576bc6a73edfced9b504af22f85de1b6c525cea6cd78cf80b1bda4df44059d27

Analysis

max time kernel
92s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 05:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 876KB
Sample260813-f5kmdsseqd
SHA256 576bc6a73edfced9b504af22f85de1b6c525cea6cd78cf80b1bda4df44059d27
MD5 258a58dc378f0ee7c7f289c762ff682a
SHA1 4e10b43f642845adc0114d61de7652be82e374f3
SHA512 e92f327d037d51ad3fd780a493b2a4010069c38e45da091b4dd8238bbb8191788fc6a3c2ec454a3f4482691121113f99a4a7d84a41e38446f3b83cef5ac7c472
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4o:t/sCv7J/sCv7SeKdY+i4o
TLSH
T1DF15391766944FA5C06F513089F54652EA33FC1A1F2047CF16B8AF653E32BB06A3972B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/6072-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c643-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b301-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30f-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6072-166-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4840-209-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a65-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a66-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018989-532.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c643-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b301-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30f-57.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a65-228.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a66-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018989-532.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1047.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1078.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1128.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1339.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1364.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1384.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4840	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6072	2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4840	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_258a58dc378f0ee7c7f289c762ff682a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6072

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 876KB
SHA256 576bc6a73edfced9b504af22f85de1b6c525cea6cd78cf80b1bda4df44059d27
MD5 258a58dc378f0ee7c7f289c762ff682a
SHA1 4e10b43f642845adc0114d61de7652be82e374f3
SHA512 e92f327d037d51ad3fd780a493b2a4010069c38e45da091b4dd8238bbb8191788fc6a3c2ec454a3f4482691121113f99a4a7d84a41e38446f3b83cef5ac7c472
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4o:t/sCv7J/sCv7SeKdY+i4o
TLSH
T1DF15391766944FA5C06F513089F54652EA33FC1A1F2047CF16B8AF653E32BB06A3972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 45aebb5b18f90705ab4e5e99e869bf4b26bf2d6dadcae31270e770761ad72b6b
MD5 9a25834b5d424fab016cf4123b94fecc
SHA1 5b57d4be427f122b9f509070cd4266d98af95f70
SHA512 e5de73dd5409edca831acfabf9e52427885f79c495a91d76bc9da83011acb7a4c3154008e61071d8d837fd251e89ecc48743bd160c3c26548a076f12f5cb8150
SSDEEP 24576:t/sCv7J/sCv7SeKdY+i4w0Le5ji0hmxNrM:xZWYPji0Aj
TLSH
T140653B17B6A44B61D06BC074C5E65656EA337C461F3087CF0268DF683E23BE19A3A727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 890KB
SHA256 0d528be8af765e7c27adf186a61c5073ae87f68cd96a347f3706ec6e5ea99925
MD5 2edb9dab9f8d82afbbc2de0fe5a5aff8
SHA1 a4b450a7a2a5f449bf99a1bb6ca7b523a580eb6c
SHA512 d0ba96ecccb012b8a318f874da117b4f27e8355b2840aa9add8fb7fb13818a85e7d5c22e90c467d59a55e383751e46114bcefecdfb25341c8fa16dfd49bebd43
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4Ka:t/sCv7J/sCv7SeKdY+i4Ka
TLSH
T19015491366944FA5D06F513089F54652EA33FC1A1F2087CF1678AF653E32BB06A3972B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 899KB
SHA256 983f08f86c2ad167b35be280e6866ab1bcbb2a6da50c98d6d28c003e474c0d4c
MD5 18808ee1fa6efb62808b12465f48d35c
SHA1 783383f8ccc246995880344f15eb24b1d06441f7
SHA512 0ac0cfb08debbcf7c44d7e2babd84203229af7bd37b7f9db1153a340c80e59e3666708898bb44f3e5970fd7691a5e16b66a0f3cfe0c64dad6c63c7fad48cedd4
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i476:t/sCv7J/sCv7SeKdY+i476
TLSH
T1F515391766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 899KB
SHA256 9af766a9da81f03586674f14f988c97ac48dc6b64e52b9e3b0cab4a3701c45ca
MD5 c0661cbfaa03620993243da7d385ce3a
SHA1 7a0fa7a2f21f0ed60dbb22c4f307d06b43d6bd7e
SHA512 a57bca072ba6ad21b44d23973838635ac7945aef818031a61c0903f283c85fa32e55caf604b0b1942d0bc78bf80ab4dc03335c3adb10ad3bdc4dca2f3d01eb3d
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4lN:t/sCv7J/sCv7SeKdY+i4lN
TLSH
T1B715491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 899KB
SHA256 6e3ee2c3a8c7a0bcc7cf9f5c9750ca898bdec5daf7c91be25993fc3734b794a6
MD5 3096d1a18341a3752c2766e76e6dd5f9
SHA1 f7a320b02db2236ce2ca7efece1427a8338f4c29
SHA512 ab1392f2eb5368d05df6df334f9ecd8ee8167063ac2f60602c734785b403bb963394519a285bbbf6705b4127f4802a376db970ef2260390c326a11e7148a8ccb
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4jf:t/sCv7J/sCv7SeKdY+i4jf
TLSH
T14915391766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 899KB
SHA256 0d6b0004ee62bb0eb6c12d9d0cf3f45c7c026052b21841c54504c0be6631d7dd
MD5 3e946512f98181e52ede4e16bcff85ff
SHA1 32967003195dbc1cc9e5f7949287fb8508c6308f
SHA512 63b30550912e77e046f68187045a5bdbe55b9fd3b31093be860b402d46a44fb1001e9304448c29a246390a6969bf2ac1fec4936a0ea27f8580ea5ebb7f87e337
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i41o:t/sCv7J/sCv7SeKdY+i41o
TLSH
T1F515491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 899KB
SHA256 0aba776bef2e10e65fdbed6fa83c97a36ae1c36f688779c943444eca9638c1c1
MD5 0cae1b73feea4f8ede31a68329ba5fe6
SHA1 7916502d7715eded71c0cda8461f0dcf28906ee0
SHA512 62c6a69fa37c00fa2eb339c72082e8ddffcd28895419360a73ffa0f084281ddcee06ccb0647874e17795145d2c8b0e5a8c69833bad3624f14728106a29538d31
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i41u:t/sCv7J/sCv7SeKdY+i41u
TLSH
T17015491766944FA5D06F513089F54652EA33FC1A1F2087CF167CAF253E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 899KB
SHA256 0f78dccc03da4b708bd58a8eb6b3e71fbe6e8d361ee56979f73cdfe592923b1b
MD5 3591e3df0f9dcb3ffa6d97d186022a95
SHA1 7ed3998bb6ce08bd0000eb6b2711314e4b958678
SHA512 7fbf3371071460cbd5d0dea56693e22e518350efacca83c02d1967d6cca89a3e79d608f85c97f2655a951f0b390a364c520cc42cbf440354673055e55ee2a1b9
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4r9:t/sCv7J/sCv7SeKdY+i4r9
TLSH
T10D15491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 899KB
SHA256 8f577281c3d9edb6a7e39c530ca38aec40541252f1c2aa90d7187d8cd0fbbb35
MD5 0c8d0d31e6e80ad6a12b4b7d430a3217
SHA1 c0bdc3c26c398275bb16ef7f861858f2443aa68b
SHA512 e928fc121b4eba8debde9a38c107f733673a460f7043630640934c49e46c5dc91775087b695529cf70f895645f1c8925c543a32e3c2b4a553bb93b666b8e1efe
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i43c:t/sCv7J/sCv7SeKdY+i43c
TLSH
T14215491766944FA5D06F513089F54652EA33FC1A1F2087CF167CAF253E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 899KB
SHA256 f62763240c2cd917f84f7905ad721fd9be4b7494a62ee8ae1ba701d4301db7f8
MD5 12b2acf655d51a19f75b8a92ef3d294e
SHA1 7394d10ec9cf929fe3042c1e90c990a5c9a5eb0d
SHA512 32997a85e7fdd7fde019492d2d20eed33ef61b9c833a5b72c404708150a4559d783be1df89a4be9de1e0618ecdaf5fb9a69879e08e26ccc74dcc40d2549c61ac
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4Ap:t/sCv7J/sCv7SeKdY+i4Ap
TLSH
T1BE15491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 899KB
SHA256 382f25b86ebf3b082b181ce7dfa94aef982ac1705cfcfd43753f080e52a798db
MD5 67d4fc70f619615cc76131663a0ff623
SHA1 807d6caac12366587d5c82bdc6efdbef03ee617b
SHA512 d7fa1097d70f34246a12932a224794d7fd0afcd196db8a052abfeb379c768c561d24945b5efbdaef4e7ec45fb3022a569b22df26807502413bdb4562d7f0af69
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4H0a:t/sCv7J/sCv7SeKdY+i4HN
TLSH
T10115491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 899KB
SHA256 5aa04bb472adcbfcde2ca29a4ee603265e1a2a2a3a5eeb5013311302f73e7148
MD5 e5392281f28969bf75f3089aac419339
SHA1 21227df710775a30001317f04f83216f1742bd00
SHA512 afba4f1e01afbe2539d8bfea80176ea3741a384059f1721fd095a11d0a52e834578653f7a03cf4bf2db03b325908c4de5942da03551e22f576b7ed32abbd01c3
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4lF:t/sCv7J/sCv7SeKdY+i4lF
TLSH
T19915391766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 899KB
SHA256 62acaa6d4b6d37b7e85920301a31918ab6017be268c52352f2991f7481c2f48c
MD5 b4559f3c0b6cf2b9681a6b92ababdde1
SHA1 5f510820f2a35f84a36c3e4e99bd1915e3334f59
SHA512 8a11f5cb5ddeb65b1ae1508e72395117f59d836b0e4754a6ab5583592e6378a6e134350c61f2ab6f4dd4b6da498dcbb9d54e0a616f1fa8de979545ea2725a4e7
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4GC:t/sCv7J/sCv7SeKdY+i4GC
TLSH
T16915491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 899KB
SHA256 e82011315092bcc9d4d442140c240101d622dbd5053023b5afe93e584a4453ad
MD5 86b19d3be0ecfa8ff1076ba083c44a58
SHA1 75bc269ba195afd483ed43481aac4dfdc5aba526
SHA512 f662fa3ab5b80a4337decb5eddb374a98305bcc50b01062dd83afde9ee8c8d2d53a01a7bac30a0304367d6069e1252d1993ed8aaa119fb4acb897ca89a93fbb9
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4Jw:t/sCv7J/sCv7SeKdY+i4Jw
TLSH
T19415491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 899KB
SHA256 b787872c681611092fb785e9fa4c4026fe0c59e09bd2617198d87a11b3ca7e69
MD5 9ac277bec3096a04d28f6e1ac7e18367
SHA1 629a62b9c01867168a240d2e9a4590b6cf1a5ba8
SHA512 0dc48f98b8e110607d0754e9b8ec6f262870310d8825e311bb90c8cb8accd431b91c9f7056b36c055ea1dae93a191d51b09428f6ab35649208b44f68f2d5add9
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4QT:t/sCv7J/sCv7SeKdY+i4QT
TLSH
T13B15491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 899KB
SHA256 49a972f4b9388747c57e08702d0a3407e230dca159c75020a46d0f87598da941
MD5 2520459b38cf9a2ddee854ed662fbd86
SHA1 8d77a1910424d28da4599391866a2a380d225ba5
SHA512 9c39db1e3cdf353fd01e1beb6df643cf951097809a18f7e357969c19245a1d7331021a598fd4d9f14dbf13bd7eff4fc0dfa2a5c3801e48d7b32579aeece87d64
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i48u:t/sCv7J/sCv7SeKdY+i48u
TLSH
T16F15491766944FA5D06F513089F54652EA33FC1A1F2087CF167CAF253E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 899KB
SHA256 bbdcc6769298c8af8e5213f6c68d815170911610fdbdd4636f8fc72a53e378b6
MD5 56439d2c5f92aa263dc08ffc35e167ab
SHA1 632c8e51adaa48c4f9d86b3a6df1cc21b8c08241
SHA512 19da06512118aa3a09ca900a1e03a968eaca3fe11626b7e675427c8e902a38e99a607a65e37c13da0bfadc9ff2caf4a17d8c83adfa38524475f22907378a9844
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4ab:t/sCv7J/sCv7SeKdY+i4ab
TLSH
T13915491766944FA5D06F513089F54652EA33FC1A1F2087CF167CAF253E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 899KB
SHA256 51adb0160db269b0131531ef1208300a411755dbd1b35c7a879620db4e8230d7
MD5 3743818b9bb6d66250c7a214aef2a4ec
SHA1 1306d7e968e5e3ac5662ea84d05bc0cc6219bbb0
SHA512 89b291812ddf4a0afe3190db3796fbfffe09365993e0ef6100d6e39c947373e3211b5786b2609ee573c48f7d5681676258c7760f122886b8ba0c9b1175f56e25
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4cf:t/sCv7J/sCv7SeKdY+i4cf
TLSH
T12D15391766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 899KB
SHA256 4e5f0170df68e53127e9da4d45c27cc82b56c12955d1454cbd45501a77808992
MD5 d71f2e3072f7c74d7152f0dc7b0d116d
SHA1 266096c8771db30b6eebe575fa75dad1295986ae
SHA512 b8ad72fe85a206ccb6b3431108137ec15ded0a9a5e4b4ce04fc8b8b1d5709e10d6e2b299e0cb08f8ad0acec9773802dbdd181116a480d087f88ea64130eb6b74
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i45K:t/sCv7J/sCv7SeKdY+i45K
TLSH
T1C315491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 899KB
SHA256 fc6fe8c96c319b0a55240aff969887541a8ead4e404e9e1aebc4304c7173132f
MD5 c916a1bf95ecf0b4603484a35e6c913e
SHA1 ac6316daddc7371dfd441bb2909f4fba14910dbd
SHA512 b0dc6877c343f426ec60b0159245867d5b53463e5d06efb702f4d604c96db82a8d0dd1e09617b3682f611f34e0b5ac97e676b6ba57c89848a7acdf23d2757833
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4ik:t/sCv7J/sCv7SeKdY+i4ik
TLSH
T1F315491766944FA5D06F513089F54652EA33FC1A1F2087CF167CAF253E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 899KB
SHA256 8440c81bcb6930ca9894db8a6ce894294de2af544bba0c5e3d343eca9385c0dc
MD5 87001c87d785735e3965ec8ca345492a
SHA1 44d3792470b086c28f0c38d58791891bfd71b5f3
SHA512 9c06f812a3839da99db85646530f4d1499baba6c17a8ae7fd8fd06323224980385f331ddf4982f2ff490eca34745b7839f4cd193ccbef12784f8177d4e43002b
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i430:t/sCv7J/sCv7SeKdY+i430
TLSH
T15615391766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 899KB
SHA256 42eacedfd67c67968a4253cc8c3b6e9ea263866f39e8a609838e5b7779bb5629
MD5 351625d82db1cc29554b329035f730f7
SHA1 3dd3004086b57c67741ef3df2341350c745db43a
SHA512 88870091ccc19d2a6da63bab8408a2fd89fd5cbb0782dab5d45c7be5f3553365edce35a225ee361179e99b9f02eef624989c4f5c1f45094c4515e3b9405ec524
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4m70:t/sCv7J/sCv7SeKdY+i4mg
TLSH
T13F15491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 899KB
SHA256 777980d9b275ddb088ea193b45a2b13d00281fba00e6459b694647bf301393b7
MD5 8a040c7d82eb3292c474dd8a4bb51258
SHA1 20c70ca7aecbe0708a76019ee7ab18d5529c0599
SHA512 23889cd291bc8d0e1a9c4d84c91474e60806f4c01c70a425854e0b3dd00633a646badc41adac61f4df91e51c5e960632a2e57bbb4549d1c90562e613a26cff7a
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4vr:t/sCv7J/sCv7SeKdY+i4vr
TLSH
T1F915491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 899KB
SHA256 1781e6dc0d29e5850c4a0f02bb69a2c84286353565092700a5b599363bffe501
MD5 d7829ae56e0ecca71b5bf1c458bf1c9d
SHA1 bfd93df9e0b27faad324a66ef6c8d8bc4781ad03
SHA512 4f9c8af0cf1782e1458a113a89ee6b5ce2307a76b6744a1c460035d414df837125572205ae8a6ec4df30b16661b77aab1ed5872ea68b1b9840a9d54b05253bdd
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i45n:t/sCv7J/sCv7SeKdY+i45n
TLSH
T1D415491766944FA5D06F513089F54652EA33FC1A1F2087CF167CAF253E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 899KB
SHA256 3c8e221ac334b47f74c912d925e6cdc50a1e0b429727fffc048d83ec9de10857
MD5 8224347f9f884efa1a89fa62a02741b8
SHA1 c79a637d4b8a41bf21e3d22c6b64f8b74d60c38d
SHA512 1aca74ef743dc781c4eb35d7d2dd5eb776b38e9d753b60f9cd82e8d7aa0f8228f2063c4d73aaab8df66cc304532549794f9a687c1fa849f2bb424cb4ee297937
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4Vx:t/sCv7J/sCv7SeKdY+i4Vx
TLSH
T1D015491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 899KB
SHA256 5928421193d8a08b1ec48550b15f824292085d45f91665701b3bf1ea9b97e8ff
MD5 b52cc68729b8f1cdf82a01e413640ab6
SHA1 343609f91fef78700824050da634f2623bc7ea57
SHA512 2a4af1a75ba918a5b2621be67bf76f63e19c6cb04edf5b51b2b6cf4a69bb8c8140baa07049c187f3b05ba1d9533c9130165dd9fe3cb40b3a2920fa81d4882cb7
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4LA:t/sCv7J/sCv7SeKdY+i4LA
TLSH
T17F15491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 899KB
SHA256 d7c538b5aa0dca844fe22e954c2118c9520bf187ca4e242837ea864567e3c56d
MD5 123aab53bd543cd8b2f8c7e3f77ace40
SHA1 8d1c876919f420a50c7e3e06abce61c93f666024
SHA512 b6aef7c3f3221112dc6814c0f701f5643ae18f549f609f48c61a93f321abdcdba9d585ba263d36f9c94868aebcbbd88f96d942ef2f61b4e07da7c8d0b710cbe4
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4c9Q:t/sCv7J/sCv7SeKdY+i4c9Q
TLSH
T12215391766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 899KB
SHA256 4625991b8a20b15a17040105bd7b047ef7966723a70eca65f8ff10ed78cfa675
MD5 de4866c7b4ed05a4e877d5ddef901a56
SHA1 4264b9537fd3077d6207435a0b65a40353e9c079
SHA512 4739a859508531850afb27d33370f37615abbe0f0c380ca96f16c9faf0be3d51aef88c64a5107a5c370fbb31ae216a3ef0db8880120956cc9c9a46dcba8140d4
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4F4:t/sCv7J/sCv7SeKdY+i4F4
TLSH
T18E15391766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 899KB
SHA256 9124b10f722e955b571cf8c1846e1a3750a009edb59ae8a08600bb76fa426a7e
MD5 b4af63fb86edf39a0db211359cc4d508
SHA1 bdf1dab986d432d70758001c3cf8affcd9402a66
SHA512 6474de149bd20d12dbe12f714e3b75dd728fa48bf979081dffa8aa71cdbff6c9143fc80c2167f5514d96faa4dfe89eaa5852cb8ce53e6732c25f0d0bec343b5e
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4Qu:t/sCv7J/sCv7SeKdY+i4Qu
TLSH
T17215491766944FA5D06F513089F54652EA33FC1A1F2087CF167CAF253E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 899KB
SHA256 0fe309d3bb3aeb923739e90e1cd9b5bf512dcba9e4943ae781fc3723b4325190
MD5 474d2225230dd30c4ea86d10bee644e3
SHA1 1956525af789df02112d5275c4f677d76820560e
SHA512 91e7e32620459db594c4c3a1c8f2e091010f384da34fa24bf2d4a9aabb34f68ea283dea03eb4307d939cef3ad303c338f73b58a0636c48a77e858cdde2f8d928
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4Rj:t/sCv7J/sCv7SeKdY+i4Rj
TLSH
T1BA15491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 899KB
SHA256 97ffac50bd8ede31556fbe4e02b4c6ad7a1b9f3bebf8e45773d7aaa9bb77050f
MD5 0336899dd8969235db0dc4021d1e9795
SHA1 55ddb9788c316c3e24b51d2018d16886d8f4222f
SHA512 34ee209717ab3b6a4887687e2fe467cccd2891c9a7f562e9e3bbdcd8107560be7d36023f7d5111392430ddce4103f0c723974fe9bbc2f6c23b69a69acf44b217
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i44g:t/sCv7J/sCv7SeKdY+i44g
TLSH
T11A15391766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 899KB
SHA256 e073308e987529cbb849116941f2efbb7b906690be56f4300863ca88569debd8
MD5 8231ef6d003a784cd896d32e17012cbf
SHA1 78474a0953c4f9895d76f8406f47a1b8c7cd7150
SHA512 d21b37c1bf8b3a459e5037132c8e9453abd734520edb61950d2033aab65da827031fff98d3efb944ebed98317d4653eaaa59c158578541ec1d7ca7e396d75ca6
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4XI:t/sCv7J/sCv7SeKdY+i4XI
TLSH
T17A15491766944FA5D06F513089F54652EA33FC1A1F2087CF167CAF253E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 899KB
SHA256 209d494cca357ae511839c9b46145bf2ddce53748537f803c58d6fad430be603
MD5 1213521c7b8c5e70251a5fd3da9b0384
SHA1 46df10f294b2d1d5fd584bd954435f9a65b6d4f8
SHA512 27a47abbc8e7ec640d9da39df12723917f9b8f174f6f0b2e8158abd148e372d6199f166a129e2c11eb949be92a5fddf605a7b1e6f7bb552f6a363c9d1b77d394
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4do:t/sCv7J/sCv7SeKdY+i4do
TLSH
T14815491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 899KB
SHA256 d84ba7cbba92e33294ab5e158e8766bd24d323c3696bd277b8cb9cf305b899d2
MD5 d3094f62f07caf016ea11cf39cb6a00f
SHA1 73c673e5095e2de4e1e78cea93b2ebdc53f496c2
SHA512 da605dc376c5c56675d7795cddd91a3ae3ea4b99f7c41132f7149c34bc9e85b113237c8379278d07ad67bde933319310981af324d42bf8e71e99f16c3647fb41
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4O+:t/sCv7J/sCv7SeKdY+i4O+
TLSH
T1C215391766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 899KB
SHA256 6c683a17f1836e2f4e60b55304ecb469e456558ef360bca3ce4a0c2494673010
MD5 89c889b165fde62e96231959a4250150
SHA1 ee162bbcfbff41be52f9e847c950cd3c75ba327b
SHA512 1e05958fa4943edbd753d35c2441d39a4491b5915c6537de07f542903107e24b9ae9a67f4dbad6d63d67a6953dedebe8ac54d32fac90d87152e3728af1eecfaa
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4OQ:t/sCv7J/sCv7SeKdY+i4OQ
TLSH
T10B15391766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 899KB
SHA256 867b5968418f54812a139b859a86b01a70409212810ff98373715019460d38a8
MD5 7b02089e714547eaece12b45bd48d25e
SHA1 6937a956bb8d8ca7faf19be7b328c256dc14189d
SHA512 10fad8807c627a483eb0815f8aad60c0f5b34376c70962c9f6f5d62e6ab6fc610ca693c42c60f222bef7f7453056bdbc242c80ab1364803e0cbd799e5451589e
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4vX:t/sCv7J/sCv7SeKdY+i4vX
TLSH
T1D515491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 899KB
SHA256 b5ccfba497ecc14ee9c55629b1bdb75424a0964ce5e9318dca7412831e166c65
MD5 79f4223acbc0c6934cfaf5c6a81ccce1
SHA1 8be962bde72ebd109fdf554d631829e9122930d6
SHA512 40ac4dc630184d9b5693c3fed366d4a71a201a9e4eac1c94eae54a8b413996bd06e4480e7d1faa558e596ab931dcbcd9294c014dfa064fb4ebd3d0aa2a3e8984
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4lL:t/sCv7J/sCv7SeKdY+i4lL
TLSH
T13215491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF253E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 899KB
SHA256 d5bf02f97903845ad5756d5749a104ab33d5fdebb4ea24d857067fdcfbb84ad4
MD5 4df77361005e043831a0ac89f7061b62
SHA1 d56821ab5d07f24d0943719cf4f0478d6b292c6b
SHA512 a7514941b003f968664dec028d45b3d93e082e496e8821cdef5537daa9d477eef89c667f1412d07a66c9fffa37cd26642ffc7f9ce3d64aac1fb20f3a39d9998f
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4DFC:t/sCv7J/sCv7SeKdY+i4DM
TLSH
T16015391766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 899KB
SHA256 612616431ded516fe5f12a7f6782371f26fae16142482a74145ec6703b07500a
MD5 194a97fb02c370d504ac1122c42b825b
SHA1 e9d416ae590b093137ea3b87b2285f165d03ca6b
SHA512 9702be7d28aca9988da4cdaaafbbd1c4b10c5cdc6f6313010e75c4ec2f7c92819c8ae716929b67c79dc6e608b610ba395c75daa86fb83027783e010118d28afb
SSDEEP 12288:uE/72wcCvRRqE/72wcCvRR5uvQ68KdmfEE+i4Eh:t/sCv7J/sCv7SeKdY+i4Eh
TLSH
T1BF15491766944FA5D02F513089F54652EA33FC1A1F2087CF167CAF653E32BB06A3962B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4840-209-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6072-166-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6072-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads