fe744047c21a101104f8fcbed58ec75813724773192da312f952fd2641f251b1

Analysis

max time kernel
97s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 815KB
Sample260814-edj14stycz
SHA256 fe744047c21a101104f8fcbed58ec75813724773192da312f952fd2641f251b1
MD5 8f7b78e0f1261c4d2d8e3af17f55cfac
SHA1 428b0ee2b8c011712349ea7791dde10b312b5580
SHA512 2d4b5fc2c6f3a375629826c40a9bc863c11f95e93205f1e44300d5055ccfb08163b4edaee1157aee4a868a484fa3dc84faee05a2d8ce7ccbd80edc65ebea0a85
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3N:A3k03kHRJg
TLSH
T10205AD13E79500E8D10AC1749A9A9A33FB75BC561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5836-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5b2-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5836-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4180-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-416.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-594.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-705.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-736.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-773.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-841.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-866.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1355.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5b2-6.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-222.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-259.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-416.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-508.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-594.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-625.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-705.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-736.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-773.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-798.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-841.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-866.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-885.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-892.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-905.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-919.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-933.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-952.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1007.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1050.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1081.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1130.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1149.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1174.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1181.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1218.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1323.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1336.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1355.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1374.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1381.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4180	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5836	2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4180	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_8f7b78e0f1261c4d2d8e3af17f55cfac_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5836

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 815KB
SHA256 fe744047c21a101104f8fcbed58ec75813724773192da312f952fd2641f251b1
MD5 8f7b78e0f1261c4d2d8e3af17f55cfac
SHA1 428b0ee2b8c011712349ea7791dde10b312b5580
SHA512 2d4b5fc2c6f3a375629826c40a9bc863c11f95e93205f1e44300d5055ccfb08163b4edaee1157aee4a868a484fa3dc84faee05a2d8ce7ccbd80edc65ebea0a85
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3N:A3k03kHRJg
TLSH
T10205AD13E79500E8D10AC1749A9A9A33FB75BC561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 8532a68cc3b7cfe1b49459cead0054c9037d658217d7ab4dec1129c31e540386
MD5 dfe2e3f327d46421eb00fb13bd72d092
SHA1 372d9a2242c4f662e79117276926f797fa88d2a1
SHA512 606aaf3d9c21fe8ffc69e763289df731677a55d358be032fd148f796870e628bbc21ebf8379ebe3e27252d82d1558307296e313c848de37aa3be2d079afffb56
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3Z0Le5ji0hmxNrM:A3k03kHRJ4Pji0Aj
TLSH
T1B2558D17F6A402B5D027C0B9C6D2966AFA713882173096CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 830KB
SHA256 76d1b014dee8931f437160c295e2037ccd05dcad9477e28062642fa253664de0
MD5 e233a0b4ac012339d8bca4f95ad60ba0
SHA1 6eb3841c65288edcdee760322b1825b3bafe2378
SHA512 1574bf93c03d4529b825e547644c02ab112b1a73fbb8240468e022bdb0618c9ef2b5f26430810d1b6bfbb9ff8a848e63f81432353c28da1753a60bcd9863d544
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3La:A3k03kHRJ
TLSH
T1AD059D13E79500E8D10AC1749A9A9A33FB75BC561770A3DF2358C6152F62BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 839KB
SHA256 0512af36fe638e4d980e175a4ab93e070d04c664be153818b64ab36789e77e14
MD5 b8a93f011eb57d5c0c8f10a8d6f7bcbd
SHA1 a2639c1bc5eaedd920f1308ae321c83535516ff6
SHA512 8d884dcd4188684b372c4f748c24023a02cc41f0b8b0c04a26f55aef11e3b646f23efbf574488d5fa6028e2a61e97e43a9b967dce49c035d5f206f7e5421008e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3K6:A3k03kHRJm
TLSH
T11C05AD13EB9500E8D10AC1749AD69A32FB75BC561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 839KB
SHA256 e38be30a36578a18cc4361669f80044cce731dbac579f9a79957f3c211922546
MD5 72cca9556acce438973b2aef46c2111d
SHA1 e878d2d9aaf2505ee14b8355b752743864d3041f
SHA512 0a4763515563374c561ebb5079437a8fa660127eb898969d6477170a293c78df3cb98be70ab8ef3e438bebc2f94404a66fdf4395e2ebbe9984b0813f61026c3f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3iN:A3k03kHRJ3
TLSH
T1CB05AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 839KB
SHA256 5fd20515654cf5f1a8efdc4024bc620c1851ab73bf7a4739905077d3b4747072
MD5 385696e2725873ecb9086aae20cd5b76
SHA1 4fb8217d25900ad038d455d9335c96d37640d095
SHA512 f7c310cf2a37004e432c080866669f122e5ef4c7a636e77bf0dd82d87f53fcd49650eee19a54aabbfc3de39cbecd5933e06a9c4ca7a676cbe9bbf6fa35f6c8db
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3Yf:A3k03kHRJz
TLSH
T15E05AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 839KB
SHA256 8c9019e542a4a5f9fbeb60d3289cb188bab46b7f1b010b901805a26488a11604
MD5 92fae6a21db674b0ae185d29d8879a75
SHA1 c47fec37a444e7aa624274822046f7746aba8a80
SHA512 1765c8cd040838e9163264c81256fb96ffad9e8881180ad0e9cfbbed6b4771af992b861105242ed960c68b662ab80839d9cc6d69580a01afbe2ab97a677ac273
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3yo:A3k03kHRJi
TLSH
T11805AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 839KB
SHA256 3aed52a2db71217684fefcc9c93083daa2691ec9e9cf1cad3bd9952ae6b27ea1
MD5 a080986ce60beb138a0e299b58009bd0
SHA1 1e04d4f4cc5bedbc268831aa2a86931f9af70896
SHA512 9c5c621fcb0146139e2c93465b025b483dcb683171e457ac1932a5ffac311a8bb9fcde1b6212e8c776d4d148e8ad8a44fb4e6c0cdac56da241d3f47cd31416c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3mu:A3k03kHRJs
TLSH
T17205AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 839KB
SHA256 388b96023f693097e9a26e356c737b833c42d7ace905d1673c8a8711ecedb6e1
MD5 d62dc97bf498f22f10e08f12923ca2b0
SHA1 49e6579820898b1c72507465437cae2126f84356
SHA512 3b19a025de4e9e262c0f1756485b7810c5aa8560cd021d9ee046cdcfa279290a6b4f0324f07f78b0ddc7e297d36578509722715efe9310266268a946404b0d92
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3a9:A3k03kHRJx
TLSH
T1B905AD03EB9500E9D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 839KB
SHA256 8b1a5626768ce1d40a433729e6aa5da4c4905005b3ddbe8d220192b19327e07b
MD5 c8df849f5a150d0f63bb82089575f26e
SHA1 b6a83726089b1de5f7fdb1bc1f0fedb7adf8168e
SHA512 580f1e7661fb58110154ab4c52b44d0f413feb5c61730428d7df3b5c7e1b6785c4f129a31280b3244d953e0dca3c57b1e0db4b334f4f38e59f6eaf0f0f007ed0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3ac:A3k03kHRJE
TLSH
T1F605AD13EB9500E9D10AC1749ADA8A32FB757C561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 839KB
SHA256 d4407e3b50f7ef745ff68c4c485a754cdcff2712f566d14e50b84bf5a22774cc
MD5 2b85c3c42a65fe8a4d7c32b2693bbd29
SHA1 5f458887bc14109d7eb84ee6a6e7bb77d94c30bd
SHA512 368fa38aebaa49a07b191efcf3fbade94a83654414c79e11e9f882e65a04ae79edb1a6cb5596b044ce2535918abcd6a9aa819bdbb554af4d2bfd0a87f7b29ed6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3Tp:A3k03kHRJS
TLSH
T11905AD13EB9500E8D10AC1749AD69A32FB75BC561770A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 839KB
SHA256 81d072e0649b4ab1b1e95086b4f9bad38490f4095e04ae7c9ab5020c6ec30a59
MD5 2da34ee2e178056603f538b3d5767f93
SHA1 f7e97a48ac858511ad6deb469293b12157be9471
SHA512 493b88b6cc92035d7a310238740d5204da29aea4045e1e0319d8d403c2cd77cae938597f1198a3630610aaa04d65ac3bd6c907bab04508f2f8644fec3fb10561
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez30N:A3k03kHRJV
TLSH
T1BD05AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 839KB
SHA256 47abd817d347b6a88fc55c99e3bc21923a1ae3e8163288f46f1a5f6693cece0a
MD5 e430285fdef3ab7c9027b05e455a7b72
SHA1 34e47a1a1bc6426570e173cd4cb36311382df914
SHA512 9f29f8e313c3ffb93c2b9b1da61f47472da3e0852e7caa8803b907e1ef837b8b5825eb4a22227b1ace0108b749a5b725434a032f4b4e49598eb9ec83d905f7b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3cF:A3k03kHRJf
TLSH
T1BD05AD13EB9500E8D10AC1749AD69A33FB757C561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 839KB
SHA256 d83e40ca9cac0434d27e1e1158cedb8ca49680fb769d9ddd91d00428e814c28f
MD5 e8ddc16db838b4696eb57bd2e073bcf1
SHA1 061e3b48d126575e7bbc6ecdc26b8bf780783333
SHA512 c5b7cce7356c69a6f60c1c4f9e3713473ce75586cb790472ba5012b38bcebbb566f640cf48473e72ae53ebfc1278b0d17cebbbf65652eb880305a349d6a44343
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3JC:A3k03kHRJT
TLSH
T1BF05AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 839KB
SHA256 d63aff392c1f21e3c9670eaeae846edea977eaccdfdcd517703f4db63d408e96
MD5 85edd274d0f5f0d43386f34118e5f68a
SHA1 4df9857e1ec230bf61697d39aec364cae6769770
SHA512 26770f579e75105ba7c87fc8233e6d50bfaedf40e2383601ffd91fed2e1d1b89d427438453f60f0981eb3137f44d0f41c7cb440a0d4ac2f5451bd164c470d42d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3qw:A3k03kHRJW
TLSH
T1C005AD03EB9500E9D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 839KB
SHA256 7e4978ad0094a3f30795ad65159145654c96f26cb30ea825021668f4e628d9d8
MD5 d8c2b3fff7bc3f3e6999c9a5cbdb88a6
SHA1 05da8dd345524f292e52d306e9654122ac4c62c0
SHA512 2c6e67850c6a99f3f82785016ab50a130d4fc3086511352238595322fc1d0ef661636ad10b1a4c6333db2054cfe29741f1f0bc802eba925a3134bfbe6a14a379
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3xT:A3k03kHRJW
TLSH
T14605AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 839KB
SHA256 300ebf78a99bc00c8fc5309a3351a649b764b6dc278013b88da6928dcaf73b96
MD5 312f5ec3d9815eb8d041de997e67207c
SHA1 202df90a21233c00ffc4d67a4aa2a4b9e6860cc4
SHA512 89c9a3c5c723a9173289f6f09db93547d08fb850e50a506686f092cfaabbeaa0310badc20961921dbc1d4782d58174e92f4a28b82ac5530dd6ab4aeaff040778
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3fu:A3k03kHRJx
TLSH
T18405AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 839KB
SHA256 832fb3f1373e19d1a5af0980fc3ba32a48b33ff0b11c2ad9c0dfeb760b68db5a
MD5 3984c9eaef6bfde48bcf1f17a5f3b1e1
SHA1 294132f9bea18fa4b1817c3e1fc2e5882c96747e
SHA512 426b7961c1a439c08c33627b96ad08162ceff0cd0a0175d242bcf48da7bf0497911f754db2feaa90e63924204641eb55a94fbb2bf3b513a4255a9563bc4280ce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3Db:A3k03kHRJQ
TLSH
T1BB05AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 839KB
SHA256 935c3064ee2124138e3d3598896cd0a049a5ae5dd0a62fc684df1e27d966f50a
MD5 3b22b5f588ca17f9047dfcd4c74f6dbd
SHA1 e1a17b8c703d3c2f57928b0e8ca212db8f9cf61d
SHA512 a14dec6caf5b255deee4d0e2b7392e76b07b4011d0953187d9b854b6a8f9246c473142020bdb42354e5be4d4b8a4117b7351f6fb24f99fdf7ca9982bf409c73a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3Xf:A3k03kHRJA
TLSH
T17805AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 839KB
SHA256 e3e3444d0209ec3c1e57fb52fa2aa943e1d02d2c46ec2cb289eeb127fb2b416a
MD5 1f8fddeae8d30d2ec4466f9245b85863
SHA1 2f1aae583d422d1e075c4b9313c5a6245ab2e5fc
SHA512 5c3dd18928dd990371369e471688390eb8b2d96c4a6630107efe57e256415e3d75c454834757eba23ed08c2f801c5d454f742b2801ff0dca9112fa95e3d8a988
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3gK:A3k03kHRJg
TLSH
T15105AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 839KB
SHA256 e3eb568335a569e2b991a80826b92d1f8862d96eaea644d2d841e8e915863684
MD5 48fc2da483d35ed7b56d239e810ef328
SHA1 d012305d0ca887625c1974fc4589fb411c864621
SHA512 b1747f44e600d7c7c5628eadc67f071dcaf0fcd3e63aecd412748c541ab2dc7e85eae62fec5c5dfdd849516fa60a425517ad303542515d1efa1191fb8410dc58
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3dk:A3k03kHRJJ
TLSH
T1DF05AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 839KB
SHA256 f7adc119c8130ee6c81e52d02ebf2fc9400cf3a4e1cff6a229b45e9a1ba6379f
MD5 29d9b033cd985515b8beb50c64cdcc16
SHA1 bd426b2caa61b59351b1120a7f52b655b9ea5276
SHA512 47c344b2bfa81ddd878cafe8916dbddf2a554e0b61b06fef24eed9a4a25d3330dba82eb0680bac0b00b8b852faa4e046b48c1203fd354c6b67ecf29d4cb795b3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3C0:A3k03kHRJ8
TLSH
T1CD05AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 839KB
SHA256 8cf165709d9eee7f2daf483a47bbafedfa8443780c6d5bd7a6f6e8bfec53f79d
MD5 228e4dacbb3a434ed2fa7f2ebfd1cf3a
SHA1 8d98c99203a538f70373fd2bdf85dc4291d9ebc7
SHA512 c734e10a5266a8243ca27f6579f8a919a382180b4ea47ac3792a26d606e292a009bd907632512d0a01427da99f3144990b62a5ccab2622dfbb4dd110f544613c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3Rg:A3k03kHRJB
TLSH
T18405AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 839KB
SHA256 366cd8255188cad63051d4aa293340abfef3b0063e78d6547f452fb2c5ccc4ac
MD5 ca70c1b38d2b014345a45bce4aa75deb
SHA1 6f2d38e679e50d3fd65234cd3af0ca6768a66d1f
SHA512 e5a15a3d72967b2218f175fabb4aeff4a08014aa61da91e34bc5512d78c407b03759a152021400b65958fa7a9c7651cb02bcf0ab0abd98c41fbd34606daaa062
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez34r:A3k03kHRJr
TLSH
T1E705AD03EB9500E9D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 839KB
SHA256 3530192933fdf0ec06233d1ab3823a51c228f61c2f0337987385ecc2ba36ba03
MD5 1b71e5493ff08522980a0f218c6a4e15
SHA1 0d1933bb954506f89d7b7df6ea89703977c42678
SHA512 1204a873f1ab195f351feb9b4c8aa67aa5fc628a5421f5afa5ac0785275e14a1d12000afeacff4ec591a820575e769a9d152db9240378a828a448150fe255b0d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3Wn:A3k03kHRJd
TLSH
T17005AD03EB9500E9D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 839KB
SHA256 08e67fe591150addeacf49235b6b516e3f4b6bda637d5548c01e4b050df4207f
MD5 8be0d091d89780584486015c6993dbf6
SHA1 71d86ccdef636022fb1593015338220b7ef16e1a
SHA512 bf2d37b6c8af4103fee0750a6d44a3d4eddfd4e8e3b6dbea651be5c005e325fe251972dc3b3e01d51c25d5b57ea75b96e7cb18b0efcd01489b7d2a46a78554a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez38x:A3k03kHRJj
TLSH
T14505AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 839KB
SHA256 9d62f725f93d986a38410c36938d297f878908b600b021117e2aa9b3cf75202b
MD5 e0a07d889489161352e7b0a7166e1664
SHA1 d819de8f25ea17b12425947e43ae62d8e1208b71
SHA512 4eaca4eb5dcb0a9e330c8583052c9234ce662b1b0a2c8b81d0b2b691a0a4c592688c1ba05c1c0febc59a15e4e3f234d358fa48b1ad03706f6788b81478875de9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez32A:A3k03kHRJ8
TLSH
T16D05AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 839KB
SHA256 eef5a95639b8c8389700d371e5c0a6d07a510b2fac09f7c76295e43f18c132e9
MD5 49d8d3a3a8f2415669a0541ea2a8237e
SHA1 a0ea15e766e17e205dccb20d70ea638239607ec6
SHA512 030ad584e917b6eda4994fe8a70703468ac68d808f86e39c4d2f2a1f968b322072cea76895482b1e1e4127b72dcfe5218da4198b81ae9f87f013fa189c642971
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3v9Q:A3k03kHRJ9
TLSH
T18605AD13EB9500E8D10AC1749AD68A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 839KB
SHA256 d208fb798e90123525291a348339a0b45afe96a5161f9c4acf3782abdc84fc54
MD5 36cd7f39beb0f89eddc7436fdfc28f6b
SHA1 66f2d2d224011cecf53ecd549fd91d55f99ca6f4
SHA512 27dfe3ba858d40590f943d08bbcbbe39fac746b469c5065261622d2270273ee248eaa69d1bba7302f1979c956ec0c67dfcd4398794fb14ddac628c972b8f1b2e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3G4:A3k03kHRJi
TLSH
T19305AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 839KB
SHA256 1d3ac4ee8178550962b39311901d6bfcdaaf627d6d5527d1693d8e865a988bf7
MD5 63f73b2ff1feb30e6cb3be233311c0b3
SHA1 7b44ca9fc46df13aeeb158f79bee40d2553c56ff
SHA512 7186d0129ae79b8c5ebe51c1f8a8288f0b473b70eafb590aac8316d126087f64b4203fff559b2459abbe5ebe506771de5b53f2c49de2ab43173c03ee9195521b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3Vu:A3k03kHRJT
TLSH
T15005AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 839KB
SHA256 2f74181cd13e699d0a971dbe60d336d879d5922cc9c1622d8edec30b9537d00f
MD5 d8d09ae3fb125bb9a3b6f13368ebd8a7
SHA1 6268a59910ae6875d6282d6adbea1442bc3e5c4f
SHA512 b0383ff1e6d7d82f520c660ac99109e1147f3bcdab0a84b47e170daff4dbd725abc94dbdfd5a9e4cb1384300bc732c7d8471fb7574f5b4949763314bcf990ef5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3Ij:A3k03kHRJd
TLSH
T17505AD03EB9500E9D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 839KB
SHA256 e4ea3f2daf0dff09995908c0af704087fcb38b3bf9298177e266b33e275d2321
MD5 723c12ee89090de6ccde5a7250e12695
SHA1 1dd519077c859896a8d436bc669204527b109520
SHA512 b685fc9a5902ec3847449837850a94213d548d506d9fb7ff68d730957f7aa838a91664c81d1fa93d341f1a32beecc1da53f3ea20d47f89e25134bd518ac88e0e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez35g:A3k03kHRJh
TLSH
T1D805AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 839KB
SHA256 cbdca02361442b016d5e5094b163d3c4defd219a7593518d7f6bb9035e7823a8
MD5 30047c0a2965554146889f1a6976faa8
SHA1 1e7a7b0f9f97b705ddedfe5e9576e96ea3a692b7
SHA512 1d841bb68e71c6d5e6a46965ef8264609a6aea4a91d87b9d78d5cd9343e26edcf733a8e25d673c32b6b67c39124c9a954e85f8957cccbf4c89ad324ea74f5590
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3gI:A3k03kHRJw
TLSH
T17905AD03EB9500E9D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 839KB
SHA256 337dbe2db0caf3ad59ecbe825391dc3e03fd4de3aa7f240ba3238f3ee3dcd8ed
MD5 9643d1dc63f46c113501cf06a649b494
SHA1 af132ea1af6c56c752c020836d9720af9e415d13
SHA512 2aa189cf35fd26507f7439ec0312f896cac3044e2a9b7063b60320613cbfa878562927b62a371e9d84ad3aada051308afa8994811beb56739f3aa90ac3ea1279
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3io:A3k03kHRJS
TLSH
T18505AD03EB9500E9D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 839KB
SHA256 30dc26a48ddff590c32e3f2318b8e2cdef4e047374313ab91c71a02cfdcb477f
MD5 e524a6b6c5b708c0fbd1be7ac7650eb8
SHA1 ae44a9affa44f42d5bc9a9df2c9f026fe22ccc25
SHA512 e1656ba09c48d4d054080249279ee499d442164e097eab7f732bbe821430396c90b917c6272d94ff9d3d33562c5322de3efc1f2436bbce5b6065a0493ebe2e77
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3Z+:A3k03kHRJX
TLSH
T1C905AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 839KB
SHA256 d52e5d66583109b548a9fbc7dc11b35e7139f8894292cc08177da7d8ccadb284
MD5 2168717654dbee640350aad23f437620
SHA1 c93fd293d40a5aefc88b69c84fc7f181ba782ed9
SHA512 3ff06ca7d133784894cd7c61446df2a5c49691168f12343e252a4fc5878496814bbd1cee3d54856b2e648296566fa777341758be6b2bb76f7014ba53fc7eb9fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3HQ:A3k03kHRJD
TLSH
T14605AD03EB9500E9D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 839KB
SHA256 549b09fb29103e038af8b0a201a58f88a5a7d5aa41471e8ca6f3986d2a77a511
MD5 1897172d5203975e253826d96b38d73b
SHA1 bd1eb481258616a421736c25b5a0cea9e76201be
SHA512 58c1aa91fd0efe2f963b31937d14cf639799a6e4a8be83cc195ae20928287010fc7ace2f242ea29d3626e765ba35cebd036a6c6e73be9a0d77cfc1e555cd82b7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3cX:A3k03kHRJX
TLSH
T1E705AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 839KB
SHA256 06f7343a1ef45442414ca2e1af2d6df0e3f5093d227a3e18216245d26ac9c6d2
MD5 1ccca8eee1974a260d795f75573e6084
SHA1 e93209f624da86f311078c6bd487bcded79f5cee
SHA512 a1348c0a657d148e22c152ab5b6da6b67caa8ef5c3fb2450532ab2264ac7667d0d409f57e69aa9a31ac61a94704a178323e494ff693b2172b90a24bf56705ffe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3aL:A3k03kHRJ5
TLSH
T1D205AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 839KB
SHA256 b651ed3e9fd14117e714e919078905fee3015157c1a31588380c407ef09cbab5
MD5 55d3f8697fc39bfa7f736017f976ee41
SHA1 170b809b3c1062258a7fb91a011791d034d6d7b4
SHA512 34e76b3426131da6774fab36e72f6630f4822f914ad524ea88fde61e46f2bc19517f250403a95e8a680a4e1f33db90502d0239c2e55f237123f6e686b7678603
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3+M:A3k03kHRJA
TLSH
T1D205AD03EB9500E9D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 839KB
SHA256 d5e95b7a6730dbe12e86f2740e276451e4833982e03fdea61223337a19d67396
MD5 dc07626d7129cbf03af40be4c94fde9c
SHA1 1684ef6e48eeb1ed8611c27ee62ef5f4986eb65d
SHA512 b88fe8b0ebdc96fd9acc9c8246738f10cb1a6f9c228d3bf663e54fa1a5a4490c2b9e7badeb0f4da332ce00a2a648415d4819de36aac0bc98a3d556ef016cd06c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQYGitez3nh:A3k03kHRJy
TLSH
T1C505AD13EB9500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD06F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4180-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5836-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5836-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads