KB
SHA256 89f99c411a329386fea23beab31ad12d68d2017ae66b74407d96f49775a0808e
MD5 cd4bba9866c9fccfa54ebc50ff0539d4
SHA1 e697aac6860c0554bcd40a34b09ccff9971fbe49
SHA512 7e116df65964041034e7711eca47888d960448f8adffe92b94d49fd32b28d57d73529b794a671c460777e1c4d716016acf7a29304cd83318614a6a8160e136d4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGocT:t/sCv7rTiw2RYwZCUsjwSZGocT
TLSH
T154153A1767EC4895E466613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 935KB
SHA256 898730e0ebe9980eca71cc06744289e90b52a49614ddcb5885919a3de08f8417
MD5 0fb2a3f346d6f01bf0ea0bb57f12ff37
SHA1 d33e31c8095563ea5f48ee71ee1068389f8c4720
SHA512 1ebb9c647ca69c51032805fa13fa9428961245554bda8ebc29a61491d7c992761432ed17eb2cf85b4f3c6d143f3b4a95f35bc1714a493ef9cb3a0d1e39663219
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGowu:t/sCv7rTiw2RYwZCUsjwSZGowu
TLSH
T132153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 935KB
SHA256 2b1bf38102c97518ac0ff67f26f56674283d59020b1132d2c1a689d8365dfe93
MD5 bc96f3b3a914f18a63525ada07e44530
SHA1 d2cde80930c6a6a7bfd09d7b49b19bd3a159b081
SHA512 075f52d269dc951f2d4533b1d27bf061b66e9fbdc5682f6d917a4cfc653bea59418c6358f1da03269e775dbbb6d6c8722e2c3d9e0adb61af89ad27ecf1d652a8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoOb:t/sCv7rTiw2RYwZCUsjwSZGoOb
TLSH
T120153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 935KB
SHA256 5a281ed69b51b4d9ea383690d81bdc2cc4d810ae7a28ff33d02a0efbfc6c6b98
MD5 5df00af2914352eef102c5ec8cc94ded
SHA1 66aec3f9ba329250cc2b0e2be29dccd4ae27b7bc
SHA512 28803fdc50448735b883b5844c3a3ebc1dec4fef8398064ee137dd4c960cd37fe5c0cd15798b4c87f8d5582e4dd5d113e7428cdcad34b59c838b9ea7082fa66a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGo4f:t/sCv7rTiw2RYwZCUsjwSZGo4f
TLSH
T149153A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 935KB
SHA256 059bf6d72a9643225d6bd56ff2ff6bee5b9ad36bffdd5bc7118f1ee804fb32b9
MD5 802b60d70c0d5743a0727e42413a5d03
SHA1 8210c02edd1bbb0baa2c1505420be74d767990ed
SHA512 846c064e864557436b9f315f8f7e917da0915a7db80ebaa926d894457b50b5bd3983062852bfa05feb50b31a0d13a54b80ba08df56c98dadda18f14d5bd8ece1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGo1K:t/sCv7rTiw2RYwZCUsjwSZGo1K
TLSH
T11F153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 935KB
SHA256 e4ab2fad3be70f9af4c4b876ca967671d7ea5af462d94f8c9fa2d2ae84353ce5
MD5 3dd17d9ce4119b77902b93d54cf38b34
SHA1 dd9d77a64b0cdfb7c6ee952b45df71ff1013ad8d
SHA512 07ef1bcbaab8a670f3d5719373a5622b2a632c9bfedfd2cb714d245f22933f980ca1e23f764943e7a57b0ffe6eed178f98ca36e9e92868cddda0690d0826ac95
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGo2k:t/sCv7rTiw2RYwZCUsjwSZGo2k
TLSH
T103153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 935KB
SHA256 10eb2abbbb1b1d57f199fddaaa61dead16265490faae7a8f4067a62897d2e7b4
MD5 518caa0c196ad7de6f82fe929664efb7
SHA1 492a97bfc5ce10185c37fe80675c4754d7d5b800
SHA512 44ac32f41f6d309a8de9fca7c0ab48cf32a3a1147f602884a6c4ae1a0d6722025aa91fcd7c22cbdab45b7b03d170de4127cb861855c82a0264c3d1595efde8b4
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoT0:t/sCv7rTiw2RYwZCUsjwSZGoT0
TLSH
T143153A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 935KB
SHA256 63a655becfdf7f1903eba4176fc30943009c35fee51b99f77637f3b786c5b874
MD5 0016f2b955d0683a263d5b698d7ca3a2
SHA1 1c238a0911d3cdb23be5db86e5cf3abb5b3bf941
SHA512 c8612aa14b65e3e8d829bb702a260fbc4b16224630ad24c85e3f20ea7c40b5a2772ca1f67f1b34466e1e6ea8cd5edcb206c2ef6d0da4dc12da05b8edfd06811a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoi70:t/sCv7rTiw2RYwZCUsjwSZGoig
TLSH
T1AD153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 935KB
SHA256 5949b45d5f9b3656fff0408c3a373120379e54e2f9ee63d65b82ee18d77e561f
MD5 b69ccd98a9308a3c1c841f25230e3b7d
SHA1 74bc862c89454085f2ac218a2c5cf7ac02c9f044
SHA512 ba8c21ff4177d94057327a32b2786459c24d308aece4c7fe182278d8194781f573f44f3ea5785363ef76c781c5aca8f484561c58b0fa51b85d05011b588fb539
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoDr:t/sCv7rTiw2RYwZCUsjwSZGoDr
TLSH
T151153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 935KB
SHA256 c2454f329c12dd440a06fff9b3e8118cf811955175a730ededa0af20a162eeb1
MD5 986fdbf1244dda6fb863ec1a89310fb1
SHA1 bde4073a0ddb9184ddb505b751bf8414b4a009d4
SHA512 e77c6188dd7b3a4c9b1a5ac4f08920000b19491a81f3e6a0984db20ded3f6d63d5877ddfdf8b7e296026547d7c8cd747923fe841a1e75143b73b67e7a0c64ddc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoln:t/sCv7rTiw2RYwZCUsjwSZGoln
TLSH
T1F2153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 935KB
SHA256 3d0df2d39b106e3d18ab16bf0ddea9d7f512837c605c2ab461b7eb61050e20db
MD5 0c65b1839bc7510a389b20058b8a7ab3
SHA1 a0c6eb3ed20471e0a1507934da6141ea09e3f560
SHA512 837f11f9332cfcb5f6c5d366f1d4121d16d7d1627976a6e2b8925da95d63b5a0f9a5a4548329ab7e0f64ea74a620d16676084081bb59d799d4a2fc5b684d2fd8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoRx:t/sCv7rTiw2RYwZCUsjwSZGoRx
TLSH
T110153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 935KB
SHA256 6a96a1e4e0b48135d097933980746e9c45d18f4e8b93c6fa567383613ce36829
MD5 552fb6b9614b4104312f45c6dfc8c6de
SHA1 cf2f48eae2f98687c8411c086db4edaeb748d4f2
SHA512 88a710779cadc2b5483c4f781c80c38138e4c32f21f9702695d2825149a6135c51fb3d6214770b07c42fe4858dd8584993c8dcc8778d546d0a604451cb59d0ec
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGo/A:t/sCv7rTiw2RYwZCUsjwSZGo/A
TLSH
T195153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 935KB
SHA256 d3d2f74bf41b917adc9592d7cb8c80fa3d68d14d710f90f2c2fdfda281708737
MD5 afb29978710b12423a6700b90cb08193
SHA1 69da0ffb91d0e4e4ee7888067bb8feb45486f7b4
SHA512 94ce287ecc350af80ffbe0db5acf7a09cc0543c9f9a21a05460ac6e2709168e5ce47c3d33cf232668472fcef75ed303cca6130da7a6b552dc8af197ff18b4795
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoQ9Q:t/sCv7rTiw2RYwZCUsjwSZGoQ9Q
TLSH
T1C1153A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 935KB
SHA256 bf6cdbff3b27ef8171bc1f8034a3fe899ea741420a52dd13f6a137addbeefe38
MD5 beb9436d555c2d02425d42c184efe543
SHA1 5df865f417db28a65affc98cf7119b5482d8f715
SHA512 58d701dbd23b74696fbfa57c2f85d9517306b4c554f0a58ba1b19ceb9b8330c96aed7c3952a8d558a96fe1662f179cb18fa1e403fbc55c9d0513309496d93a7a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGox4:t/sCv7rTiw2RYwZCUsjwSZGox4
TLSH
T1B1153A1767EC4895E466613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 935KB
SHA256 08f1112062387e86cfaf64937f10845a568af15e49b1a9d60799ce97a211c865
MD5 d0d8f46422fbc8961ceedb2561a956c3
SHA1 315cf745ff942c719a67044360731f8c483b4451
SHA512 2ba543b3820a2bda23c21a7c532a2247f02788a5de18dde7981a5c6ce51372b9bfbfbc0fb7a120bc9385c4695023f18ab0d9cbd1b693c2e74e105c4bfb8b09bc
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGo0u:t/sCv7rTiw2RYwZCUsjwSZGo0u
TLSH
T16C153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 935KB
SHA256 ff5cf35b46773fb77c1024c4811f91725ad0fdb3c9ed64ea8b4dab7bbc310c8c
MD5 6019aa8b2c701681cac698d696cbc6fb
SHA1 fd91dc45d1afa76bcd0922aaea7a4c4ec6641fb5
SHA512 61fc28cac4dd9e2dfb7a77ec7ffc002d1772b21313c2a7cda027457fc2f5d0eceed1cd6646bebb94207efba5b7d604b296ef7c3d621d0c9999678a5fe4e485c3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoFj:t/sCv7rTiw2RYwZCUsjwSZGoFj
TLSH
T14E153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 935KB
SHA256 f81c3814caca99d1d6073ba4043182e6a64a0eca731ff5ca68b94d83ded6c34c
MD5 02c11bbde93a7cf8342fe1cc5a6bb09b
SHA1 81869d1dee5324a3c0eb2a3f18ee6bf4bcd0c691
SHA512 1024b96baece74aedd4e1e7927813ce03f10261721bc5c1adb012de9dcd64e4ef998f8644407bfa62d12827fc9681f114ef9bdd837ef607e9b4f296362d21af2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoMg:t/sCv7rTiw2RYwZCUsjwSZGoMg
TLSH
T112153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 935KB
SHA256 395a71d2f38afc76f538b03612d636c49c652f1102cc9f53e91fb20100a69b10
MD5 b7ec355b0cd8062dcdefeaa67a0916e7
SHA1 57a20ef6a9fd621e6119f9454e56b6f6d3e11b5c
SHA512 32ccf6e3a76c34130631b6e30904f330ec9f59a0744b185e9504e029ce8ae793ec9e8a8054740a3204053a75d51462f747a05c1d617b534ddde6cc464bd3fe5e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoTI:t/sCv7rTiw2RYwZCUsjwSZGoTI
TLSH
T12D153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 935KB
SHA256 5200da36996ebd8590cb954887504fd0016ce0dbc257c4aab177f35a79cfc540
MD5 68a14e7950cd2eda7689656e0b06f8c6
SHA1 40a13d7b26283e3440a31355a57aac04da6a1b6c
SHA512 5ccba13d942aa40349a2dc6a848309845ad3b2c6264f35d0367e139018ddc35760c3183b31eb9f409888f740d021d1091d9e597d9320958505901f66bbccd85c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGopo:t/sCv7rTiw2RYwZCUsjwSZGopo
TLSH
T108153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 935KB
SHA256 f4685db885c4b667972f7d7909aafb30908587e4585f3fe46f32059a7aad05cb
MD5 4a31a0e1f5050945b2b6452c3ecd6780
SHA1 f8d99d90e37c8882cfded040ab2d4b2040494cde
SHA512 6f23d3fd12d56df57c18fd734c7cf40e8c1726d88c049ac18b38ac501b1f72f01e0612cf1d1434c9effe7745e7fd81e9e6cbc67f9a3d2ffa9028b9e5919eccde
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoa+:t/sCv7rTiw2RYwZCUsjwSZGoa+
TLSH
T11B153A1767EC4895E466613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 935KB
SHA256 21d9459e13e93ba861394278b1bfa5e7790fa0d230e7aa37f7b8af735cb81c88
MD5 4e64fbeead52a7196ad5b926e0b08d8a
SHA1 99fab10ddec7057b8d9a81e8fa416673dd23796a
SHA512 17008bb4d5af585393a3e5fc10598043b268be40df9e80e4311ceac23b3813fcb77da0b1820e27e3c8bb6e77d391e4260ed43089ee139069ed861680a9be05ec
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoaQ:t/sCv7rTiw2RYwZCUsjwSZGoaQ
TLSH
T161153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 935KB
SHA256 882fac21891bd76dc201ba70b78dd0fa30a8239e02da6b4004d5b9553c891a02
MD5 d5f4ad3ca69fc60d4cd87fc961212186
SHA1 9bf07f00470b2885d1aeba3f7caab3710eb30eef
SHA512 b1f6a7f7d91566a3b778afb4ddea5794fc4b78b057298ffb3ea8dade6e780d222fd397754770802d7d45fd5159291abdfe7e5bd7ec03da321d2d2743d8d3d7b0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGorX:t/sCv7rTiw2RYwZCUsjwSZGorX
TLSH
T156153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 935KB
SHA256 87251bb43838aa1fbe12e3bdc4a2de44a27b31e64c483926fb9aef0099f63d48
MD5 29def93fd9807bb92b94d95cd80bab74
SHA1 fd206baa2ce5438bd89afed7772d21901df0d65c
SHA512 707b103db4e12aff868318531c707f6b09feb13b4ad7d29b8bb0f8dac2d3242054ccaebf042ad738df7df1d22d34742ca97e64906140949c37ff09985003b73a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGo5L:t/sCv7rTiw2RYwZCUsjwSZGo5L
TLSH
T128153A1767EC4895E466613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 935KB
SHA256 045d0ac7d8230d1cbd07123b8c6a2cb6c772967df29509c40e01812d2cae979f
MD5 a83428ed8edbc32ffbd070899278cf52
SHA1 7e11e45f234b673e6c85b16e82d1ea490d73cd3d
SHA512 299b875f456a694156706c4c36ad3507abf71b030f589a01366e5c8848a0f6db01958fdfacf8ac44d77302edf5c88453a20ff813e122c85565de250a1a206c41
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGonFC:t/sCv7rTiw2RYwZCUsjwSZGonM
TLSH
T178153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 935KB
SHA256 fdcca2a398e36031a1d7d3259da94de3e530cc440a83a8c9108fca6e9d1cae0b
MD5 d83eaf05c68fd40e8e0cf4495ee835c7
SHA1 050c810f23d2265cf5a35ecd1d3878abf97d5eda
SHA512 d16af71d7c13cefac8f98212d18ff2a3f83bf40f5d16b0d12e68a6b0affcb95e5c35f06278a2a79cbfc24ebded919a58756294f4d3eecce609227c07081641b8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGoQh:t/sCv7rTiw2RYwZCUsjwSZGoQh
TLSH
T11B153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3784-167-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6056-106-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6056-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads