eda0679e4ed7eb167ed7f3207a6dd6ca9111b537f3dd45ae6f316863aca1992b

Analysis

max time kernel
87s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 14:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 853KB
Sample260826-r9fpsaysdy
SHA256 eda0679e4ed7eb167ed7f3207a6dd6ca9111b537f3dd45ae6f316863aca1992b
MD5 a391c5d0bac4bacfeaa840a6a8c51616
SHA1 cccfdf3d0ca1ff231021cf1085c3e26213bbcc89
SHA512 77818bac47f4dcdb49d7642dd42562671e77030151ea715f4545db1592e0980aad001faef2d03309c0853fd736ce234429fa6cf619f2041241c905b1e10ddcb6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDa:A3k03kHRJ
TLSH
T13C05AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1032-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c53a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1032-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/680-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-539.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-998.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1115.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1193.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1290.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1346.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c53a-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-489.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-539.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-605.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-911.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-998.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1041.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1060.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1115.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1167.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1193.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1290.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1327.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1346.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
680	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1032	2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
680	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_a391c5d0bac4bacfeaa840a6a8c51616_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1032

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 853KB
SHA256 eda0679e4ed7eb167ed7f3207a6dd6ca9111b537f3dd45ae6f316863aca1992b
MD5 a391c5d0bac4bacfeaa840a6a8c51616
SHA1 cccfdf3d0ca1ff231021cf1085c3e26213bbcc89
SHA512 77818bac47f4dcdb49d7642dd42562671e77030151ea715f4545db1592e0980aad001faef2d03309c0853fd736ce234429fa6cf619f2041241c905b1e10ddcb6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDa:A3k03kHRJ
TLSH
T13C05AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 c45886f6768a7a4c4becf14d3347566668f9e469143eac59204a04e5b5212fa2
MD5 9b674933b949a314320b32a032fa2158
SHA1 e377266f20220790110fcc358ce6cee7241ff30b
SHA512 762f23fba6492a358101054bd1f9daab7d706f61f2884602ca0a700ac3aa1dd29c8adbb6f535f484b0254eddb25d43a40140f2bc795c4b19c948b1e5ac0d70ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaP0Le5ji0hmxNrM:A3k03kHRJcPji0Aj
TLSH
T107658C17F6A402B5D027C0B9C6D6966AFA713882173086CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 868KB
SHA256 81787ca1c8513cf6a05e408d2016b38ca5e06e1de8b75460ebbbe02db35de6ab
MD5 fde8334dd34d5fb2a9d994e991f93092
SHA1 2cc43643d79e3eea2416c4a70bd2e9cc602c248e
SHA512 fe14b430082752a4b0e56dc3980d1a36c81e17e4a47fb7fb3811a6ab6cac3464300921abcef7fed58408e28f4f0fa332551e309597cdf2fcff877f9454930ae3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaRa:A3k03kHRJ
TLSH
T1F415AE13EB9500E8D10AC1749ADA9A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 877KB
SHA256 c6ca70db8262157e51f2bd31b54c560511238afe7ed4d5b45d75a1f049114747
MD5 ce069c32043fae6621141cb29336e6ab
SHA1 69d098d0cd9ec1f5ef7aa1513a67f201949bc1c3
SHA512 dc1edfb1c405df0ce11d1444d7ae0f0c84f188493134bd4d1038962c88c7baa749f733d78cd463a890322e31ead738bb4ecc0f9b02e0ac32e5acac63542cc124
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDao6:A3k03kHRJK
TLSH
T1DB15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 877KB
SHA256 2b62b4b9c9da0d53e48085f56975dcbc4c1fde962155626d6f069a9132127040
MD5 f73931554190f8ff4967006315a285b5
SHA1 f1303a885f64ccd00bfe1fe2cd0ce5254f11d5b4
SHA512 eeb76e6e19d3bbcfde1377679975866a32625355cfe564685e6f0c5b7a8f8bcb632b67570939b65f5d2035ddb88e07f9db10ac27351be6190013d8cbda1cce9a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDasN:A3k03kHRJD
TLSH
T16D15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 877KB
SHA256 134aa69ce4210f204dc39ccc19dc63fb338f245f69fc2f76e58ae771006698cf
MD5 8da2d2efae5e38ab820c6895a24f628e
SHA1 5370b633418d80e7237a65742b5650de95defcd0
SHA512 874bf1c9b835684c422fb45ba3c8af70ce5d33e407519f5382321394655c6056d667071445fae56a47ddd5b1d9b415d560884cfaeb93bfe55f70cfe3a241c4ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaif:A3k03kHRJH
TLSH
T16115AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 877KB
SHA256 c4539ed1299d2ed3e19ff4461a51c9b843fc677a0ab1ea92b4569da80d45f4fa
MD5 8108406c080b08a2396130f85690ea29
SHA1 e588ecc898c03b665fe6a5b11493d52fd3190eb8
SHA512 ac921e1cc2760a3755a5c75219883992d35e9c3ccdaeb09cccb72c0967e58cec448e5d9bd98237df047b18511027b01eb0be2c8f92787dafe891c292845163bc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDa8o:A3k03kHRJ+
TLSH
T1C615AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 877KB
SHA256 4b7d0550f0be7917d49409fbf3a16f4abae4147442daf4f235e10aa05c8491f8
MD5 b56a73d576fcc3eb0498296fc36ef3f2
SHA1 ae388dc1a2ecddbaf168ffc87a67e6aae1262b5e
SHA512 e63b069ec4d0dd080ad1f755c68ffb98e989406a92fbb80234e1938e6db4bde4a6605f6c4993c48cacdc1b7cccedb0feb6604d54ec5a3eb3264176b54d24a9dc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDacu:A3k03kHRJ4
TLSH
T1F015AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 877KB
SHA256 d6f2a282937c10c2c1fac9987d659095e09a4640b8263ac3c3178e55c6b41f80
MD5 3f0988596f6ca9d69ec8cc2c1e08d9ac
SHA1 6e576ff0b60a5a152df3fa1873b95d3707e05658
SHA512 56b8c7b53b1414b3608639fed750f085cf9742c4d5c94412d6e62af6df1e2b24f0ec4e57c7b9f0431ae8beb94ca437805290095f561ce70df93722e340970a45
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDag9:A3k03kHRJt
TLSH
T1BD15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 877KB
SHA256 963e7af357a8007e0849884e5c4e15ac243f2caafe9a45c921ef539e7eec0e1b
MD5 7fc18008bd26fc66da564c15b91c5c25
SHA1 cb1da2c3efdd8249a385c7372a2b606adf4b7ae7
SHA512 c5c2c8842812610790759270d8677468c0b0451e5bf432608f52a425c579da2274329ecfd514421e9aeefa027bd496b74f1c24a2dd3e0ff8df8c4e44322a206e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaoc:A3k03kHRJY
TLSH
T113159E13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 877KB
SHA256 ee439e3a0496ff5bcc66eab07d9044cbd8fec2f886add521b93b6e5ff0765be3
MD5 7f2489c862d84ad63669ac15a9a60a10
SHA1 81ec54492dc916c7d49326cdde2f66808837f0ff
SHA512 ac8f8568506879d020fa5be5f98a1b756f4a927809767decf4cdf32e3e18a9b344af332ecd907d9f6983acd7c13e6c154c7999fd78ea199977df34dfb5924102
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaBp:A3k03kHRJO
TLSH
T14415AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 877KB
SHA256 8f1f4dffee3a72e05614841ab8e18d8f9ee83b3bd14a3e6bf3cc683cb0de339f
MD5 ccc0fe095bd5e62f04ff50dfce0eabdf
SHA1 709ac76b9ed8551141002999b607e182977db215
SHA512 b4ea245a6813ac53183bb577ac50506ca0c325c85fae0a36d61ed49b7010da0158c7fcd5683831ff244c88574e00741ce4b1eb09a50131dc2251cff03275f749
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaWN:A3k03kHRJh
TLSH
T17C15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 877KB
SHA256 034dd17a25321a2758f30e93a02365827388039aa43fa966a0f782dd176deeee
MD5 5dc774353ef748c5828a721797b3a583
SHA1 7be0fbbbe2193a3b503774ec2decfd2c221762cc
SHA512 9b40dcd345250e833ce4a02f563209ee21be84c6ae591dc91e322d8a13cc0147767593131d6b3e1e7555b45d38b2e072c7f1377e8bb88118adfbfe6a2b01209a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaaF:A3k03kHRJz
TLSH
T10C15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 877KB
SHA256 0aaca81b308f97ca08707ced260844fbd22af71f6e835fe4565de7bf804c88a6
MD5 ea5e18da3c05ebf63cde169a6a5ff93f
SHA1 0aafb058036105bb72b43f3c1fe163433bebc470
SHA512 4c7a013f39769e076cf5b2156bf60f958ea35e8399219f4b693108dc59ec7bcd1cedbd6a042109da7346ee0372268580ff46cec5ead7eb2482394c9b8a76e4a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDavC:A3k03kHRJv
TLSH
T1FB15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 877KB
SHA256 19a3572954a9cabdacc3b2ff50adc0b9b6b08f6ab10e72c1f13290e619555019
MD5 f6c1cb7ede7d3a44e9f0bfe4bda3ceb2
SHA1 2b47ccc5a0092a13ac3de845df09774efe46b7a6
SHA512 b1608d873b08a874535493bafd257a4834249ab4e06ae898481ea0c16cc6362bf39aadd93eca8bb6207e2933bbb241c2bf17075e0b503036a98175e94ce9cc06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaQw:A3k03kHRJK
TLSH
T18315AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 877KB
SHA256 4d45b365cc9ed094ba8e8b3cfea0d86d42feb0954b46afa4f80464b7b9b1087c
MD5 214b56fd33c6899018c6dda5bf273e74
SHA1 29b8d6ae8af9489cb9f44ff318e134efc07a4f41
SHA512 2b52493012f38de5596eab67dec931c10af4a46acf83edd8a79aebdd4f62a30228f6545dbd698dab3cbba835f75ea3389bf68a1c3738a006bca6b97202b25c48
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDavT:A3k03kHRJ6
TLSH
T1C515AE13EB9500E9D10AC1749ADA8A33FB757C56176093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 877KB
SHA256 e3f4f20ce6630ce910ca61b3d8041b8e116ec2abe8ff2c3fc00107e7deeb9054
MD5 b5ba5eab82f1465394c521bc990dfc5f
SHA1 7d2a51e0b67dafbd34c9ac412d282b8f30f84170
SHA512 58d29be8e7f72841073e8c89b710e96c56ac8958a8fe2dcb672d5fe1f711d4b15fd408087136759f4b92225a352e053fb9ced129bdce7137b5dbcf3cdcda8f8d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDapu:A3k03kHRJ1
TLSH
T1CF15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 877KB
SHA256 a0bd6f67970dd1e9817f18a788b13b42a02f199679b469c1a2564cefe034d02e
MD5 9fcc983e7c195eee82d40303e296a0c4
SHA1 ad5b8126f3f38b9e553934c4c8cd0330833f5639
SHA512 46d31e28c69871049d1985de761661596c266b1435025057d86fded97ce55aa67fa3294cab774069adef293e8e432f9333d9061248cca022c8d2a411f9095c69
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDahb:A3k03kHRJU
TLSH
T10615AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 877KB
SHA256 7e694d47973096e2aa5ebbefe0d8f9b4db19f1df66688dd914c56680aae40ad4
MD5 903190e62f72dbcf1690ba3a4e814cdd
SHA1 50d45e63212c55851fce13ae237894ebe6324352
SHA512 90d031e2e29ce3220be10b6f5a5d27ef128122c093a88677c010fc4fd76d26e64dde8f4e013be8cd1e6d20e800b78fcc232b7b383e36b43f9c666089cfe7e738
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDapf:A3k03kHRJk
TLSH
T1AB15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 877KB
SHA256 7a703bfde0e933f5de3951445bab07957c0e631e9b51273d58e7c1b312d75d91
MD5 126fc99940dc21a013488ca40e585b8f
SHA1 c8499d2039273382cc79b894101514662dd08b9e
SHA512 a8e64e869fc69ede8be0d9048f830a0817b3fd3124b25abd538064b9b7a613fffda30ce9a353aef56d95d987b720e3e5fe9bb679a369b5b87fa087e5e1958573
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaSK:A3k03kHRJU
TLSH
T12215AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 877KB
SHA256 1dcca2ba3e39afb9b5c29000008d275e2851044837ddcd33571390900b6901b6
MD5 4b0535a3ecedcae2406ca088fb07e4b9
SHA1 baf4253d1ae253a0cb9487c2ae15a014d4b2d632
SHA512 b5f7178b899f520f20f47934691877b14045f21e18dd3a468bba3a5c6be7000f11a58594f222fb73df89cf9b94959c36c325c3c3d98f833c2efcecd7dcdf8105
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDa3k:A3k03kHRJt
TLSH
T16C15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 877KB
SHA256 734bbf1e0ee366df9a5f04d1c543f7581b2821261900a10b611258337f994a41
MD5 28e0fdb16cee6cfa650a45ab75a41565
SHA1 bf8d2e6c731cc98bb4ce38b66719776d78e7c42b
SHA512 439c340d3362c6dff0c0dd6f36c44b22df2cb841f9be28ccd5e96e82915ff38c4122108cc140b58a3d2bb7c069ed7446eebcd58dec5e9051694cc2dc93b2ce8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaA0:A3k03kHRJQ
TLSH
T1B315AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 877KB
SHA256 a41b4ef7e164a02c3dbcd439ce9c04acf2fb3646d0e7821dc5cc33496d094736
MD5 cc1d36b0297e85e3faeac24a5c7a1df2
SHA1 c25357786903950ed756d3d49c04037c8b6b502d
SHA512 83bf612b8a3e7641a4a6c7cd8ed6d799bbd05e7358dae609c1c3fde1d84dd229db4a1cd2e120dc216570d62840709ceef566eea311a96d0775e0cbd2635e0e51
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDabg:A3k03kHRJl
TLSH
T18E15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 877KB
SHA256 6f6d7d5d9da577234794f149219bc89c9a8e23374799622f1a5f4ac97de6c4c6
MD5 0ec5c8aebe78ec4a8734bda4c3a9cf93
SHA1 ed4d9bf446457cdd5ef76dc60dd6073713b022ca
SHA512 4ac4cef1446d34cc94e488e5613dc6687def9cea6f361bc0a307c690e78b69e1c4a19434df8e00528fc4d31e687f0a837821040e97026cea21d691fcd663a8d7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaWr:A3k03kHRJn
TLSH
T16C15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 877KB
SHA256 c95ba9da4833789c542d728929468d983f4831bc95423dac3f177a20389034b6
MD5 e6305a3ac3eff8291e8ae2c8aca1fbe9
SHA1 8830213b5ccc2edb3e5d1e986a94757e3c00aa6d
SHA512 ae2492ea6d25704651889f85f3fc6cc2b9465f38608d1cf1566bcf20fac40632c3a7a0544f2eb2e99af5be5eb1982f43302e1309f1074e757a3e3d019c5c16b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDa8n:A3k03kHRJR
TLSH
T1F515AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 877KB
SHA256 18d0a6906513dd93dba617e93fde3afd0c4e8cc706d3ee625fed39e84e64fb77
MD5 f293a219aa883eb495da364656288e63
SHA1 f6e1d52d738f14371746e2512ef0cff852f6ab75
SHA512 919cb4d59e4f3526fb152c386867e4351b22207b22c69cbee020c1ea97c87a389a6ab5ad500deca606b8002f79d0bb6cb85778b657dfbfa1ff0218ffe216728f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDa6x:A3k03kHRJf
TLSH
T1F815AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 877KB
SHA256 8ec657238e60a139686f9194d491c305160bc6806704aea97f4cbf3c1edd664d
MD5 123347fc92b5aeee072615c54841b518
SHA1 ae25cde12365d9cfc73d91b241013fc15b3c6453
SHA512 c2a8bcd9809f3e347a40bd0ff5d35cbe400578534b543a3646998caac33877a30a189d7c609a8ba18e808ebdb0c6cff97e6642bb96eb6e5972e5d90210ebf78c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDa8A:A3k03kHRJg
TLSH
T17015AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 877KB
SHA256 dbca0c2de1e9a9ff2a8bcdeff667e727902dcb5b5f310c8886ea7a8561349a9c
MD5 3349a671df99a5e3756451b580250123
SHA1 eb12f1f24708bbfb5d87cef1f2715dc8626c31f7
SHA512 c8ce71e60b6ac57a350d93af0244e4d712b7b6bbc5dd4f44df97694e57767a3c9e807d71cd961be9147bbc577539d183e4ce4b70ca612738bd4e62fdb9896e3e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDal9Q:A3k03kHRJZ
TLSH
T1F115AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 877KB
SHA256 0202f395d23be34ef1d7bcf303ada1e69cd25df6b093066061151cb02c747e8a
MD5 635429cbb6513c24776291caaacbc378
SHA1 b584a8fdaa67d9346bb124fa3e456469ccc7b880
SHA512 234bf67da7ad8eb7b437ff39fda594e6e471115eecbb2ce29f5dca68087b36806fa453cb3f1233f00df53e1be451662a1be4521ea0157556eb33420ba0fa028b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaQ4:A3k03kHRJO
TLSH
T1F915AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 877KB
SHA256 ca78718d44e077552f9dcfc8c1c17d9d18fc39f7625276393472bb06927d1a41
MD5 7947a9191fe71a750e523bfdaf6f1b6b
SHA1 b12d153cecc7d08dbeb84f455b3e7b335dd61e93
SHA512 edba0eaed56f45318b76e3ec5f045cba2bc927194bae0e809ccc4bacf122200fdbf13da581034d6d88a79fa90a9eb3ad7de0d9f4f96689ef622ac665cf2192a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaTu:A3k03kHRJv
TLSH
T17315AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 877KB
SHA256 72b8148ce4aadf0b755f4531460064b3bfca6a6cbc522fc729ba11393affd647
MD5 2577105caf6dd2a49e63d8f7af3f2b9c
SHA1 699dafc4cc57ec69e4222ba5667520e6df5a5905
SHA512 4ffb84c0c1f0082102178a20c1d01fd3b0116790951ae97ece4f59e89c9c9f0bcc7e18786f3336394dd7e3353c5995ed1310b62a12943bd6858ec29822ade779
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaOj:A3k03kHRJx
TLSH
T19F15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 877KB
SHA256 53a5c1680bdb545ae34044aa442484fcc84e71c043c5e4cf97752b8365368232
MD5 630e70046eb152fd64e858725093a79a
SHA1 49f732241dbc033b787226664a794c5574e2de03
SHA512 e2b0e8a48c2b25ac70e267f18ce4471aec439b167a1b793f7c970a2cb670aa26927022f1ad3276db8a374ded7e6d29d53125e0861e0c761815cb4fa1c95c3848
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDa7g:A3k03kHRJ1
TLSH
T1EE15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 877KB
SHA256 a85e413ea59fcbf25e063d6297e445233f3745691358d0f7530c254065a0110c
MD5 6a48d1bf42de34014f6b0d8bad5ccd90
SHA1 50843b0e494fe9c900d6c0c891e257ec704c661b
SHA512 25362755cf96ee59cd10b2071e06cf7519f6d11a4ff212e2199ec875dc90249d9c7a17ef542fbdaaa1b35e340d79de4390ff7b84c62aa7695701fa21cf543cc8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDamI:A3k03kHRJ8
TLSH
T15815AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 877KB
SHA256 74872ad55c74c6dc02dd823a7272abf23b881e95dc03cff88ed3553e509fe862
MD5 aa427105299fd2f78ab44aa7d0ae4038
SHA1 cfc37b59c78c3b4b02447e2911dd46a44dfb9d79
SHA512 cfe4f1d4b7ff218bcc1f612fd7d76776c8dd3402c54891c3dbb0e5da21bfce2e7572cf4f83589943c8bf401f0904a63b518b58d61b4165747df71a64a56c5b62
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaUo:A3k03kHRJ+
TLSH
T11015AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 877KB
SHA256 172d63899f32aa91e8ada46bbfc760ebf68530c30eafe71b308c6ff1c47329cc
MD5 24e136430018f26669e34e45dcb17fe0
SHA1 a9e0f55c64c792ae5c26ff76eec38c5371a025a9
SHA512 36dee182c3ae739d6ad77e09c43b6cda396f112c736f53ac5786015fc855187b85e88375afc09aa85707cbe39dd3bc00d5d1124024d421bfc14f87fe2086ecad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDa3+:A3k03kHRJr
TLSH
T17715AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 877KB
SHA256 b28187ad1f2c49ceaafb3d896d47f8023e53a893770f280e90042e69672f838d
MD5 a0561f62a896ddf3b4d57aee97a43666
SHA1 5d95dfab1ce3dab011878e49ae5cda9fd63f7995
SHA512 57e861fa49c72105e0809eb8eae5439c7ce71d7b904dafb3184c35c03b3266675c918eabd666e85b7c8c391acdec3d26b0e91936da5c7300aa5239b854e9c0a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaNQ:A3k03kHRJv
TLSH
T1DB15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 877KB
SHA256 072ec04cd002ad7e8b167532e11d4f8bee8748207300be7efc799ae40eba4927
MD5 744f2917798acf066bf42e177a5a168f
SHA1 9b15741620a82d416c86d7b729cb662221b4c046
SHA512 fe23261e4843dc93c7a8c623e34133da39288a1c104f89db595f2f8c541860f213a7495c3ff3ce9109803285d0db54da2d2c0915f2c5cf89ea65e490b911cd11
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaCX:A3k03kHRJj
TLSH
T1C915AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 877KB
SHA256 151f3c5d0d18b164517830118268564bb5d7967849deba662a723db0f582309c
MD5 5f46a6af918694a4f4d14216046955f7
SHA1 de524fa31c30a1601417d53957807f7c6c83527e
SHA512 1e121349199c2f8182c472d79021b7c4cce44583b6a012c910e84beca2eb9936c9cf18e6b6e0fb99824210b927f603f0b90ca3e6d10b8f7d00785068f15157ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDakL:A3k03kHRJt
TLSH
T11D15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 877KB
SHA256 14b51820e1dca8be59e3a7bfef3871c8157a74247f55d59cafafac0be1ad54ef
MD5 1403011d49b912ac88b019e85266d253
SHA1 8cf38919dee5ea915ba3393acb02956bb85f29a2
SHA512 d4f6209859fd48869c7563e628a4e579f0a15b1e9ef757f7798a0ce3a81d92e4f2fdcfe4fc62d8dec570c4e97ae0a58d60f22750ebb822bd1ccedfc2597f3f44
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDaAM:A3k03kHRJU
TLSH
T1FD15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 877KB
SHA256 6dcd854ae1518d22b9d953019d49c2776216429514249ffc7c3846f651c85bec
MD5 11468d1bd0c4d3a3a504ef6143aedb6c
SHA1 ba3823b18bd7f1faf9794138625be38ee6fcd8b9
SHA512 ab84775cc29c22cc3f426e0b7f6677732238313187732f713c767071362a8e1729017c43c6d79c757ae46bff65824d237ac07f2109df4c1465feaf3da5378c44
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCZDahh:A3k03kHRJO
TLSH
T1EB15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/680-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1032-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1032-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads