f502666b04cc4a5b4886c91c040fc675b54e8a20c37723311d4fc870cc61c86c

Analysis

max time kernel
91s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 933KB
Sample260818-cedjlsvscs
SHA256 f502666b04cc4a5b4886c91c040fc675b54e8a20c37723311d4fc870cc61c86c
MD5 a591caa91b1d1a9707926be7e018e60f
SHA1 7c83b87c84cdcdde4e9a2fcfa03b33fc8944303b
SHA512 3734c89d60963a68baa505ea2054986890b1e05cb6326c4ae56a00482b5712898358b07cf0451e0720560db07969806c1db71145cc6e241f4b1a85cef1d9f2ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBQ:A3k03kHRJq
TLSH
T1C515AE13EB9504E9D10AC1749AD68A23FB75BC56176193DF2328C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5484-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5dc-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5484-202-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-233.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5240-258-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001baff-458.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000018a56-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198d8-708.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-819.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-851.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-972.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1015.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1101.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1164.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1209.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5dc-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-233.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-259.dat	aspack_v212_v242
behavioral2/files/0x000400000001baff-458.dat	aspack_v212_v242
behavioral2/files/0x0006000000018a56-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-623.dat	aspack_v212_v242
behavioral2/files/0x00040000000198d8-708.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-819.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-851.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-972.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1015.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1101.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1132.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1164.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1209.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1389.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5240	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4F64B9FE-D791-490C-9F74-D185F13EE27D}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5484	2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5240	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_a591caa91b1d1a9707926be7e018e60f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5484

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 f502666b04cc4a5b4886c91c040fc675b54e8a20c37723311d4fc870cc61c86c
MD5 a591caa91b1d1a9707926be7e018e60f
SHA1 7c83b87c84cdcdde4e9a2fcfa03b33fc8944303b
SHA512 3734c89d60963a68baa505ea2054986890b1e05cb6326c4ae56a00482b5712898358b07cf0451e0720560db07969806c1db71145cc6e241f4b1a85cef1d9f2ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBQ:A3k03kHRJq
TLSH
T1C515AE13EB9504E9D10AC1749AD68A23FB75BC56176193DF2328C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 8741718a1437059e0a53971e9478109346fb9b0e6e3374a60ae92594ac1af7a8
MD5 2c7f4260888585a0e38935fadd03bdb0
SHA1 f2d600f165c7c51faba4617c3c540732f582385d
SHA512 6d81e4c8583abaf099d782112c8c24515ad0dd8beee796ba45566eed0d3e41c5a7f185b26f412ba323386507039a40688a979286cdc5b4b1e3ce492935d89fa8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBo0Le5ji0hmxNrM:A3k03kHRJ6Pji0Aj
TLSH
T1B4658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 948KB
SHA256 bdf10854e7cb028d8226441a1252b5e69649628b6cbf99d881107b95053ad97a
MD5 5e77fb07aed350d9a4bcaac05afe4688
SHA1 3eab2a98aa977aaaf9ff4e488ac46c780e09eefe
SHA512 e09dce4a17c42f94a5466a8ba7d5d93817fdcab4ff47342294a3208c0d298318b9efbf8aa85987b83d9fd644808cb7d8aa7f8730f9a973f37eaeaa861796bd52
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBSa:A3k03kHRJ
TLSH
T1F025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 ce742dcd8b0f7974a139b96d02d0e587054ed814b7fda007d95cd65e227af629
MD5 e82d300d67be125494c6adfb92af1537
SHA1 c975808dabefbee64a9c17f3be402813c5ae8e2d
SHA512 97cdd62670838241beef5e24c4232d9c47840d0560ce4c79f582a532a15d633969119bc99f2f80f7f0aeb8d7506eed27f22771e015b076bf431a1c29b4c93f1e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBj6:A3k03kHRJE
TLSH
T18D25AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 ec51637322eb931d67d3a590d86b45bc9f5c1e2bde2294569fbce607ac8b63e1
MD5 90097fc84c803188ecef95a5c10a4d9f
SHA1 51b73cc1f1bdbde5aa840f86379c6f3d7340def0
SHA512 bce44b5dd918bcf94cefee78925369bf8db1db3e312112c725a050ccf4b6a398c8b0587acee9775c9e11381cd92e49d94b30e0286c01d62326a6128d574322a3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBNN:A3k03kHRJZ
TLSH
T12625AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 2e3a9d51520e62271748bea17cec06b805718e014ca2012b366e5d2ca11da48f
MD5 9d4dfa8c36f95769187a9f9f37218c2e
SHA1 d71c577364e10e3d2d055e28a2ab383a96055069
SHA512 87318e829c3649497349ba44a9e9a170d80b57827fc9b3ebef46a748e65d28bad863957efd98ef144afe193757766a029ed14b1c5c1d37beae4c4aa48fe84e66
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZB7f:A3k03kHRJ5
TLSH
T10E25AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 9f3d46cb79903b942de00961f23b40b20db762325b1787e3c6e6563a6639b841
MD5 11b35a28fb9bf5114c7243b526f5020d
SHA1 fa849074e07d9fdd5f8d77ab4d54ceea59c978c3
SHA512 ee8c364c0ba63da47dcb5875f45237dfccd3772ed0024d3ac3acbf9ee51d442907bd9595cce8000b84bdf2313c51259ca48a22da4f7ff344e3f0fe44e8b557e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBto:A3k03kHRJs
TLSH
T14D25AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 a77aa18362f8ee7e2b86e8cf89d9db9ebac37a46021af03a9017fef1d65a6a09
MD5 1da99d3bc6d14a2df98adfa9f8816815
SHA1 104ac1d764b403389e8dd83f91fa2cd71f543269
SHA512 b3e1003cafb882d56780be29476351ddf723627dc33349f92af512b24b7722656e4b308507eab4802bb9553e3cc9c8dcc20f1f25c2a1196d2dd77389ff1f15d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBtu:A3k03kHRJO
TLSH
T10325AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 8cc6c1adfd4b3446fb48d27bd77465521412c11868c614b35ae9a2b7e8e3bce7
MD5 1acca67da045cebcf3e6678c7fd3c2bd
SHA1 d6358369b9f54883f6efcfe6a9a8b12237be1b5e
SHA512 5d1368375cace3a55d27e0ea906c6bea686a5fdca77a08cc04d4f6b68724b29d7e42358e3dc8fb67dded2eb7bcb3930efaf84685570390cd75247f528d2ca11b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBD9:A3k03kHRJv
TLSH
T1E525AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 ea13830fc185034a386842fcaf006f46fafe13c88f79a3f30d161ed954cac916
MD5 0afcc46cd7bfee99a7e63d0644f844f4
SHA1 e365f3c381786437699d7fade42d19e44f23b4a4
SHA512 b8dec70578c43191cff1ae78bdf4e99c3e181b01860278ea68f2ee4988ac92c1dd09e93bc30b5789bc6175e22de5f5e35a8c4ce1d04972a974652cdd3f5ddede
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBvc:A3k03kHRJu
TLSH
T14625AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 5968671ab6b7f48afa231674be7dca1dc430ca25be85408523f01bfdbf45e281
MD5 7ba849cfa5dd7cf4e9dfe7fe314f4fe6
SHA1 6151f1b574270a8b17804fcde0e763cfa7a7b660
SHA512 a778966cd651afac6564343ba0bac88eddf1c50c20c150b42a72eac0c097a4d6c629076796fd7ecd1bc57415aaafa5c25462ccfd81d20ac64a04381567e2e80c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBop:A3k03kHRJc
TLSH
T19025AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 edda3dd1bcbb0762eb944e8e7aa6c27827f5774f00fb6d6c303d9a7997dc3d8f
MD5 81946eae3d8af584900161dbe13cbc90
SHA1 21e56f6f2b398d66977467503f31ee8a89b3a1f8
SHA512 4269d043b49487a508a392c8cc22cae7bee0558383ec84f6af968fdc7674aa05cbe0bf51e3173b248f32cf9dfe5378b4be6ac807f8b00309befc3a4f63ec5632
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZB/N:A3k03kHRJ7
TLSH
T1D125AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 bd04686e5655f6fcc9f77fa0346741ab2b0655d574d8944c3edc27acec1af402
MD5 8ced40cd6bea8224109e40721013dd48
SHA1 b80cd46c3935bf401cbc4ae8ff882b5902915df7
SHA512 31520a8c695b19ccfbb9f7558aa1637910319eb18fd430eebdc010882a4336778b65ed2397683a308c5d8594514f4a398fdaef410f511f3893402d7427717a67
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZB9F:A3k03kHRJt
TLSH
T15725AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 5980b199a07c9b1c151b9924e538d5de94c7f2cd10cfe2e7a87a173bd845645d
MD5 c89aeb5b78008ec75a471ab09d149e63
SHA1 f0cd3debb0f5ee2ba1c2a3ee3e3358a6ecfc9273
SHA512 66c3349bda633c6482d2c96592da2766c86f38edc2312d264fdd0927ace42c0f1f95f6bd6486c90129eb88507335bc0d8ea196968a2d3c185f6691b6018b4b97
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBOC:A3k03kHRJR
TLSH
T17F25AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 31a41a83dc1e3fb16623e44435cd80c05b4fa7ae19415a92d03ce04036de7364
MD5 cc17bdd3a7ce17ed903d81ab42952760
SHA1 93597c2a53ba88515caec18b9271a306525cf1ab
SHA512 2cd0fbf9f7e41f561d6a48f5c5439d92766e1bc8f24776796c8fb8e04ef2dc84627d01b065e0915e840a8530655592da931d166e33b3c69059439b568d7aa7a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBRw:A3k03kHRJc
TLSH
T16425AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 7d74f98a353457afcb11f4865ab1ca28ed9aca3e3570c85f01b7a8b0a002f5d0
MD5 1333734e1724ba8c6069b97d4bd77794
SHA1 54b0b946a841982139ce0e95f46451f6a716522e
SHA512 51c6cdd57bba96cdc4ec55c43ca8131f1559655e3ea455d1b9ca1cd78e02fbffa6b5a2d07ccad70416257399fef20aad266576e6700d1a681e8795249d96a626
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZB4T:A3k03kHRJE
TLSH
T1EE25AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 6b902320f7b4f20063b7abfc5ce028bea31c011966b1283a2dc661ba223ae3c5
MD5 9c41c33c6acb8acfac8bd3d74e1008b1
SHA1 b04ace9ba634d73cee991eadf046a9d7a8dbf60b
SHA512 153173493cc20eddd3f3af900c3e7be8a176120f6651a8fe295e9bdf0860d4a38b213f4914e91f5c633f09d726858a7f4eb2f4b7d9a263a53a625f2abb0e590e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBUu:A3k03kHRJz
TLSH
T1B825AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 bd9c90bc01d19b35814172404ac2d500396b94b68193d84f1378adf004a6f556
MD5 17a764a96b5bf16fa4cf1f9d30c691ae
SHA1 a319584a1aa6ee944339b2c06031368f3943d470
SHA512 26445c5afb2d447e281e97b58039dc563c7b7390549cd4f41dec7c69cb36c0bc2aea6bf89680e2120216660edd99c30a6d4c628832af560c45b0907ccc61f47c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBCb:A3k03kHRJ6
TLSH
T14025AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 108d08c6ae9e2be6a742aaaf67f7260b48ccdf095315a84807351440f9f1c79d
MD5 f210006dacb0ce3614e7258acca30c16
SHA1 ffe5d435b3ff0381c41709d174cb55893bd0bdf7
SHA512 5bfa91882feb6b54c3697b658e8e03e5333ec172f0e995a78aca0f70cf04e5e4251361ea9c6057695f334cdf1f34ffa58631a1d4a51f24243e622f7005adac5b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBEf:A3k03kHRJK
TLSH
T1F425AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 3161023e23ab13417d634110487076f7536a982b0e337313b80bc42cd521578c
MD5 8b6bb1dc8634af331149301e841b08fd
SHA1 e610e145aae25aa344af58c12b809133ce48cb66
SHA512 ff6e2500a8c22ef5d16aeb99967b9ca3318afd59e6e87060ba1f8379b108659ef45be5125d4af5701fab49c1cd19129a402b7d1762167624601d5ee264a35ae6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBhK:A3k03kHRJK
TLSH
T1E525AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 05e183a8faa92104f11ac4716484dc91e6b6bb61dbc3c3a0a6716cb4b1f431e7
MD5 17c26462935a7c760a208b1ae526be4a
SHA1 49bc7f03364f97af4bc84572d897291c963e6edb
SHA512 04e83f916d3a12b91bb83ce1952640f98a4eb158adda78055a4e92cbc61a8b76dc8b2856bff11563fcdb3a2258921630bd04e6a3c7806913e1aa55906bb7d788
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBak:A3k03kHRJv
TLSH
T1FE25AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 f77cc302eafc9190e22fa5fc45628a80f412ef53b54eb4f77757e906c4709ce3
MD5 b34ff2f634fb7d608d1156ac9fa96d86
SHA1 3f5edfa3f2b822a96a2ed17e8e02fb2c642bccd5
SHA512 9bb4e00e93a4832be4b80e247e59addb7b40edb1d95d8edd946a5cc6a3f25f75792934a8f8e0caa17b69415d686c79d195bfcc7af5d6fd7560eceb077adb3905
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZB/0:A3k03kHRJe
TLSH
T11625AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 e5d8e2d83efa1bd99197359160967ce1d97afe7ebb7661ae558a3129be7e0b8c
MD5 004464e9f0e4eda04cbcfa7bdec8f96d
SHA1 9d866a158789d7182f66e91cf154eb2e694cabcc
SHA512 f9e2d970ffdf69da03f485e7084fc5ad2584be3f3c36fc743f89c547a96d05331f99c92763b223b8ef1dc95d02b5979f76e101670707d16fdc44ba90a4c72c87
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBOg:A3k03kHRJH
TLSH
T17125AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 374237b39a2482d0ff4526708cc76f42b2b941e001a008881db699731f5786e0
MD5 1915deb40679c97d5c8bf28e6b9f16bf
SHA1 f1d25292b116d1768caecb25d7f841f4c1ed5111
SHA512 40b0bf21b7492e76b759508ee0244f070fb492a1fdbd767e28e1599871a1ddc95e05bdc84c8914248cc8927cb9cd92eb3edbec944ab80d9bd500a2c72addb071
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBXr:A3k03kHRJh
TLSH
T1B225AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 aa0a8fecd22f59bb103777a1d89fe562c2f6dbef0de42b0681ebcf0e6d553b35
MD5 ba56a28f87c57532bdc0deaebbbf6c74
SHA1 db7498b744b5f8feee4fb93da602363edc1b241f
SHA512 504867a37788e66ab18d820de66064471f3aef9a89336b21163cb9d538fcff335fcc496fe724e8df3c152de38ac911b812591bac762c35c7daa17c8daeefeb4f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBhn:A3k03kHRJL
TLSH
T1E725AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 cb501805fb2bbb554bfd4fd7fe92769e54a3cac346bbf09f4f8a70f43f0301bb
MD5 3018f96cc9e98c70aa6fd6ae6a4bf0e6
SHA1 2d2c9f90a74834d64e71ebb5847ae4112e3ff84f
SHA512 477e31254f999f7acaec4638f6e9ed971c9ed0f76a7c995d53d911a7e43f6e20f0c36e00689352ddfa26b2a3dc3ac3cd737aae5896612e0828bbd99ca49d9473
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBNx:A3k03kHRJZ
TLSH
T19925AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 2fd5697ef6f7e6b0e2233f9b178d172052ad6164a44af18f805aaac6e067574b
MD5 c0728b15373333579fa4e00f19f5f6fc
SHA1 da921cc699218ce5dab0a7e174338e003c079b70
SHA512 30f745b4e2701dc8b9a8751551c3829f83a06608af5c27d61db71afeabf0ff5ba2000f410e70652612f3a67f2a10eb5cc267dd63c417abba4f5e33276034ab5c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBTA:A3k03kHRJm
TLSH
T1B925AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 8575b488e5f4eab13fda93e8b7c3df1ba17898a6f389a449d75b4f5a70daa931
MD5 c362e9acfbcd08884c20537a25303b53
SHA1 b5de2b9f89522323036c2d6029a9e7e5361448e3
SHA512 7f0872ebf1899934b120f2b83fdd6656e3443335be7dd21ceff79c3d6d285b128d42b97874ef2274cee7b8ddb2201530d20f1b3e9cfe91f4136f68d61922388a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBk9Q:A3k03kHRJ7
TLSH
T17225AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 e743d6a568dacb7149028694def1ec94b25d15b54bfa11ff631426c42875a897
MD5 0ff437f11ea73220c41a23a39da8226f
SHA1 8695c78f5ad3d205a552d17fad1af888f768366a
SHA512 32d14fbda1f0c91a152ea2ca30246a512f7d99e267b022315aaebacd13675c55c48c192ac2ee295909d56d7b61c3f8cfd54048d224e6d205cb5e7c06bc6f50de
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZB94:A3k03kHRJs
TLSH
T15825AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 8292440fa9082102bb2b9dad4869ff92e35e418692c070656afacb8aa6ee9284
MD5 300f4d1cffbfe495ff1289612c5ec09d
SHA1 c41200f088038c755d2a27fa6a046a707b9d4ab3
SHA512 c580a4deeb3b7026dd1e674f185d95f29b4b64ac4284dc07b4456130272ee8a72921eaffbbbec7829a5e46bdf1db50076b9b1bf2ccd24be72a521fb47447005b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBYu:A3k03kHRJt
TLSH
T1AA25AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 054e59ba9161d95c309f1f37c6d205fd7f79cbc6dc85983241f5e50dc4a600f7
MD5 84ad5aaad802dedef15f9dffd1184320
SHA1 e5f5dfbc88706e6b1d033c54c3e0cc0b355405ce
SHA512 31e9bdc449f71e18d6136c07e8ca8a11e00ecc23e194a1e2128e26c14b5b4077d6f37af1d0782e26021f74b29c53cea08ea1b1ffd0400660ccd9cb5154f814e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZB5j:A3k03kHRJP
TLSH
T15F25AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 f0aa6b322c04b9746c86c520faab252de2a68002dc24f7cf0702cc4c03083d0d
MD5 80be11c0ca995143911b8abdd4821c18
SHA1 6ae7c511863c9dd492b6286e7d131594bb3bef7f
SHA512 09d8ce96a1b2ef768803fd3f7447e99558cd823538ef1a9b7bb0678404d2d8583f73f0b9dacf43dcbb856c347d4af5694ce7cbc6c6728258fb7a2c6af0960e03
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBgg:A3k03kHRJH
TLSH
T11E25AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 61d52f14e1f94495e54306893e1f5877dbd93c7d781cd42ca055c8fd59ba64d5
MD5 370595fb8da3f676771f13e52839f5df
SHA1 fc821ce096fa2e3e0a24fd6d09638c296eb0a55a
SHA512 16273a3d9533392e8ae0141497b45e5c262f1192a09d082eb9ddb4ad04d523242194f84a6d3a9743669cb0295207d688164d32f6056fb28b5c8564bb009e45e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBPI:A3k03kHRJm
TLSH
T1BC25AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 ea61e0c6bb36454880e1a5ddc81704cc6fc72ba2d0b51eb2167df89ba484bb4c
MD5 794ad931a41db463c80ef0cb8b99edd6
SHA1 005d8ffef8ea90ef4ced99637bc8b3df79bf59e8
SHA512 c5bda482fc5d64f4d3b734ffe2d2dd30a8c246251660e9c12fbbb4b9a8751f8af52e09313d8aa1b7007f51d912fb5086b50a8c13036930b8ed41c9d0ec32dce9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZB1o:A3k03kHRJ0
TLSH
T1E125AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 c6937fb6e3eeea2da766e09eae783e8fdf730be344a8c53321a4d9dcd9a5aadb
MD5 c73a979fab0ccf25d369170af011d592
SHA1 72a8c8d3a57c0df0e91714fedca28bb445e85969
SHA512 cb26610922cdc7eec4dcd1aa1c57a9ece9ddc1833644cae7db844c5b4e47fd4f74ea28ea91dee7722b9ce1a0dba5bfa38bc6e34c6853beb9180b8fd178982f07
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBm+:A3k03kHRJp
TLSH
T1B125AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 ccd164bc91f7f10a71cf57e81599dd7eecf21395197b9a38ffe0140b565f6e03
MD5 f49b186275c4b66ccd78a1293026d9d8
SHA1 598590c13db1efdf5f998336256266e872b36ab3
SHA512 443629ccd9442a4c7b61f877c6d337a329bddc031b9c5ce8ea236ae6d40a57ed420be103703777275123184c5977f2995ebfcb927b096e6da8fdf44035a38f23
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBmQ:A3k03kHRJ5
TLSH
T19625AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 82976caef486d35ba260619623f22c70814d7167830a10d9edcda2097ced6927
MD5 6e1d18293217823a9cc1e2fd3f2c82c5
SHA1 506d92ca86df93022ca2349ca03ce66b9f64d13e
SHA512 1b3f8cc9028b346e435b898136ffdf7a79ef9ddb82afb5cc8cf2d6c1783ac925c286ce78ce4e5e6e98f1b6a578c598701b3def97dd163df06b448aef315918b3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZB3X:A3k03kHRJl
TLSH
T13625AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 3e459a430583ae769e31cb44385d7905e9a4cb402bf5f78d8536123f151721e2
MD5 b17580b840eaa17ac4b32b5fc9f4362a
SHA1 f2fda06dd24d9f85490be73d21811e47d21293ab
SHA512 a70a70af53d2e606aea80af2f10746b13657fc513ec6b182db978055385955b272fa19c2c740c736de7b007deae3645eb3080e340afdabea359d412b54967c7e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBtL:A3k03kHRJX
TLSH
T18825AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 2f9e9d399774d45ce37989beda3d5a0166dac5fdd196f694a9f274f4581e8b38
MD5 22e7bf360b472d017079cd9afa878319
SHA1 8cf0682faae11b4caf8ced6a478539fc2629298e
SHA512 616e8f194bb1d64c81661aab430e4ea3237de3978e66a0a50cdd729c6df7cd07cecbdc3353a20cfd4c2563fcd72c9b1ef38a8f53d12054414d96702a6fb9fff3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBrM:A3k03kHRJy
TLSH
T11E25AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 3ceb45908548afed720b2a8207f066ddf98cf4c38f0bb4be93e6cffe23e930ec
MD5 f0507a7b96533873135534c8bda1ae31
SHA1 7c9597304057d678f77ca20fc25e7a347734b408
SHA512 3dfef30999eacbfad1f6ad6927c023a0e383ad17e271f1211661e3297eff73493ad10254655d760fcb8eae6c2af92dfb8525482d40c42f7a804266b9c2867b00
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhZTZBsh:A3k03kHRJs
TLSH
T16225AE13EB9504E9D10AC174AAD68A23FB75BD56176193DF2318C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5240-258-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5484-202-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5484-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads