5b6d947fbc866171cd147ef6e9ddef42007622a73ed6cdcc61fac21c5c45a7bb

Analysis

max time kernel
103s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 08:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260824-kbw6jsdr2x
SHA256 5b6d947fbc866171cd147ef6e9ddef42007622a73ed6cdcc61fac21c5c45a7bb
MD5 781b1835e717807a8476ea74d2d56bad
SHA1 2adde3be685d8669d7af8dd9154ee9aee52f3d6c
SHA512 918ca174159144cfbc6638ed46371d3c213c79eec4cbbc0ac5e622f8ae355311b2f393230446f78e1e1fc135d0099012145b16ff02bbe8d2f4e632af692391f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sa9:A3k03kHRJs
TLSH
T1D225AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4100-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c568-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2cc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4100-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2752-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019844-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a54-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-650.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-841.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-867.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-912.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1079.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1290.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c568-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2cc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f6-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019844-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a54-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-650.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-841.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-867.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-912.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1079.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1129.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1290.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1346.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2752	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4100	2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2752	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_781b1835e717807a8476ea74d2d56bad_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4100

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 5b6d947fbc866171cd147ef6e9ddef42007622a73ed6cdcc61fac21c5c45a7bb
MD5 781b1835e717807a8476ea74d2d56bad
SHA1 2adde3be685d8669d7af8dd9154ee9aee52f3d6c
SHA512 918ca174159144cfbc6638ed46371d3c213c79eec4cbbc0ac5e622f8ae355311b2f393230446f78e1e1fc135d0099012145b16ff02bbe8d2f4e632af692391f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sa9:A3k03kHRJs
TLSH
T1D225AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 e1510336f9fdb91ff424020d5089f7cf1e6d81703612dd4cb9efaae047273592
MD5 fcbf646b66fa4964c623ced15bf510bc
SHA1 3ea1e0ab380941990279315345bee59676d816fd
SHA512 8163c35ff25f19824a7a7c4a2e4342110aef3cf9fcb93ddfdea52427bee0d3d9568411d7c89856338ee74653231e1fcd12dd6e6a267a2d7e27fe1ce429883a9d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saJ0Le5ji0hmxNrM:A3k03kHRJ0Pji0Aj
TLSH
T11A658C17F6A402B5D027C1B9C5D69A6AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 fbd071de098922b4af72ce847cde8b6fb89f94e7cab57de96a6783ec6dc86154
MD5 f0a281d4dead0851887f84d6a6d2ff56
SHA1 32e332e81d5e0274a99acc6bfd6d29c1274ff276
SHA512 772d6e4222575562e850ec07e6c5750e7ac37d4f2fe17a16467f0ec97cf9582ef5ddb3c92ec0236ae8e3f6ef08634b8addaaba33f7079e3e27975e708a5c6045
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saba:A3k03kHRJ
TLSH
T14325AF13EB9500E9E10AC1749AE65A23EB757C56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 138c46b354b18cfcae8a1845d3ed6525a50dc977127bdd1406ed05f728fa0c05
MD5 943121b424b30b831d3d84399b2a82ab
SHA1 c67be33b5c37267cfceed805855785183334a401
SHA512 ee278dc401ed3069ff2b30fd146e1f4bbfd9a4ab3d64bedfc19565f29336ca421441865d292c9a6a473869d1370cef5a1554cabe3e7cd622290b8a3af92bbc89
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sa66:A3k03kHRJi
TLSH
T1CC25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 dd85428f1904781d58a7afe0f36d91a96b54420d390a00cd633e59a889e503a0
MD5 560ca26307ecbd308a202a4f18c6c2ca
SHA1 f9d936ed9d81d21576479899a9d409e01a5f3eba
SHA512 1e6fd4c2ee431bd47f66a9777e7238c445c0ad48d47d83daafa834c9309e189f412e511a6be67c4b00e821f528a9472f004aedc869ad33cbc0262c1817ac2072
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sayN:A3k03kHRJL
TLSH
T1D125AF13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 20cd893219bf8957d3d65f591f1f00022e02c6a0857dfacdfd1dd71823ecfcbd
MD5 89e0be0969e3e528a0a21aef3cbf0a6e
SHA1 9a4a7590f7c6e48ebc592103b021ac568a7bf09d
SHA512 059afa8e5d33c5aabb34c0d0359f08c59401abc4261c38ca5d6ed85adffb40b84a20080b7bd447e45709fcf59cb01b689dd1b29eefef413f6c58b3678d02468f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saof:A3k03kHRJP
TLSH
T14F25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 c63c045a0832367e9b176263246ba6b28c428e0827ad1ab9856f19bf44272506
MD5 ac8c16a4d05517a64447d7a898e2e025
SHA1 4cb7da7a1f0953c8ac6e5ea41480785437497a15
SHA512 7aa2b638e003362274454969017570af5b34e7bec575f9787cc73b60c98aedf66e535282b9519f7fd8a16412769b47ded7742b1fe24b92f121dd70597f559891
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saCo:A3k03kHRJG
TLSH
T19B25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 1f1984890a6a33decb4dc948c0d87be1bb126e6df4957b52c5ccf449f8206e97
MD5 3d54192fa7afa62357281c7093143ee3
SHA1 997c441802f5f41228bb125cac97b67c6465b1e3
SHA512 9982b1f02488468f80f016f18df45e2a697f5a7c6d9e180192f1d5efd5f4f5c97a17559e7d1d38108955a61c7b953ef9256edaffb3b8ae4300ecffc325cffb62
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sa2u:A3k03kHRJQ
TLSH
T19925AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 4c8251cc2eb95eb2e307e75ed5008398023d347e46bb78099dd4f4b835b2e8c4
MD5 2cd6a86f6961a10278451ce2e9a717e2
SHA1 804d6dcbb368ee6450cb9f60fc575d3be06a48d7
SHA512 6b90e9705d68a2cd252fc4a4c435ab4a99a18adb3eb119b146ca601a2d2448d20405d1f81b344343b8da3d8b96afea8581dc99defeef5cc1195ac62da93633d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saq9:A3k03kHRJl
TLSH
T19A25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 d531003e94eb343910a92efaa1521ae7ea82e54173195d73d469298f5607a695
MD5 cf81e8d2280ed9b075a7f41a2cf3504c
SHA1 e8f5c5cb7a53da168c69eed3d2471bd0edd026d6
SHA512 c3e36b693238fa288880399038fe2d62e0ff943ab7bf6f40b0883570cb5c12b26d1007898762f44c81b042af55fa2de60ffcd25b5a2c5d75dc8017c1ce2c4fa3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saqc:A3k03kHRJg
TLSH
T15625AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 a3ddc549f231c20d5bfa7e4b6c4fba7685c6fe2699305f9ae41fb1a268c877ad
MD5 e6d2b8e74a1ebd9238e62f7a57187747
SHA1 fa1e6a56ceecde74f7a3ec5ef48ab95f94ef241a
SHA512 a57277030e6c4c9230482d816e0074162ea21fe381fdcab9038b700b2a567306c714a5c180337d805f0b6998790ec3273ba53b1a12ea55a4ebce92f23541735c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sajp:A3k03kHRJ2
TLSH
T14025AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 f76069ea4c8dbc68821955d46a45c418e43aef0079ba3d7c89240c03bc30231c
MD5 4f5bc82b3cf9c50cdd84e87c41704450
SHA1 b6e7416f1741bc16724cba99e3191d21beecb73f
SHA512 7c06f5db2c1ddc089a101892f74be12bea6080beb9577e7befa6790d3b9a1bb53e88bbaa6842be9317030b70bc3a07e1d659d5a76e64e8ba86c73f5d17cab262
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saEN:A3k03kHRJ5
TLSH
T18C25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 9aae13d62a407c47e4ab48dbb686cc72bd1a6a35bf2d3b28bd10663075e2b88c
MD5 0cea518a76e8690c44d60792bfb73dc4
SHA1 5a441a8eea596a524bea19640886a8eb56f26a76
SHA512 a5b56cb1d068a6a99cda54bc3345ec18e5fbe26f630e4c73aefd279fac3a15996fdc47d9d8deeb233cb097adc077239e85fe69c6b83763b1bed81e329edbd67a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sasF:A3k03kHRJr
TLSH
T1AA25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 f91726bb45aa165d8cecea8a8cf71676da6738c697bdf3ac63a034e217b63cc6
MD5 59f30bfcd2dcbbcf1a94f45bcf19b811
SHA1 ead734b9f946ea4ab7f4c5ad1e75d395433ee23c
SHA512 ef519b39050f8f5573f5d4f6e495636b632fc9f6410f9d5a2056c2f7e17153618578a076a50456fadd2dd18f72df6a5b528244bfc0ea267c964d3ec921e13aef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saZC:A3k03kHRJH
TLSH
T13825AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 af562cc92d9b98dd7d9880440c254168610feed6801f8d61abbce09d3485d894
MD5 e4a5d9ccbbb81e3a2351c20e982d5fbb
SHA1 a87e18f50294e7b6b362e7e626acc7a6f2a5b714
SHA512 4abc04a4ba118aed3c9c699b10efbb31c74c9eba5c2b98158e06bcfec8503107c9473f33e58199b4d24eb1b65c413bc6076645c2c2b124b6df9c2650e103165c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saaw:A3k03kHRJi
TLSH
T1C325AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 b6d0f3215300f60d71f63710cbaab00673ea214d3568012c641c0ea1b3cc0893
MD5 20753ddbb5dc4449bfc1179dec2b7185
SHA1 d2a46b69d46051374646316490668bba1a00c4d0
SHA512 3646f857b7df6f8ef2b8c4868cf40ebdfa349b91fcb8b3af050939bbf6f255dc61d6409ef8255fa91c6bf207ec627fad9a1cef8a1ebb711e9d098544da619051
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sahT:A3k03kHRJS
TLSH
T12E25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 7c754f8acc372dec207b4d7685101aed0785824e9e2acdcb40eb686696b9f430
MD5 04cb7dbcf37c72ea3069978cc07a3fba
SHA1 60a82583757d99b1dbed857b329af4459cfb9337
SHA512 a12c3938ffb57098497f8f19d23f59811d20c1557451f3e9dfcda91baaf850af98b1f80d7b7e2e9e66685d4610e1b30aff764d6f48cea7a2f51002a90e236e35
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saPu:A3k03kHRJd
TLSH
T1F025AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 7ff6019ba8e194d2fb6d705ad22ad9754ef6d3c82ce71d4c488ae598cfbab889
MD5 e5dd4bb0ba4a069ba8131571a346a751
SHA1 854f90bb61e77e9a18080bfce579228b1017b4b2
SHA512 97be02ab6af5427bb3c7fdc50cb1f8be41fc93ef29c47e27d6e6213a266f918ecd162225601275b504f8547af7fc8ae7dc84e36bd90ac1611777c7e1e562b87e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sazb:A3k03kHRJs
TLSH
T19925AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 b36f9b2c8037988905b0966d1267e52aa2322d29aa9e1de1b34e9c475bf49ebb
MD5 6aaf993e85cb81ebfab28750426837b6
SHA1 a13de8df908d16f29d537eb0ee6c327e2d072d1c
SHA512 3c1424af6dd441c44e228ebee7bba84a8e06f66436ac6687ba405e59b9910e653f1ee5fd20c5db59babeb3b933124662020a3fcc05ae71bb09806d44d159b426
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saHf:A3k03kHRJs
TLSH
T19925AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 e75982ef43f8d4ff9752ad535ac426f8473b002daec12acac384f2050912c841
MD5 58e7d0e383352f3d19f47811e913b54d
SHA1 f4df9b6d3bbf9b9842f61379829f0bf0ab68071c
SHA512 2149490d76d18f7f16deeef9ad811c26bd00938b3dcd8a536d7b25e1d343dbdb7594a61f776d73840a09029471eeb1012784e37b19997d05086b36e73e7f612a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sawK:A3k03kHRJc
TLSH
T19B25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 e886d98f871a423566aab6f9f919858ffa8101196541d515de51ebd428288450
MD5 f0166eb4f50890afaa6ece298ea140ac
SHA1 8edd5af2dbe3a2c5fcf699d7f94ba5abad12312c
SHA512 6f6bd3bf033a32c1b65fbfc8ea0a54f770e15ef732ad8e462fb0286707cfd009a8ed646eacfb81c9dbc27b8938602f9e0a94e0095d150823c0065f9323ffa5fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85satk:A3k03kHRJl
TLSH
T12225AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 b836a048ea7e1bf3cd6d60b9298ae87aa13f5c42371f074fd985b7dc0f667267
MD5 dbef63301acf8ec2bc3f30ff4709fa05
SHA1 5d81a7a22d8bea77590c916e8da171ce59bc969b
SHA512 55f54c0dda8beb3b0276da1a8238300e5866514982879dda49dc209f438608c8b23ab9793f5013f4b3b31294926ebdb85648a9ced0d2189ce9345d905c3070f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85say0:A3k03kHRJY
TLSH
T19E25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 982e3cb05a7a709480f3e9e2bf4c4ac2eecfa7da0dfec1bc28b40894a3d1f044
MD5 2912717dd99c538a7b4b2edcc8686640
SHA1 d32ddaeb5a1f9c810234d9d61b36269fa8eb1357
SHA512 eafa1ccf4dcd1b798ed491078af51f7e8a77a04df1599429d70209896abdc930bf5965de26668a6376285480c48ecbcad099f7f8e796e2a7cf5d1062f968ac22
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saBg:A3k03kHRJ9
TLSH
T10825AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 a75518ba15c6da7ed5e6d7a47017157894ced28509224805c00e7517b93beff7
MD5 c0f3ad40e44a26bd8f4dfa8dda0d2e9e
SHA1 4c348de784552d66e5d0118838c5f9e9f951cb57
SHA512 40d11bd4d76f8fb44017bb8506fb7092c5eb94be68be3a1b69661bc2e4f84d24a6d0f5fc1f2b50a288de26e22e6e1f10b59d25f8f980aced73a28052ee94c03f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saor:A3k03kHRJ/
TLSH
T1CB25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 fe5cbef72a5733d6e574f7377a38ede8cc45dfd1f7f1c54cf027e47901eaab6b
MD5 3f279e112f60e57430302a1ec92a6af9
SHA1 faeaf5e9b74857f83b05dcd09a79438f2008805a
SHA512 71ba71805c54aa8fb223bfd41f5cde387c89c00c79cf378ce7e9e496f1ed117a7f2f06006d5ca014dffc44701a0dc89e17a6cf88b00c1ccefd511c4d5fd980bb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saGn:A3k03kHRJ5
TLSH
T16E25AF13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 71113177ceb087230e2b2af138782ce978c7f9feb4fd8ee688e12f5f5dce3cb4
MD5 af6ac3ffe9ad4ea930ebc7b2faf8926a
SHA1 2ce0f77999b7638e225053dd8e01e9b55a35ebf0
SHA512 a0483141b9f85efce86263bb2a9d14e72fdd7f386c6467df987b95a62dbe973bfeb70e0a38a9a46b36edde2392a3a6ce681eb858638e2dafd88dba9c83634210
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saMx:A3k03kHRJX
TLSH
T19125AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 a70702009e43eb5a2aec619cc7062555eae6cf9a521fae357be92e93fcf54edc
MD5 df6b468e21f8721a05ea383473a72991
SHA1 e5334dd4200a7cff692da5b618248eb49ead5bcf
SHA512 e2fa9573bd5ae41e08b29ec08d21548e8465d731fdbfabde2d4b722088929ec5f647c5a8b8ba161e75b336a2fa8a8c0a27c1bd2a680ad9b4ce9c48fea242603a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saGA:A3k03kHRJY
TLSH
T1B225AE13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 00f111bfd75d90be83dbe027266c72caab32497dfee0ce9c847c5e533aa18bde
MD5 dd41b941c1d402250bd6ceb5007c4b64
SHA1 5f877ea6cd7685372fedbd47f0518db42e0fe1f9
SHA512 2dfd41e3565da579788406995942f1bab5904066b8f71cec0f5f66044fc019566af41bf039041ab5cc056d7fb8e132e169e4b67bd9712009c6d4a4ed94d25af5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saf9Q:A3k03kHRJB
TLSH
T1FE25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 6b23e869ecd783c10695cc9b97273dc9884f3fd25844ed09a030928929427e52
MD5 0c99701e0c2f3cf0631b5ad123cc0bd6
SHA1 f689b369655e7f25faa4f309721f8ee461caa593
SHA512 f8a75f29ba7de17419fef3ab1fba1e1002fcd731243e18d0cc1063bb44edcb193ba2fbc02a66b0a0f02fe7d724f9697a2ff1b0db469114c89b804d951e8689aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saW4:A3k03kHRJm
TLSH
T17E25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 ec4afc0d40445e12bb94da3c164ce356ebb9f3663df15c502ff6327ce4ee8f91
MD5 8a475a7542171435caca1363f8e1737c
SHA1 432a346f1b9972710b90c0ebc4d8cbf4df064a57
SHA512 8676f907947b644d00e2ac158b40337376c8e3f7694b3a2135f554ac95e718197dc93211c3006397148e10e15b7236dce18abfbc701f1ea3f322648dee94a889
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saFu:A3k03kHRJ3
TLSH
T1BC25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 8b0df6030b5260ae260d669e802cce1777ff5a581da2a886131f7c7f04fca41b
MD5 39d9b108d898e28bebf92b85dc8e9772
SHA1 8de7e2b99d5ca45382a6743c95cdd7c73e8d598a
SHA512 95f08527df8d92a03e12b2aa63d3ef09a6e7597362600fbecc75a37fb32b1ea0fcd015650df9404334ce8fb56f731d0820f14fdd8e6ff81459f15546db624ed5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saYj:A3k03kHRJ5
TLSH
T19325AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 0ca77d7a6ea60acf5b2d0ef95f241d8695777b261996764b0b2f61a8d927cb59
MD5 18abfd5760eac0f46f64557c9349a3d2
SHA1 7841b0be7e708b4636bce9b08d9face0c42f495a
SHA512 8d6b2ed92aa5d9b6808e6af7f52cebc7f46115fcdca8359252e5784e95d8d76c51cdd7b5df816cb5bc45520a6e2f6e8dd77dfc031b17cd38e103f8d4b2b6735e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sapg:A3k03kHRJN
TLSH
T16525AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 46375fa7e158dd23b7838689a369b7875f29d47911928fbf72ce5694fdd4bbca
MD5 34ad41d07ddcaf7a23da6b3bce39dcd7
SHA1 e3c134155b4f4517108f001df18bc2554982125a
SHA512 cc10fb200abc95f7153c6a20bc6b5bd0ffc10edce021b2de4b6e5fc532a683927a4ed30ed4e8508102c9ba56da60c84672c236976f372766b94d35837db7e656
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sawI:A3k03kHRJE
TLSH
T17325AE13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 f5aba2c8c96d28c4ed7d3a851563ae476fcdee4b1400e4f63ad68326239b87d5
MD5 1ac90e2756ecf0a39cb6ef94836092e7
SHA1 0c85329e541a440d9c67b0dca008e0640f71d389
SHA512 fc79f3b3504406ba1ba7e487dca5e564b19d5302f232336caf000c92450e5f52f1395e32daa9d9b485fe8b0ac2d51747baa914a81085d3681ef11666f563b1af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sayo:A3k03kHRJ2
TLSH
T18B25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 64f92f2e67a7207fe214c1658de818422e79ece582b5adea091479ae33e32768
MD5 cc7a6d73e9bfcf9874dda2f33408fba3
SHA1 1aa4edf71a35e76a69b47c6489dc3fe649c65170
SHA512 3f2e4033bf428fb388f91975b04e124983601f31d60bdc20cf063a0df3329b20b962ff1ccdf9528172b57c9485e95ac52f8ce68818f796c15857f6513adab743
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sap+:A3k03kHRJj
TLSH
T19D25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 9bff0110850ba073fc196e9d42f8a890d4ec0034f80254f099ef93f0fba4c727
MD5 254203c6581a447382997ed27cf33cc9
SHA1 2181ff3a2d8e28a1559457bc69694db83db35e13
SHA512 993b451a95db717ae12920169178cd1e520f525f081be7f0b113b09115ac57fd2140018eeca0d0fea9dd06da9aa65e3dd07abb82fc35166fb7d70d414860e2bd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saXQ:A3k03kHRJ3
TLSH
T19B25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 553a7db3590fb50e038a4bd840cea29603ed7931e840a0fbf9e61271743fc14e
MD5 bd76df488b3e50e098715fc598a63d3d
SHA1 9236c21d64973a43d88fba8355f6cb30b1516426
SHA512 bd47c87e6c5a5760b290ea0c585e9d301bafd2f8c8f7c6e5e38b886a6bde8c630ed8176ad0fb16122b4f7a32cc6058ad58d1c945a26e247c336239cef7573a74
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sasX:A3k03kHRJr
TLSH
T17B25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 018065fb30df1462f13771d56f42928a940bd1139adf87cbc97563a5f49354cf
MD5 c21c743ada352b0bd5ab7d8f447df945
SHA1 3e224fb5e04ef96c50545f45c878b4a8757af131
SHA512 7853017e21cd42ba5f0dbb72de423092e79d88ea3b83e2afba2c145a24e77f159c26c50547a8bcb480ff3f23dc05a393863f62da96123460ec44d6d8b6e553d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85saKL:A3k03kHRJl
TLSH
T18525AF13EB9504E9E10AC174AAD65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 45eb15135b7b1f98cb74357c1404add6d0f141d1bcf63340d0c91a764af7b477
MD5 4cb49e5a84c07d4aa95bb76c24b4e454
SHA1 1e1e02a6f8c1cb17879c14ce874cd52ccbbf2fb7
SHA512 a33162839aa1670077007e499ed797f21504cf90ad2935be8248a3a3cf37caed3932ad10c4a66e4f67a5181669222a6c5db70299b8927e230a92e38ac0c1c568
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sauM:A3k03kHRJc
TLSH
T19425AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 38d4993e8b3d828fa484e1b030868dd235008e137c0d90dd335e5bd135e7065b
MD5 53b438559d3b1547749d1ac28a9dbafc
SHA1 9de665a3218aaf08c84510972ed92960db56c54d
SHA512 1bab5506baf46897ae197e3ee19e0f8c6d4f3b084514db367c64f6f12560fb4bd4142eaae3b77b9d21cfe463ae411c0d11f541b2ee279d69cf70fea1d33a5f05
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWBa85sa3h:A3k03kHRJW
TLSH
T1DC25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2752-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4100-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4100-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads