d7c3a1341ba725c4fee592362a39bc55a1fa9fa16a482659385e6b102ccbbeba

Analysis

max time kernel
95s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 881KB
Sample261027-emfeaa1vfz
SHA256 d7c3a1341ba725c4fee592362a39bc55a1fa9fa16a482659385e6b102ccbbeba
MD5 e5d3ed75dc0be6be84e949a7025fce96
SHA1 bb2533455e9fc2d0683f936748be85723df45a41
SHA512 fd33aef943836e6376ba59cb22bdda66b7a40120802759f2e9b927e84c2a6cdd2ffa0304ae272db08988661811ec47b6e0bcfc29106df14963941dd45753baf4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlER:A3k03kB56rj
TLSH
T130157B03E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4108-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000187c7-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b220-10.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4108-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4456-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a4-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c8a-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-523.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-602.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-724.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-825.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00040000000187c7-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b220-10.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a4-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c8a-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-225.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-443.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-492.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-523.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-602.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-724.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-744.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-788.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-825.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-856.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-901.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1132.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1151.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1323.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1342.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1367.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4456	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	patcher.exe

Drops file in Windows directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4108	2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4456	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_e5d3ed75dc0be6be84e949a7025fce96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4108

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 881KB
SHA256 d7c3a1341ba725c4fee592362a39bc55a1fa9fa16a482659385e6b102ccbbeba
MD5 e5d3ed75dc0be6be84e949a7025fce96
SHA1 bb2533455e9fc2d0683f936748be85723df45a41
SHA512 fd33aef943836e6376ba59cb22bdda66b7a40120802759f2e9b927e84c2a6cdd2ffa0304ae272db08988661811ec47b6e0bcfc29106df14963941dd45753baf4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlER:A3k03kB56rj
TLSH
T130157B03E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.4MB
SHA256 df3f775597edf9a60f6d21df827d1971a8749284af0faf4ae101bbf86b8b58b8
MD5 6ab1ca37cc86bed286f3dbd8b3f93122
SHA1 cb347b32c90c5a0a380f91167b85c447f5b3201c
SHA512 69c8d80403e53768dec9f0fd98c94bdd6d71e9db1d918e2c84758a9e34429a72defa86a63bdfe57b18d0f37467e4ca89abdaa7509f51869540a9308b55820f5b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEk0Le5ji0hmxNrM:A3k03kB56rePji0Aj
TLSH
T178655B16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 896KB
SHA256 c6240e2e016214f2e988d18ee0f48bce4dac09e135d9e0eaa03c488b297a406e
MD5 999d0bdeda9d6aa6a31edb4ffcc9a39c
SHA1 560d80893cb50d497498c93687453a58c9e2bdcd
SHA512 0cfd5e070b03706155c59955322c87912a9bfb4d43b2d826a806dcc3f2a3f3a2875b180b375d33f2fc6e55e88431cea37b8a316e318d701d8bc18a4a768e385e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEOa:A3k03kB56r
TLSH
T1C7156B03E6850FA4D10F81749A968662EA777C425F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 929KB
SHA256 083b8b9c51be634ef60e1f1896fe962a8df0e0b6fed4d93622ef0bd70bc6b5d3
MD5 c11963a2086a74afd989eac32a0f5da7
SHA1 0049109f63247e352eff9edb7514dc5e01f50fad
SHA512 eb4b0967d1958b5166c778929124083d4999beecf8d0dca8f3060fc868cc2691ecee41227811c5fea827da5530f0042c63432d4264e823fd54c64ce46ef5b984
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlENb:A3k03kB56rTb
TLSH
T15A157C03E6940FA9D10F81749A958672EA777C425F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 905KB
SHA256 5e65e5c89537d5c641db4d25d4bcd91abd45e5fcdc65e920f8474ae25c7dab73
MD5 5bc93f094b8124a6ab68eacd243e23a8
SHA1 a35d936acbb32763281c7852a3fa5dfd59a83fd1
SHA512 27f31743e8b565c22c6c1364eaf30290aaffc28e652ce5be680b19388e97d9ccd3dc7589d2108833fc4cb02b2aeee4ff6a3887f87f554a78e669b8e8e8cfe3ef
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEv6:A3k03kB56rI
TLSH
T1A3157B13E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 905KB
SHA256 60404117d29fee4fba0c27f4afb26c0669ea317b36f0365681948bde42bea86e
MD5 10abec35750a4b47e0d77d93960f8940
SHA1 f9e506aafb4062cb9c4132f90d59ee641eb19325
SHA512 5b768399a5e76b594584e81a3c3f93d8ace1bf60b056625b4d92dbd194513580ffbf375f4aec6aa4e7ceeddc5b6d9387fd7fc12ca27ca5a9e63dc793fc80fedc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlExN:A3k03kB56r1
TLSH
T1DA157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 905KB
SHA256 24e51aa15ef0c0533880527e1188bcb71206a13a07d5f3ae904c2c737e44b5ff
MD5 2fd00d0dd2c308477e10206b9e188fa9
SHA1 f850a09e04eac91cd0c4ded81dad1f3d8487857a
SHA512 f2de0c941fe26ea4ae0180ff1c0f3dae19991e9fd2533aac1b24a2f87ed50752948aa9ac39207d194fab3eba1ccd8acc637c645490ab31a2b0c0e9b08d77f477
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEnf:A3k03kB56rt
TLSH
T19C157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 905KB
SHA256 06b5b91817a2e5448c4eea2ae5685429311f71c0354547c478504d02e0f0a4b8
MD5 33d9eec0a998d5e6c7aee5aac19c6a3d
SHA1 3c15057b1eb1ddc445f36a7f9f89ad3c7ab0c910
SHA512 77dc0271941fa389cd015a9cfe0de9b26f0bc6465010e4ef39d9a6178fbf5428399646cf0c2df0d9667ef4d4dde3f85aedaecd31bcde80b05e816e1ff5a7c5d8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEpo:A3k03kB56rY
TLSH
T1CD157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 905KB
SHA256 4bbe46d049b09f428190e73a0955990c880c691bdce579510f18481b641e83eb
MD5 b3ce547ced822d9ff6604cd5173ee015
SHA1 ae7471a5da6d1003f6b34b6ae42c243686f22dfd
SHA512 4a213a98233c5c913ef616e664c3d59000e76a6f5d39650780a11a1b297382e37cee2f7f94c9f686ee15e128c681f8406697fcb69ea97119e0e1486d660068a3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEZu:A3k03kB56rq
TLSH
T1AC157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 905KB
SHA256 59ab746b5af9b716bb5930880aa38d7d69e9cbee63eaba4511671be404394083
MD5 edf188d56bfa0d3f4d7f0b9465b8a2d4
SHA1 d1828420b092a49d92e8ce6b5d3a39d9bb8d8d13
SHA512 3e4c52195f09b73c81d7236ffb119c8c5cee85d7bb30e397320f6514beb58c8bb30ae0c8ddb3338deaa4e662e36223c6e370390a86dd83ad1cc38be1dd29b291
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlE/9:A3k03kB56rL
TLSH
T1BC157B03E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 905KB
SHA256 123ece1c4c3e562970d3fc8569b720749e01802dcade1e50af78668cf1929873
MD5 042c90ab18b45aea02958f075488b823
SHA1 87baebd775ddb5ff57a49aa8ca6f3b9f67a46ff0
SHA512 f7a64b6517617ce541478688984036d6b9680412bb0ad4e827c6dd59150bd0c535e56e37ef0c2d342bcaf0553b60a23c1099c0af749148512a6d218f4ecd159c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEbc:A3k03kB56rC
TLSH
T1B5157B13E6850FA8D10F81749A958662EA777C425F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 905KB
SHA256 a4de6f2a8b96c9b9e478a114c0ef7d879f7f2f2bf5c29b39a1f8951d1c64ecb5
MD5 310a01309f76eb83f9e5fe9dae1b5100
SHA1 ab927a5d97148b53828e4e00dbc47b6d064fc3cb
SHA512 82d6e358b46ef6d726edf36231fc09b04f0c3380812274f6dc348294e931b72985d96f9e9f8ce6fec7bfe9d83ed716581f6ef42884485b86eb0bbe7a5766d554
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEEp:A3k03kB56ro
TLSH
T152157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 905KB
SHA256 1fe4d33af6a6913ea72ded0fe85a1cbc9e8b1bbe85d09f517cbac84113ae3f7d
MD5 b574bd06150d65b3db5c3693e6800142
SHA1 adb54e38b077a749c660ddf6b51f988573da8b40
SHA512 87e9c4ac36e9691ab1453d5f16b18daf3402504f4bb269aa1b347182d320f0c2a180bab3ddfa6bdfa9122f9ad68834f0f939c08a938b148dbb6cf6a926e7360b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlELN:A3k03kB56r3
TLSH
T110157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 905KB
SHA256 35fbde2749eb69f72052d82efe27b51bf1634e1e56259d4a94fc6169edd85871
MD5 570bb18689f89a520425de8f9691ca01
SHA1 28f1a5d6b4a37e7943652260453d1581f5922494
SHA512 e5ffcc4a66c6cbae606b780a5839f1559692873efa62db4380bb07b19897f7ba2155f34059396aab3ea6bcc4197d18cb32f6c2f127e1a737e327acd4d6db7a75
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEZF:A3k03kB56rx
TLSH
T115157B13E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 905KB
SHA256 47f70adb32d0d210a44452d68ca3a5ef22b9be1e20d0bcd58d44733bc2f050ab
MD5 5f44c73473e4f3e6c319b624956cc645
SHA1 b10832ca4abc2abf8faa51ca11c8db36b7b86951
SHA512 bee76316fe00b9014f4074396f74c87a03eaa100bd4290aeabea25ab6172a8046ed2562d1a0b09fac3e55a2b70c7874f01d4957ec3367ae25ae7ba52f5534d11
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEyC:A3k03kB56rd
TLSH
T176157B13E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 905KB
SHA256 68ef1a0b430cc113dc76598b8a3fe373d811b33abd77dd9ab9c20c0b8e23f420
MD5 0a4b3d83857b943ce6dc103f95518ac2
SHA1 79a515008df2a2c45142cc3653a19a7ccb5c97b2
SHA512 97a8ee666add0a70c8e82a45f1140ae81e253f6af5708d8b42f5e1b2501c109f97c234e28c66f5c8694969c101da5a6b37a8f5aade21dae5b28dbcf5be921ec6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEtw:A3k03kB56rg
TLSH
T1F6157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 905KB
SHA256 348087e67fa2d1397481f1fe5ba2deffa5bc2ea01b0d06e6cae4589497d5fc71
MD5 67c83c9f4fcc436419ddff4bb9c3f4ce
SHA1 4021772769730e09c07cfe6a70d66dd444b85201
SHA512 d2948f2490535dd205d4f014f7ac275edfa0ba5560613e1158ae4a5b84167d52bc78cac85a76b46b99c039ddaf54bd03dd63adf60f5e64ccf63988f0b27ef7bd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEcT:A3k03kB56r4
TLSH
T193157B13E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 905KB
SHA256 084026578ac834b021c355fdf994b4323564a01126a8b14f2c6f1351ce6a46e6
MD5 7ad4fe83b75349b64c5b79447c924987
SHA1 3fff5ef4e1485fb8d70ba80ce7bc5a455a00c170
SHA512 9c31a15d67a409eb82b4a21d74d661168d5779f0d4df5831d78b0f3705af8abf0264cb24f58c57c4e0b5992e2702ed52c6d4c41f138648f17419154976223ce7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEwu:A3k03kB56rH
TLSH
T187157B03E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 905KB
SHA256 1eed8ad1cfeda6023a2ae58a17148a0b1b3a729c9a9abb27d76bca30dd64e401
MD5 80cd45b37bc1dfa355f675b706078f46
SHA1 e2567c88bbfc64040a639cb166b87ad1004c542c
SHA512 e0542e7aa85a94e571c216b3bc8714978db4b2173b52ad54aa8f5f7558276e8974d7e2bc73e3c1771ccfe6b67e25bb3cc855792b2f21f25880d6a3143466f135
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEOb:A3k03kB56r+
TLSH
T1AA157B13E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 905KB
SHA256 c8baa936639d00c363acb17ac772578151e3220a69c4fe6fe4a3635b9241ef25
MD5 35fc7e9600c9232e275bb1fad3773d85
SHA1 96b7da9f6b558ed3cf10a5fa2a63fbe7c30d7e31
SHA512 73795402b0a07286c4f6b90abfe1532e48feb42236f3e653619d093ed944bf582f7bcd5a65201a2ad093ae56b44315694e3d8a44fce421b5aae7c77605de9da9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlE4f:A3k03kB56re
TLSH
T1CA157B13E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 905KB
SHA256 6b380fa3433f8254c178cd9e6b27b22b43993c554f5a8cd7c2e94415d423e4a1
MD5 a6f5ac563230b10bb0ce6fb0af166222
SHA1 ebf620260027a906654c57380234d9433d52242a
SHA512 8abdd5826147dfb96f3970ed0db9b3d91cc01639183618a7d2430d5af1630ea4ea64d7dd4eb8f8a54b32ac4c0a766a6fc90fa36e4883d463dcb5af9a93bbbcf2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlE1K:A3k03kB56r+
TLSH
T1B6157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 905KB
SHA256 abdcce5c63677cd02a7806aff5dfcad7b2ac28853382c1c8eaaa583fe9bf3fd4
MD5 2a797b39c4080ff36f40403ff2f82fa4
SHA1 041c9abaff2dd4f3d0538e2ae452bd55cb1a78ee
SHA512 aacaa2162f68caad56c99b615b188bb16765aff37a2901aa52a1f8cd44adff73f8da3acf6009b7920589cb981fc80a7a6ff9c98636095652a09b63bcd6d60d47
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlE2k:A3k03kB56rj
TLSH
T14B157B03E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 905KB
SHA256 e00effdebdc1a8dc503b569e6e4b83a471730a663244a68bc2c1b47578231012
MD5 514450ee455cb23f11c913c42141f353
SHA1 8eec9bc918db72522e7ae16dfb9476482f35da7c
SHA512 30efe990c67aeb5e52b067835c6c25cf9dc5eae1d80ecabfdb4f5d6abff2b3c04773180074aea2aa0f7017fbe6265e2af6332aab04e510a57922f864c907908e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlET0:A3k03kB56ri
TLSH
T166157B13E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 905KB
SHA256 4f9b3c2be8f5282524fcf92feac7d12aaf73dec8911fea52bb11933a30b557a0
MD5 4224a4ae0cd52fb2e302691fa5318ee6
SHA1 e67d57dac83a95ac6d87235405b8dd367c409e79
SHA512 f01a9efc6fc2e3f51245734ef95a8a7d27a25d3aef3afee7948a6dd885cd2454249c5bc76d603fcf567a2f12d207bd96d61ae0d9b209d588a812428fe714819b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEig:A3k03kB56rb
TLSH
T145157B03E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 905KB
SHA256 3675d01b75eceafca3765d4859ea38dce2ab1546f8e6a8dfa81a2ae404b7a7df
MD5 c5ca77e79ad21a86af3063bdad49630e
SHA1 5c03f7afc8ccf134bbf989c2f6af35a7bae0ed55
SHA512 510f6e97fa3ee4750f1900cd94c43181b0505fac9f27dfb133457b4bfa361fdee0099f1370bc924d8653699e4e7d5da10666dd351322fb62e1eb54a8e04ffe98
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEDr:A3k03kB56rN
TLSH
T10E157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 905KB
SHA256 462b834295ed131202610a6d7977f19596a62e757d318b57daa09124aba55836
MD5 4677962ff251cc57a3f05dc1094fc33b
SHA1 10624592666ab63b335caf63f229c696a7823e3e
SHA512 4aa26abd2a953a16d9eef3a3e01bd28e9e8fea4659b5efdc056064213febc0559b22b82f62c5afe13efb0be8a32ad0a1f664b907b2ab846d7c4d5ce574292426
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEln:A3k03kB56rP
TLSH
T108157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 905KB
SHA256 c65e08076cbb870703da435de6a3af3ee71485a1b66f233359d99b8f7d1b3123
MD5 fc6a13b6f0970dd8ed430591fb32ddcd
SHA1 a1de2fe35b4e1a42be2f65639e378804c89d2209
SHA512 ec8bccd24485c247ca84cbe67f709f7bf0cbe61c8a1a0497398cddc25fbc5e1b48735b10019b52ee2d9eaa193804e4c53b7f6bcf83db8af4ddac61f796664a11
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlERx:A3k03kB56r1
TLSH
T1C8157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 905KB
SHA256 8fc94208f7881d9766d786e17259cd7c7c1906da6419f199ea9ae5b69bc0bebc
MD5 1f86ce309965f553b391537a7d9be3b2
SHA1 df61a87e17a3090217c5f0a231c5a8cbf9ba79e5
SHA512 dbc77f27ac91f7691fbb3457b9a651df29222761e8768dc4a33ea38d47412a4ed71aa72dbd988843acfa053b2ad3516bb5cc8c52844b8c59b8d05021526504e2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlE/A:A3k03kB56r6
TLSH
T117157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 905KB
SHA256 ea97f82912ab99b923f75cc5fbc22655e9ab12ad35434b7604e50a130072aa05
MD5 ebcc6d703553499eb5e698e6a75741a0
SHA1 ea8f18a15c6a8cc5505c885e976e291ae0324816
SHA512 23b3e23cc5cd398cbf6d34cfb6089fef1eef99b6c1219879298d7a9bcad40d31f08f55bab4a114739e2c73d5fabfd5a429d2bf42f4779c0a16b8edaf40d9c7d1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEQ9Q:A3k03kB56rH
TLSH
T1E6157B13E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 905KB
SHA256 87864ce165c8cc601f73559557a9a156521875db4d812340bb60401116182651
MD5 57d4c127a4d35eb76ae7e0feea0f9519
SHA1 1a112c7229e98b8699f5ed4686ec6de722f672fb
SHA512 8a8e14a59daac4e6235d7ad315e9d8d24a56fa486fe9db8dffb5b0fcaddb42c773c3eb2d1916be924002bb1621cf9c1151b35ef22d513535f0e66fc9d72b2410
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEx4:A3k03kB56rY
TLSH
T169157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 905KB
SHA256 e3fcb539142ab2d80bd2887ed6a385b336a38924109e0e2f61b116a543744d2f
MD5 19d5d05731ad33a7d50b4d9dc55dd46e
SHA1 5179cd9720796d4637074da7341c1282dee8cda0
SHA512 22f36b2d35332a042f1138838381c8a1e9d4811c4d0f5e015c7cc0f5b309bb27b7b6cafa79eddefb68ad6a5d22e6521e675b796801869b7ff45aa9b53999dd39
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlE0u:A3k03kB56rp
TLSH
T115157B03E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 905KB
SHA256 822f7c173fdb4bc024e1691b9d7b3453cd0044f585c920587106dff2408e2244
MD5 35307887021e85442cc5ae5b5ca44540
SHA1 6d7a20a5e8b6f3f7c56713d720d3cdc19f29ff0b
SHA512 0648269641c9b52e196f833356674c6c678eb383be25cf517470a04117e327761feb98de8fa06e85058cb20af06211838d8507874caa58a7611e2bef94c05db0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEFj:A3k03kB56rz
TLSH
T190157B03E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 905KB
SHA256 f725d2e8e549559d4fa9512a43194722913ec2092a9311856c6850d7f88685fe
MD5 7cc5744d9c35305631372d08afdd46dd
SHA1 ebd03839ce7812c02f0944146c5931f8d5ad5a3c
SHA512 63f0fce0a9dad35af8e46af89bdb30e4b0f34d10991da90e3e75e9a10fed07bf31686bf4982836acab2b83d155568a3288a306f8104cda7af25dbaaf3d2c6ac1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEMg:A3k03kB56rb
TLSH
T11F157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 905KB
SHA256 2447ad51eebb55eb4ad6e211a3fa1a3be3e50b387c6347c830b7cf8508fb0dd0
MD5 40e0415074a0e1d20e6f9e5b41b15e02
SHA1 b71bec26737a95b4416a25b4b94fd8a946a47dab
SHA512 34da2a0e1b2c729fa980abad282e6b381bb1577fc2f56dbc5c11d4f63e6a8540fc90d984fd2a5f847cb0a957d69d232b3a6ee06e26d87ee8f5e814edc7e91f5c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlETI:A3k03kB56rS
TLSH
T18E157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 905KB
SHA256 92706e76df1b9951f7351a9010bf4746b8efdbe4e1d296016da716686fde087d
MD5 ca8fcca851df5e0ec2935b067eb713d7
SHA1 99407857bb042f8e52692a16867e31f8f2d82bb8
SHA512 bebe6917ed6990d77b1fba469bcfdaab52960b67536eaf3dd6adc995ba955cdd6e3d4358da404540e3fe0e3bdb89b72c484954101f5c36d22c643bdf402ceb9f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEpo:A3k03kB56rw
TLSH
T1A5157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 905KB
SHA256 8b943b132066b6e74654d524aec4efe413b8bc93f9bc630e7c07956fb25e71ec
MD5 c755ab692dbb9a43efe0c10b3d9c1ead
SHA1 41057a298df2970c570d9c7465bc1d378dcee720
SHA512 12c8379819d87bbe7bc86a4442e253cd7c092d9d119c9fe138ad8163dabc026489c98acff2560a1ccab1bfa9a20e99b006eb1e0588944341a655e2efc1f20419
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEa+:A3k03kB56r9
TLSH
T10E157B13E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 905KB
SHA256 c2570f89441d1258a32d3cd1a673e69dd4f72e0547ffd17b778b7f42e750f956
MD5 617f9529a19e503216d94fbc195df8ef
SHA1 5b8e26555c4891f576441ce162faee35b9d6952f
SHA512 c96dff1ecd34f40c76b74f8e42926b05993577a8e97d092300c14951428cc89c309fc9d9dacd49e1cfda665c69c6af15515146339fc62720eb84a58d13381dcc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEaQ:A3k03kB56r1
TLSH
T158157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 905KB
SHA256 867d0237bb5780772eb21ec1868678acefd9067b0f9554722afe297c0abbe84a
MD5 0eceb5e90d52cee817febda11f77cccc
SHA1 dca525bbd68acaf45da25dfe7e8a5e99ed003b02
SHA512 3508c8a8d1f7ff4046574d26346b03f0537f69564028ef3753d09e471059075bc809f25715abbb1bb0959a10749490e5af1d02637f2831586aeeeff3587a6681
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlErX:A3k03kB56rh
TLSH
T141157B13E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 905KB
SHA256 65c585ad946859defee0fa9dfbb021b390a4d975d4b8a54148f8bcce965c2733
MD5 3110e076f950e2f55a0a757393a21433
SHA1 a0eab0fdab8cf2a2eabfb3ac995a3b32c7156249
SHA512 29a6f11e1518785af258b6b2137d90978fa8ed369fe0ba82ca4249ce55b728ad4f68968c2f4d5136af75e327382ea46c2383b1006ca0b75dcd2432dd61f51210
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlE5L:A3k03kB56rr
TLSH
T1EC157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 905KB
SHA256 69755d2afdbc9c57b19a7a030765eaa25435b9f7ef1b21256b3d4d5561af2b74
MD5 8882969a3f3625ab6483f47c6ed133af
SHA1 d5ae5ef6eb52e8f0ba0abb38280d0cfce7f558c1
SHA512 783b6377f2766acf3ae80c900d0d120cc0b0f5a4f1ba0ddd94f04676cb689537698190c1828f5e5d72b7e25dc32367e3338e082601d8d092e72669ac8e46abfd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEnM:A3k03kB56rm
TLSH
T1E2157B03E6850FA8D10F81749A958672EA777C425F2093DF2358AE153F72BD06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 905KB
SHA256 2a8109a0eddee64a0cd2d5f17f8e4d4ad7ed23ad20131a8285bf64fe08fe72d8
MD5 6cafb8192e6ae121a5787069b09231c6
SHA1 efddc9c0ad875a9064105c9d9f4aea680d0899c0
SHA512 f98a599e588fce69853ad334919a9a7e6c371dece96286eecfe91e845ddd8cf9e74db628889927fbb8af3bd6418c9816d94e52272a03209d22c5010ca5f14780
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrjlEQh:A3k03kB56r4
TLSH
T1B4157B03E6850FA8D10F81749A958672EA777C465F2093DF2358AE153F72BC06B3E297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4108-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4108-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4456-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads