99236b2de51b2e223bdd146c1ff1e95c87881aa805a63520530567f1b8e2851d

Analysis

max time kernel
85s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 870KB
Sample261024-pdasjsbw8r
SHA256 99236b2de51b2e223bdd146c1ff1e95c87881aa805a63520530567f1b8e2851d
MD5 5aa9ebba38bb239b95e0d9834326a70e
SHA1 c5d785e206e4a933912b7736b362ae8a41f9f686
SHA512 91b4c7876de91a9b990680f492e06b46e47db9f11df3edc9adbc2d0142d7d080a70296ec5ea461cb90d8a6c976f4f9fb772a460d5925de0d8514ec854cf95a95
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpc9:A3k03kHRJARJC
TLSH
T1BB158C03F79900E8D15AC2789AA69A22FB757C560730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4484-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c50b-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c50c-10.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f8-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4484-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a64-239.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1748-252-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019853-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb31-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a61-556.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-820.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1084.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1152.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c50b-5.dat	aspack_v212_v242
behavioral2/files/0x000e00000001c50c-10.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f8-57.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a64-239.dat	aspack_v212_v242
behavioral2/files/0x0004000000019853-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-440.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb31-495.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a61-556.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-605.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-820.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1047.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1084.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1152.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1748	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{1ED00C52-7A3B-42BF-9CC6-6D903EE65B4F}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4484	2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1748	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_5aa9ebba38bb239b95e0d9834326a70e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4484

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 870KB
SHA256 99236b2de51b2e223bdd146c1ff1e95c87881aa805a63520530567f1b8e2851d
MD5 5aa9ebba38bb239b95e0d9834326a70e
SHA1 c5d785e206e4a933912b7736b362ae8a41f9f686
SHA512 91b4c7876de91a9b990680f492e06b46e47db9f11df3edc9adbc2d0142d7d080a70296ec5ea461cb90d8a6c976f4f9fb772a460d5925de0d8514ec854cf95a95
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpc9:A3k03kHRJARJC
TLSH
T1BB158C03F79900E8D15AC2789AA69A22FB757C560730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.4MB
SHA256 ba5bd62819e3000fca3395b9814570b63582ed5d71c7a66c4f2892750cf5a87f
MD5 23d22194d7a1941476ffa8071c721233
SHA1 fa3705a90d2e65d518fc336f45f97870c1af7a57
SHA512 84374c156e8438e5d119315fb19902c52f55d72ea862eb108f2ac99eb17c74d8244632776da58dc14f1c2d5ff0c141cee7cc19b6529276105ad28ba11f4c3857
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcJ0Le5ji0hmxNrM:A3k03kHRJARJCPji0Aj
TLSH
T131657C17F6A802B5D067C1B9C5D29A5AFA71384207309BCF1394C7292F67BE19F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 884KB
SHA256 1d614e5edab20fc278a0e52efd7f0e2232e6ba5da19082b59992844bff08d315
MD5 95844b01f48edc0a5281295f331f2b5b
SHA1 d1e05d3db39bec85406a4c370633a45a76984e34
SHA512 7c7505f3e6fe1e3f0d7f420142084652ae8f3c4503245a8e0943a21ab2810ccee7e2af2b83329b9e692bc2095cd87a081e4579068864f96c12b1dacd301407e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcba:A3k03kHRJARJ
TLSH
T1B0159C03F79900E8D15AC1789AA69A22FB757C560730A7DF136486162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 893KB
SHA256 786c943da869a5945e221147a3ec0803eae3ccf39f6ab8995862672a0103adc6
MD5 35f74fbe15df958842a9bbea471de218
SHA1 32ce0b5942d495689ddc6ee78d57b05750ea1110
SHA512 662227fac987908b28fef1728e77ca676933a0726118fdbe45afe82244f04681a04c51e4baab4d92c2fef160d69d8a84747c87977fd542e4d63d0baa1a25149d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpc66:A3k03kHRJARJs
TLSH
T1EE159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1364C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 893KB
SHA256 82e6b58509cf5e76b7cbf345f894e9d2f88b7e494f0e7f8a66206a4c7cc50a7a
MD5 52bffdd3cd14443e5a917e03483616cc
SHA1 5604350d6a33cb841e6f3020f804fd5bd475f822
SHA512 6fc61c3e2455ac509969e7edf236c9fc87b23f1deb9f002df2466ba67c1bf9f5fa2f4480fa3c076c1cd4425352efcd0a5da36cd1097e81c04dac3ab8ae33a8fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcyN:A3k03kHRJARJR
TLSH
T1ED159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 893KB
SHA256 b0e54d742fb358fc22f9ca6ef437172ad2637bc1032781a3e99d70840bfc66b7
MD5 46c2def569fdb8ea7366263f3f8b174f
SHA1 f6fb0748c982074a3454945cf2c3392d2af31916
SHA512 896a1b106fbe078d39ee80fa88829baf1046e02eb0b167c432b8b20342fab61f2a5798d538ba901740e4e3b651b3dcdf7272b0d9f6b39fc4ca99d1b7c94da4fc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcof:A3k03kHRJARJR
TLSH
T16A159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1364C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 893KB
SHA256 9c2f17b690fd6999b12ff9e950fad44f880d4d295b73284d5c319686b0060c3a
MD5 748a89ee339ee1e6a0ae3500bee7c6eb
SHA1 63f620b4a5c4d000c80874d48f149691ce7fbb81
SHA512 d95cd53897702328de8dc5da953b0ee43b08cfedd09e519a263c170f55b07aba8dbd798381e0ddd560ccf0b13b5c70f1fecf8d0846b2ddf1bd5fb470b61ed1a9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcCo:A3k03kHRJARJk
TLSH
T129159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 893KB
SHA256 a5067609acc7eb506bca5b667074f1bcf7c596d91a9f90237f91af0bc53ff788
MD5 d0f751dab4dd9e9a4e57c6b9e6d8fe3f
SHA1 00545f1cec42976554fb73d6dfea99855bd2d312
SHA512 569c0c49a9b56366b6c250711c3d68f086abdba2f46a30dff6e84950ee40c114384f9e47b31e6d5b8ad18c286363c4e041e6d3d11f1b6e66a76ac40b7c26db6f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpc2u:A3k03kHRJARJW
TLSH
T118159C03F79900E8D15AC2789AA69A22FB757C561730A7CF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 893KB
SHA256 f4b30e00beed7a8ebdafa9e1bd8ac1635c0f07e76c6c921a42bd1e0e0ebf0d65
MD5 7e46dfc3cfc923403090834e3accfe9e
SHA1 c898f751a29baa25f01917b6d05917a16964bb41
SHA512 9f6e335473166b3ffb984b77079a91f4e5d98a34462ef3c6c3ef641ccc12f4d4d95fdfa9980c3ff6c3cbc09cb6acfde24232dc6df07e8deed51533012ccfb227
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcq9:A3k03kHRJARJ3
TLSH
T12A159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 893KB
SHA256 6ca494ea86ccb888455b9b0e5f3abccb55206f9342db3cbb627f4e5f7b669677
MD5 cc3a2b98c0c4e085d9ccf8dcf1721234
SHA1 fd181d5e6dd3fb7c8fa066899eb3754009b7e59d
SHA512 0a6f72de7c242ace0f365e056d5a9adb7b1f54374106a5da22f7531c13da167485c1590444a352b2a3818afd84a8825ae5a81ec6b9b04bb1891c3abe76156e69
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcqc:A3k03kHRJARJG
TLSH
T1FE159C03F79900E8D15AC1789AA69A22FB757C560730A7DF1364C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 893KB
SHA256 cebfea9e606a196b2cc49578e76d83667590cdf1373b82218a4664def6b67b69
MD5 3585519570a4e2696cd41a3a4622ad74
SHA1 7a4db3016ab8a0c2c43b751413b9d4fe2ecd47a6
SHA512 63ecf9295d2b604cc1d49981d7e75be59ce45d87fed43b1527d17d21c47ceb113c5996c1b29e1b649dc078b48f8b025bf557b8edce523f5f9aecc69da25c62c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcjp:A3k03kHRJARJU
TLSH
T19E159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 893KB
SHA256 c1fe842bb2f6aeab22a4da2c8eb6772a9737c96c6f05ade6d50cc4cd63ffd858
MD5 3b9629ccfddb40a9baa1d0c517594b3d
SHA1 4d12eb485ad03aa4a085740dbbe0ef6ec0ca4f1e
SHA512 74c71a1a8a07c272890360d27d17487014fc7c176bde64a64b17ef6ebef4c9618970e01e0eab9da68711564645b6a3dc50549cf92e27bd0cfb0e4c59ff7ef137
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcEN:A3k03kHRJARJj
TLSH
T102159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 893KB
SHA256 bd9052a5f7e967d335c11082b132eb7552636a93445351e3aad0c5550082424d
MD5 d7ed9c8948a3bc6a9ffd6983c00f24e2
SHA1 8c8492b7a8ff1438aa3b314925fe5d0c3b9e09df
SHA512 12e0d064746acd1c9b870ce296ad3135f378e2b3294d5479144358d5c36056ffdb55bde894cc08df4ff71c641239b259e5a39ac35e0b3e919e620a4a5ae2c8e8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcsF:A3k03kHRJARJ1
TLSH
T111159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 893KB
SHA256 cf525f7bc548a1fb7dece8971f1d630d8f8d2dbc2a619c8aecb83f114f1294b8
MD5 7ce2e6bca2396830dbdd6f0a07f5e3e3
SHA1 f1cd85e02f9a1efeb5df4a202fdf0ada5a2a6d9a
SHA512 e778f23e115a0d4ffe507474ad42e6e7f3a54f132e7eae2db89bc85b20d081d89766ddf4d6756c612776e2712836f6bd737c80d201e6b9a68a0b8d5e447e94ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcZC:A3k03kHRJARJZ
TLSH
T1C1159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1364C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 893KB
SHA256 bdfaa9aa45a8be9776582aa938dc835f08301724df400270ea81f853a30b40bc
MD5 5474fd4e6fb75d95ec37d542c0c697a1
SHA1 9dba788edaaead8affb8850d779129acc087bf2e
SHA512 9625f5518c45f5a3892bf8aeb0bcefb2b1fcfe2d30382f267773c19e2869161023775e8a481a650c68b14fd5e2bf0abb4c1bb737933d8f800dd084444a894330
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcaw:A3k03kHRJARJE
TLSH
T182159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1364C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 893KB
SHA256 de35a978c15d5914134f8ee68d1b80acf689d329296926ef845a45d0a6b638d1
MD5 d7a63ccd256e29b2f76027da9472a95d
SHA1 9ad8d11d5d31d4a2f9dbe29e79868504c44b96db
SHA512 cb6506d6d3873303ce328c6593fd25b1e8c38a9d4bde923abf1dbd16e792c875f7effa18e29711b49d94ac9ffc39289c93dbbbe9b2caaaad716a08d866e27605
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpchT:A3k03kHRJARJs
TLSH
T19C159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 893KB
SHA256 08bf0dc0525997b0cf3ed49b876109febd991966d1d405958f60680979bc2f0a
MD5 cbc6ed50c49d0c44b376fcd1c982d34e
SHA1 5948234b9cff77d74731229c391595df54cde3ec
SHA512 364a1f38dcf3519444212c4f285db25082760017c6c22572831adaf0a5d4c75ffa6c728a56bfd8b00c7a8416b2a6f307af889d3c7b598318961ac4e63b48cafd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcPu:A3k03kHRJARJL
TLSH
T11F159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 893KB
SHA256 a5ca652bdac2b2d3530b7eb4b81c79d4325683027c9f6e33d75117068a6253bb
MD5 417e2d73ca0d4b1252c68f8dd89ce617
SHA1 c4c44f4f9b8a59f0819097f9208d04257675e8e9
SHA512 96f13b1e2ccfcd0c7cce6390e86c9952391cba36ee46fc05f85359a54966653b8da38802ca71f72afd9d4399a67e179b65a2dae460a6066b56a22bb5ada3cc42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpczb:A3k03kHRJARJi
TLSH
T1AD159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 893KB
SHA256 21d8c4bb56a2b5232aa6b962f700e5823b52c01014650a205c0cc9c0d6a2c512
MD5 b7602ffbe6cc7bd6c61cc1a051a2f9ee
SHA1 ab67276bcca3e6b7bbe4112bf0b6f837f987ffe2
SHA512 21d6b1ad4f5401059d0b3b12f0f9fa51380e2833753a464a9b02cedc3dbb791a935a54861a61cc6d536244d36564a5ddc30383285fecc8eb9570fc9b5b95be1f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcHf:A3k03kHRJARJC
TLSH
T182159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1364C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 893KB
SHA256 73dbf9d5f02b77f2b920339c37387ad89939f2617c4574324204e4073582c2a4
MD5 d9596643cba8992fe5a9f03b7b9b9e56
SHA1 1e2744211352890889d4e1566f8e37bd5ad4540c
SHA512 266bb5c41073953b4d4290324413a59235ff860d625e0db5dc924add5ae4b48b2780eac26caf4f05094a17fe60cd794b3fff8d4b91f14533ba5153084f115f2a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcwK:A3k03kHRJARJi
TLSH
T14C159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1364C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 893KB
SHA256 14c6ba67b9cf8476d1f4bf719c287912053ea83e9292ac8c98e722b7b4cd9bd4
MD5 e85bff40ce3276006803557ed8ed114b
SHA1 5137485f2a2d6f91e806b41c5c9b3bcf6c49ce6f
SHA512 bb2b248c357848437c34062ad875a6ca81d78052486ba709e686fe8450ecf13a953dcbc365434357b0c681466b33cb65affb109b26ca49e48b5c7c8300a67f62
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpctk:A3k03kHRJARJ3
TLSH
T140159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 893KB
SHA256 64d15a184b14992af75a7a9888c8ad83f497a30b990ec6f5575661c49ee65ebc
MD5 bdcb167f3754b25d8437f29c3bed7e6a
SHA1 9363ef4c48b3db13aedbd614f2144360a5020760
SHA512 a95903af89125eeb2234b0fb17a257c0446d445b56b0f0fe82fa938a6fbbfa3eb78d0914fefb92dd2ed45b67b732fdefffc43c7f6384a01fcba0980f423124fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcy0:A3k03kHRJARJW
TLSH
T192159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 893KB
SHA256 07a484172bda526af99c77e5d602c9e48aa259ead9e25b220654e4489e150926
MD5 7bb4eed8fcb9187555e85cfa92003542
SHA1 4d89f83ad489c5b08fdc614c426b92a96156a5e0
SHA512 bd7a8a7af6885832759e522da6bb99767b2e5d85feaedca9b23932208f98bd571239b4c265c41974478e36b165efe0ecd4d5392d379740fb902d256cb2ece6da
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcBg:A3k03kHRJARJv
TLSH
T134159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1364C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 893KB
SHA256 070f5ef42f1a05128495f437c1a10dc8fe815a9f299149bbdc721c498e9be66f
MD5 feb4bbe32b7924ee2af9efed9a517e61
SHA1 85bc4363597a062bc33d38cdea1630a15d9c9ed4
SHA512 8bae7043b7f75a5e16ce01cda19b99e5d94aa286dfe470fb020da6e386bf0d1daef0d2abba900ee14056c1e042b02c02f2877bf3af8031427f02bd462edf4e7c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcor:A3k03kHRJARJJ
TLSH
T192159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 893KB
SHA256 938644e43212998792e49cc29dff7a7b4a89aac368678869b0cee9f4fccddf39
MD5 38deed739d22320a178e069ea8a3bd43
SHA1 7d097e59ce29c18f3179442b9d7c8e9a4747a372
SHA512 85aa0c6f92218fde9e5e18c6d0051b259e72fd326b0ecd74c2e0394b48e0e8d9bc4cfce74d89ff2c96d72dc08a6b3a78f1ccf3ee2a63d0335f4684054aa56d0f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcGn:A3k03kHRJARJj
TLSH
T18D159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 893KB
SHA256 cf21dbb1156d124be9eacc0235001901040a5dd6bf925115e6b2abb4c26ccfd0
MD5 530eaccc590197e89be677bd47dee0bf
SHA1 fe4f0768e933b32b722f99076758eac585c02905
SHA512 d70abaed40d0a3db11b36ede44679a6fc75e0700b3438f97bfd086935ae7dc55bd0188cfab656ed6300193737fa2cdfee6fd5c0dfbbf230cc3536b6dd00e0e8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcMx:A3k03kHRJARJB
TLSH
T127159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 893KB
SHA256 73447b8f4f38dc60d90f16d357d1cd7d53a5f54af851af3ddbcf7a6925679e78
MD5 4fb511cbc2ed744a6e0679016c6cecb1
SHA1 068d592fe2b61775670f8feaabb8baf61536c512
SHA512 2884ea91f9fcc194c9854de7279496c0d0fd5f9f1caec7eeb6368aec2c92836988c50dcd34d0aee92385a2ad5dc212bb5ea11b650980b0d5525e5e2b552f4639
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcGA:A3k03kHRJARJu
TLSH
T1E7159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 893KB
SHA256 ec11d8787474f38e550fb96057750055766bab576f15ff10fb6bbff913031e33
MD5 2a70390414176119fef9558e8b7e6c79
SHA1 3e8b35cd45abd527e032b4c1ffe0362c2d3b3376
SHA512 30990590952bdfc1c5b189d9314d81cec69d58d5acbc6450124f95357bc44006435b555c9e2fed508c27af50e882c6c18edc1e3519dc86f540a25061e1e98ae7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcf9Q:A3k03kHRJARJz
TLSH
T1BA159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 893KB
SHA256 b69181206efdc4afe32d88a95ec9d050f50d4b51f704b76331aa300538b45df4
MD5 1293b73f092a6e12ce1e2869666a3935
SHA1 87155c6d5277023f125a98c051c2dfa20be4485e
SHA512 f3591ed3101e566e237e86efe57d8083ce6e76e85c509caf4888ee2e6cc7a4e169b5ae83e3c63e73134484100d14beb484cebbf96768ab87ff49dc41dcfd9984
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcW4:A3k03kHRJARJ0
TLSH
T18A159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 893KB
SHA256 c9b8de21bb74a630e9ed54f6672ba3f5fff09833bdef569c385e4722e56ddb6d
MD5 918d14a11e36ef63a1021dfab53f42c4
SHA1 dd50f31575f60b2257edd411ff54fdfc40236634
SHA512 2fa5039a6853f9315b36ca12d81268125f70f66ed2b89acf668f47aa51e07d0af2621ae8ed4029d8b49704c4c6c8e768a8c58923d27753f3a2cef0da4554861f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcFu:A3k03kHRJARJl
TLSH
T1D2159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 893KB
SHA256 6248a0459ad754e27563ddc464820a432c6992a1b480e73e601e7d1e039f020d
MD5 ca84a9e84ca1e7648a62653b8c19db8e
SHA1 9ded9a105431ac73249451b1199fde685562d3b9
SHA512 1419864877f23642fcbcb79c01d98f53c77817a42892b7d07bbdcd7a935450ca3efdcb8784df9ae275621344c59b0dac96968a990e015c6687ed95e9bfb66a45
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcYj:A3k03kHRJARJn
TLSH
T1B2159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 893KB
SHA256 9d0da6bcff54a027dc41fbd777da46b55d4ad7a3f7fb58c601fb1a3c48103b4d
MD5 08605aee50dc5608a719c66df6bd1f5e
SHA1 d1a338eb12902efbf91d9d9b6903662f384ee5f4
SHA512 274ead09d639d2422dc9fa73da4b1983598dc6d5c0f1c13ca3481226d20bd0bca368e3565353e0a435c93c16b10e3d56d22093e10d0a944ed600db2125012b6a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcpg:A3k03kHRJARJP
TLSH
T126159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 893KB
SHA256 dad7c69d52b1103b48573dc32eebae72cf047d110df438a567ed5e932369e068
MD5 646795eff69e24593e659a6d2c279c7a
SHA1 54a58b7b320d67aea8b0e75f344fd8341fd7afe0
SHA512 5be276b66650b1a434cd1db10784886f9d7e9158b73557b87a58be215b441f455260b1a0e20651b2fc2a6290f985588b5bae807677a31fd089683ac62d16b5ec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcwI:A3k03kHRJARJe
TLSH
T186159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 893KB
SHA256 5f4dc421251a3067141eabe5a16c7f9b22e3fee564be0065eab80b27b23edfa4
MD5 54429e85e87ef9a74f61e5abb01db777
SHA1 cbd2d36bca0aa3a761d80e670dde9b40372d5046
SHA512 bd3e2615ec4a265a8f07b3f615254941e5c162caa74260df0b64921bd57b7942dc3b60c97457f58de6af1327fdcf71a564450947976782acd78687bfef015c0b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcyo:A3k03kHRJARJc
TLSH
T1F3159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 893KB
SHA256 c33c3d30505bae3387586bbe528254a23bf694748b9b3208695107cb1930f835
MD5 66dc9d452e791f1bd381463b18143ae7
SHA1 4a6e3aaf3ce538d4ceac6ef34501582c4069d3fa
SHA512 80f76088eb921a150305f06964d3e2d80596675af3c1349af9cd6b841dc2f462d7b524c64b6b058d28d369ea5d8278096abf4145509bb26c699eef9e29364ffc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcp+:A3k03kHRJARJR
TLSH
T19C159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 893KB
SHA256 965b03829364a1e75fea10fe142751f51e012c8e58f91d6c10eb016cb3b9e3a8
MD5 bf2e7e782447d8c1bd586b4b575e71bd
SHA1 7775f7c6036f76d661048e872ba02449d0c0157c
SHA512 4aaddbcb14b1911d6af43f0dbe703d6a58e7f240dc8b142d93ea419f9d35988c8d92d3beebd3d5538b8432f8906d5506a5bd2b49b8f6049c262aa7fbcaadbf7e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcXQ:A3k03kHRJARJR
TLSH
T133159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 893KB
SHA256 1844383b2ba0f168a4cb75dd5ab0935b8a10fd306a8dc02c8ade59d0a2d38614
MD5 37b1a6c8eccb9d38f4df5455d0006216
SHA1 cab757105640ad57438b8c14678f2b01e5edb108
SHA512 26d62d01fdc936648e5035b3664245d80a8a2dca7a5b5fee57eba1f5029c99cfb3d0e673932e0518f143bdabf79bb93666a99298aae45afe66a80be17849cb8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcsX:A3k03kHRJARJd
TLSH
T17A159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 893KB
SHA256 8dd0b5c48c8438760f8628535450b5ba624bc61c51f9086e60593708bba1ed8f
MD5 c77f1ed257295b0fcbd185830d030ea1
SHA1 0c62781aef9f2437f79432645f2cfebc5329317f
SHA512 84d7f1e08dbb93fc1007975c03aaf82ceac3d4eb663c0ebb97f106b6c8ea25158045358c2171465de8138c299d8a65f938a98e43aa9112e3b7a608207e7d7b41
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcKL:A3k03kHRJARJf
TLSH
T14B159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 893KB
SHA256 281dc1962b91789278b48b8572dfa6eaff3629d905c5d7268ddafb1e62df9e4a
MD5 39a3900bcd11506769515bdd7dbac4be
SHA1 c862410a9c76a4ba49db1997b063c39f55108f6f
SHA512 efecd5bb03692671b5e5e97d29801003f40c79d91e4985bfa5c2aa9e737bf76cfbdfbe8363d2d70dd3790fb71e17bc0001d34b0dde4b2efbe4cc16a0dd5f0627
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpcuM:A3k03kHRJARJq
TLSH
T1C7159C03F79900E8D14AC1789AA69A22FB757C561730A7DF2354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 893KB
SHA256 f8bfe9bb696d8d0460c2ba5ef4520eb9e2b61addedfab7ea9d6ae728ec346d68
MD5 e325e4f8b9ffb6259b6381ffd1547e7e
SHA1 21a8d07547f4bba0dec5a38d91a838b220a30158
SHA512 496a7a34a2c9b71e0778c1722d71471a9466176a5c83d50a0d3693e11bf2d843d79a9233c3e6d10c0af0cfed4879c2735a29973825c78fe772e1b91aa974965d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFpc3h:A3k03kHRJARJk
TLSH
T14A159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1748-252-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4484-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4484-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads