df8b3dede9a29ecb603e440e6dbf97b33faa4c29fb907cd4c5817f1fd0ca1ca6

Analysis

max time kernel
110s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 00:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 946KB
Sample260823-ax12hswtbx
SHA256 df8b3dede9a29ecb603e440e6dbf97b33faa4c29fb907cd4c5817f1fd0ca1ca6
MD5 c7b4dfa054d626f3c33cd94bc3760ea4
SHA1 e9e86509135f51bf47ab535b250221a010d66d4b
SHA512 eeab3077957aa3b40588d563284e06903a0a71238da9565571befd68cc9e06d10f7c6a8a959fdb149926b7691196eb65a19b3a00e4fef29056607a41acdd4f09
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZC:A3k03kHRJARJi
TLSH
T1E4259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3800-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5bb-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3800-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3236-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001896e-200.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a48-207.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-315.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-353.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-484.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-509.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-606.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-637.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-753.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-796.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-833.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-864.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-943.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-986.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1017.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1109.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1190.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1332.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1390.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5bb-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2bc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-40.dat	aspack_v212_v242
behavioral2/files/0x000400000001896e-200.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a48-207.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-229.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a4a-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-315.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-353.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-484.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-509.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-606.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-637.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-753.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-796.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-833.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-864.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-943.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-986.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1017.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1060.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1109.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1146.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1190.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1332.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1351.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1390.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3236	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3800	2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3236	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_c7b4dfa054d626f3c33cd94bc3760ea4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3800

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 946KB
SHA256 df8b3dede9a29ecb603e440e6dbf97b33faa4c29fb907cd4c5817f1fd0ca1ca6
MD5 c7b4dfa054d626f3c33cd94bc3760ea4
SHA1 e9e86509135f51bf47ab535b250221a010d66d4b
SHA512 eeab3077957aa3b40588d563284e06903a0a71238da9565571befd68cc9e06d10f7c6a8a959fdb149926b7691196eb65a19b3a00e4fef29056607a41acdd4f09
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZC:A3k03kHRJARJi
TLSH
T1E4259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 70d8e77ffda66fe3c906cc691551f5768e2d831f5ddaf3cea47338eb555099dc
MD5 1905a927692c687d16e20e7c416653b3
SHA1 daf3a11ccb039a0729b8efe18f19b220ebe18750
SHA512 0b59c2bfc1de2d5e1a1daf356d2047c27f7cac4dd32729872ceb64c750375eda40937f1a11afaf5072ab9b8b51a28f200a22c4b49b05283138d387904894880c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZC0Le5ji0hmxNrM:A3k03kHRJARJiPji0Aj
TLSH
T116657C17F6A802B5D067C178C5D29A5AEA72384217309BCF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 960KB
SHA256 43128ebeb51932612fb69633856560b270d00cfdb06308646b892183258d7d64
MD5 77eea25e1f0fe33a9fa3d3f3fab70667
SHA1 50294a9e89728284d5466d87b99a5b1942af1020
SHA512 3fb580f6b8f0f4405b450e480cfb8ab884633c9d68267c23f8eeedb0b10ae59f850b72f26fea53cc6813784edef3d8a4032828d104533c04559126401b9af93e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZMa:A3k03kHRJARJ
TLSH
T1C4259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 969KB
SHA256 5a5b88b20083723cdc726a30cc25210dbe72d823746c8e6fbc08d450320126e5
MD5 eeb82848f58db193e9ba200969b32433
SHA1 02e1ee36fcc0873225becd8da9e2ac3d333105bd
SHA512 36ad2435b6dc1461b61e629e70eba5aa93bb2c19f0f573c52cffa8c534d77896190e83ee394ad0ee691d9891e365a8198ee1b31dbf7a61275b3204821bc193f3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZGZ:A3k03kHRJARJQ
TLSH
T1B8259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 969KB
SHA256 7fafa1c182c72ef587ebed490bef7088e6fbf719e7da8cdbb2e0735fa8371d93
MD5 883a1af2e36cc59d5c90e93eb654be8f
SHA1 0eddb36d28da7544d6f11e07d2fe5c77993cb8ef
SHA512 836a8be03935c47b1c4210650a53f83fb36ff656dc8560819d3a2bff3704e9a9cb354e93f39f285e12a8db5d2e44e19ae32b63668e2147f1b0c8b57e1bda0b29
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZx1:A3k03kHRJARJn
TLSH
T14D259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 969KB
SHA256 88ab83759143852d79eac67a25d1beae18ca43ac6494236c6c972782b604b453
MD5 ad4178073e05c6464a476fa5f70d1105
SHA1 bb7967a3e6a6a4b86762aabfdf11a2b2715e85df
SHA512 193d7be1487658325a6bb9812efb22fbf2776fac34e0a248b59825d2edc4f124fdcf1b158aa77949b72dcad275e76eb8275ab2b1e5a7eb600c2fba52d1da4ac8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZl6:A3k03kHRJARJM
TLSH
T1C5259D03E79800E8D15AC1789AA69A23FB757C56173097DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 969KB
SHA256 ee91d5139784dac68f4cda9d2fe0c8fc218bbb9394d2cf2fe67ac795a27633eb
MD5 b8142fa346cd9f9c2191a3ff34a008f2
SHA1 93ba28fd4abf521de2bac44f8c59f20c2411ccc9
SHA512 0dc95fa8e1cdb5b4f6418eace6c4c1419dcb71d8947b91f03d3ab6f78122f11278395f6aed9322864c816a74f6fccfe9f1ac88ac86361b79ef7abf61dfd999cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZ7N:A3k03kHRJARJx
TLSH
T142259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 969KB
SHA256 440f96768b2d79a0a96df7980386451ce188b82f6747c42c463c1d5f59b16532
MD5 b2a4b7a942adc16bab63146e4ab8b207
SHA1 34a885cb9695f5b4620c91844327099e35599fa0
SHA512 0a54d7cf2b891f35cebb3dc9c1657305465bc39cdee43fe82addcae8945cb50ce2745f02a2484545f5696d1ef87b0efe4b091290ea5244e8d2f931582352cbd7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZZf:A3k03kHRJARJx
TLSH
T1CB259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 969KB
SHA256 ed0fcdb3d98bdddfd68d8118c8c8e9ab7d357d8b68488dd7ddd5e0716c2c42dc
MD5 734e4a4634332ed0e0966e3d23269197
SHA1 4315298407f96d709035cf3fe0966763984a1359
SHA512 17e9a7251f18859fb040abd3153ad18a35dd1c6d619cebe8930c9cfdfd69ae4148c29fc410fd8add35c0763c775b8bc503c07912b7431d0932446d685d6d2f42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZd9:A3k03kHRJARJX
TLSH
T150259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 969KB
SHA256 5c81ee82fe0bf606a96f4500bf89ba3db8d408374a5d6ff8eb843d136777f8a6
MD5 540646b08fa7fc0842e008520c1857ae
SHA1 a8e8e120ebeee6891c2b45657b883f2f41fb3c13
SHA512 5b889f9e8738db747a246beb8e44f60f3083cb3d36e3ba4b29920100e0f85cc91f7d03d90cfe1b864637a80e2f04ee72b8b4eed00ed1f19d7266079a8f2fd918
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZ5c:A3k03kHRJARJm
TLSH
T19C259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 969KB
SHA256 8f69fa7108bfecfd5781c85cbabcd4ec9944839e7d0ad0069ef141633a129873
MD5 562834d2c37ab8b46622c557dc808531
SHA1 4e5ef6a39bdc95b9bf54798258fa0ae7d69f9eac
SHA512 a4b227161a77d16ef3dffcb7564c26ccaf213839c03818923326c81b1e431132c53064736ab2f9e6cd4e6c2d630078c99b3783032a4e085c7c04a2536fc452d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZyp:A3k03kHRJARJ0
TLSH
T182259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 969KB
SHA256 dcd9951609a325e9a98724c0c838b3b54677e686cf0b894f6992c88ae6936ef8
MD5 3131538fd52e420b2718b36647f89683
SHA1 60a1a8ab0be442533cead810250b8e9ba4d348d6
SHA512 a0cff67da5d1b03a5a4507bc9752e96b5f0665082b6f9316f041736abe0f937f6211b19c3641317d0897ca6781d1499dc6404ac5cf1f8d7e9504b9a9a9802ea9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZFN:A3k03kHRJARJD
TLSH
T1CE259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 969KB
SHA256 560ae8e97841258e5fc0b4a2e96cdab5ce8267ca7a361a7e5dc1be50060fa705
MD5 715faa3a5d21701ca21ff2eada240fb9
SHA1 fa4f23c4a720351677516aa23f901e50d8f9205d
SHA512 50a500740de6de80e67e7013eb8fa90b6f7d7ad6dc21c70c7ff8a830591302a186e4b3ebdb8b22fda1747277eb0e39fd143b70b887009e7512ca877127791885
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZXF:A3k03kHRJARJV
TLSH
T1F0259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 969KB
SHA256 e01b23966e8ae79645ea2c86824226fcf1f7905897329ab3f29e8b62775fd527
MD5 6e84e00a1e76917fa259c94f1e4e37f3
SHA1 8c31b6218d12bfb19cc836f857467da33ff2d7f3
SHA512 100034f9711189d9ec123f28601bc157fcee9cfe2c1943d294033f11e893d849bdc19f0f890671d2ea9cf7ac17879a19ef3148a055ddf68627e21773bf7940d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZoC:A3k03kHRJARJ5
TLSH
T145259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 969KB
SHA256 88fda9444a39d594d0944381cadabd89854278fc6dce2c9400bf09675ddc16af
MD5 44a866b88c6eb16cea6b9849fb94e3ca
SHA1 225a788a3867f9a40fc54b4d9a5bf86fa641251f
SHA512 989a1900fdab83e85a2738bc9dece0f5d5a4bab3e5f061a5cbf41326da2d80f616ee97393b460051543943662a5e7b8d78113d54b3e2109dede981afcd92c169
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZ7w:A3k03kHRJARJk
TLSH
T15B259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 969KB
SHA256 66b10cecf67a8ef2649f3b44f56235d8d25cd0418f0243f624f725e2f5c1e6c2
MD5 defccb7a3f205b27787d92b40fcd2433
SHA1 d1489dfdda514708717aab7a474bc14efaf9351e
SHA512 d119d0cbc6f03e2297c959c19d38c0cc8fc7fe147de8cf2dd958d8c6a413e15c594dc5aa45df3e23f0946cecbb67ca3b8e381271770ebf315ea69f0ea75f78c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZCT:A3k03kHRJARJM
TLSH
T1B1259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 969KB
SHA256 b92240d6c635426815ff1912d15a600fde4898510b353c50d437a9cfb9242048
MD5 e8e1211a729e25d84df2c4368fad91ad
SHA1 f3c246b26f6002d9f6000861c1119441c11f14b2
SHA512 4db754b63d09d4ef3844e63a43690be6eba4477921f302973ca68e3c8f4bc0a2afe04c7e801f9a417c2734c41ede81c05ebfec25f89d4231d44e861dd2a9bfbc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZSu:A3k03kHRJARJr
TLSH
T152259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 969KB
SHA256 4f4c96744e188ba0fa07cb200c6c308ee6f711b015120750d5c1dfbc4aa706b6
MD5 9a0258e4da78bb5672efab6679692660
SHA1 adedb3981e78fd825d131573bf84ff57dddb753a
SHA512 4b6d078350b362174be97291f0a916a68bc1785de31c3ae6b6a535a90c6983637b1b64fad565a7bdd7360a46a5010a10d50d6452af64cb61e7ac3f54bfcd57cf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZMb:A3k03kHRJARJC
TLSH
T1DC259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 969KB
SHA256 669ae84d7af07b216e19bb645e38c3ba7c5064d468d17b4c0499207cd98bf4b0
MD5 8bd1ebc5e4c3193f3e9bff852762c02c
SHA1 d92b1057921e4099f1a60f4bcf824f01b17d0ae0
SHA512 3fa3064220397d4e177146b74a1ea40e116c845bae78619c6edfb6d538d09b5aae1ca1cc3246869faf2abc3df836010c2d1d895e39794ab8e663a8df29c9aec4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZyf:A3k03kHRJARJi
TLSH
T114259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 969KB
SHA256 1adcc973ba0182f36533379f88c4314b414c85ddaead89d121604d955d5cacf2
MD5 a431a26caf1d82e066a9fab099def198
SHA1 36d033db2a421932cbed88042704753f207c83f5
SHA512 eb171f066ad539158e0956959491dc311e03228c387316384ec931b908d5648b10e21dc814e541e9372f089ba3435b552668627b13ae8532991c4fb85c7dec29
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZfK:A3k03kHRJARJC
TLSH
T1CF259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 969KB
SHA256 080128a32f244a858bd7054de4b961a9b2994dcf8f8c46fcbae81c0712dd5418
MD5 bebe6d58b03e8a0bca82328da1169ebe
SHA1 ff9ef20ee63ba95cc7f81a0c5d6084936765c183
SHA512 c253d2e0c66179c7b62fff8f566eca8eb1f9f431f0d6f7e6ce9cad3b77a190239c5dd412f174f10a88b1f21964e6eeb023b3d9d79bb9c8c6bf19e0a1e663a80b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZ4k:A3k03kHRJARJX
TLSH
T164259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 969KB
SHA256 1b3f8576621d261d24f95021f3d299aa09d3702ef63f667a2546cf6b28fa16c5
MD5 5adcf8019e5dfc6aba6401bef26cda78
SHA1 b73ed79435b27c37ec3793da2155b563ea69a55a
SHA512 7681873eeaf84c798d36421a5d78fa78b0be279f40dff7dae3966a456f4bf65846c136a6fdce933890bce4405df9db1f56b8f183e366c5940511584bd06c233f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZ50:A3k03kHRJARJ2
TLSH
T1FA259D03F79800E8D15AC1789AA69A22FB757C56173097DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 969KB
SHA256 6e6ec138c3a5f48448ee4d768d6879239460ced9ec0077bd478a1ae9805ed95b
MD5 154802f34f08b99e5f32a6ec4a7756a5
SHA1 fed1ca98dfdd2baffe8c6fe459da1145e898f0ce
SHA512 67c60cec5f5ead68d401354d236cd441c7c05926155875643d2d8b6375a1572fe93b9675b0fb1a580d920f025b7f1b2c177135657416ab885a59c195f369192f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZsg:A3k03kHRJARJP
TLSH
T194259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 969KB
SHA256 57250ece26599aaabe3fbed204d910d0a5e00a19241fe5ffca53d6fcbcee14f5
MD5 d1fab068862afd44c6354a3677faf8c9
SHA1 e520bbea14c81473ad741fa15a8c10faa8caf4a7
SHA512 9ccd79024c369a53937a732b9ce6ad41ab3d9c00d0f87ef9d557be9d3c3c99baed4767a9226953a07d484c8c40aadc6a484da600e1f9efaf1791309faf8e8043
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZJr:A3k03kHRJARJp
TLSH
T172259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 969KB
SHA256 2ea55bf8f6e9a5d2517ce7b8f59d5599a6e60ea2d6368a7daca29794ada3d646
MD5 15af26384942f61dc34362861b5b1424
SHA1 2d925eca3dc18208d87d452b6ba8390efd79a4a6
SHA512 98e677c3d3c2cf12afeb41339db685605b2eec72f4a8d36d226439b45d82012eaa444d372f968f8ecf9b691461404235d1f704b4a6fba263807d4cce5664245c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZrn:A3k03kHRJARJD
TLSH
T121259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 969KB
SHA256 797f9156213a0ecc3c029630aedff77fb94815892ccd285fb52404e10baf8003
MD5 4f905588213f065cc5c315b018edaca0
SHA1 938a594b1cffc93f0cf02375f717f0bdf656952d
SHA512 ae987e75020a7ab2b9fccb2c9b7f789555b093aebc39e004c56e1eaccc8752cd7f874c413fcd4bbaae1231802049ddb2bfa47ee2d49b35717893cc8532408e35
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZ3x:A3k03kHRJARJh
TLSH
T1BD259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 969KB
SHA256 9505386177e2abea717d17ea092f901e86034d5312967461ef29fde2baacc1b3
MD5 453f22412f8346b0fbc8580a92b3e135
SHA1 6df106d40ea8a909cf3b12f1552f6dd23519c4b1
SHA512 e8dfa1bbe3c8f7f4767c30ffb95e28a1f42407044f99ae7aa20248c2dc7d17742bd2962007908031405da6b3981e8d75c78315739d5962675a97b6077439489a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZtA:A3k03kHRJARJO
TLSH
T11C259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 969KB
SHA256 b7453d7c063785de66f87b33dfd6cd24da50256a14fc44e1cd2cd492bfce4588
MD5 b45443bd5cd8675a1c5e9f9fe2feb0cd
SHA1 8dd139ba652a378ec173a9b659d95808857c84ea
SHA512 93ca88df8a87cec1cc747229789b3a06353bac5098aff315e5171eeadf2e9f824683425d6a782b8fe18bfa8724b5a9b478f3ca9292c6d54201d3871d86d1499e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZm9Q:A3k03kHRJARJT
TLSH
T105259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 969KB
SHA256 0ec4b06348f73591ebd391c59eb8232817f170b7de9560dd2edbfe8f158f9b5d
MD5 e0ccf553139d9135a39b88e48caf1282
SHA1 60f8bd5a1063ed87f5cc239a5cebfd35a76a97a0
SHA512 0b72f8dd28754a5736b86623937a198b3930fe8c91bb0c270aacd9f7c87f1c42bd918322a53c279d62588d5d792e09e9653a93c93fa9d86d212bf6a08c027d37
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZD4:A3k03kHRJARJU
TLSH
T1FC259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 969KB
SHA256 d17d1a290069c324c3c38948ba46a86aa63c1363c585d238d7da51904f96669a
MD5 128479caa985f5bae5072a322fddfb8b
SHA1 f753f8616e13df6c40f7bf6d1fd112e6d6fb0289
SHA512 d7ad94267a588faca3867e36dd22345e87ed7e79bcc27706b4466f958039d74cd2926ecaee7ccaf1d7254c4657115ddba12b46b8c5f352137b4660a0e5cbfceb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZqu:A3k03kHRJARJF
TLSH
T1B5259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 969KB
SHA256 5eda650341b10c3590a081cabf5a45f4504c2e24c161636b896f4a03fb1fe5ca
MD5 40a24427f468113f6c872bc7e73ce335
SHA1 b2a9a3491522d6bb4d048bd2bf110bb544c13467
SHA512 bc9b32e1340a437e75c0d15600f008528e6805582bea069bb4d4d7d974ae101913703ff4539fe07928b349a3e307e0a4b837213d0ff098f613472afa67f34d1b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZ7j:A3k03kHRJARJH
TLSH
T1B6259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 969KB
SHA256 8da31eea70d950d7fc8d8a759b599b110762641eecdc010c5570d7b5e8f6420e
MD5 b2ecea35e502539f54a26b591a2f125f
SHA1 b5d31bb9ac2b9b553c3f462c3af287f2afd187a6
SHA512 b0451b15cf6da4cc4b52eb9737eb71736ffec54f40a6c132c012189e8e2aef451fcccefa97fb24238e17b7e547395f599cc8098c4f897a4996a352ccd929ea12
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZGg:A3k03kHRJARJv
TLSH
T170259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 969KB
SHA256 4f39f61dbb62f3ee76c86bcdc50f1533b466a2f413cb83d1c6192d140636a294
MD5 ac004994f0315eb52b8ae25f641c2b2f
SHA1 3cef189aa8efdae4ff00e13ce1b0c3c3a82f06bb
SHA512 b6c0f3338cfad0b500aa15b4ae958d737b64fe38721fc45541fe079153b99a250e6da3a694e51c4b50a77493982f429259e896fc5b56568475b589ae4efc043c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZpI:A3k03kHRJARJ+
TLSH
T141259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 969KB
SHA256 cca56214b92951693e3e09f8e6ac86d6318f667a35d5c1c276bd7203ed4f1255
MD5 9637659d4237414f968f73b9165abab7
SHA1 9a46ab7dec1146d65584bb0bd5c8e681688033af
SHA512 7b1905e205ed55e909577934a1d0494c638b9f8703a146345d6fa1927debc8ea75de8532f4a7ab960310d0d48294f8a6518e03a9c875bcd30aeff5353ceca4df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZLo:A3k03kHRJARJ8
TLSH
T107259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 969KB
SHA256 6eebca22e159b8819f5015c41326be9f26ad383bf7895c7d8ab2146c9d5b956b
MD5 a6c149cbf2b06a62c6bb731177df2c7a
SHA1 c45a265d39d88c0b6c513290e5f249cda3dfa5a6
SHA512 a65d8f8dac79edb0b340ab107670f41b22d0fb164bf3acef49786db55a538032400e6d975c14cb715c667a2509e122d1882324a19557027e786556df112c388c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZw+:A3k03kHRJARJx
TLSH
T17D259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 969KB
SHA256 449433687ef99eb4d09aff94009ae2e03e9b531eed8e7c48177a5b5811885b8f
MD5 b561cedcf981f35860782d9f0dda1141
SHA1 0b5bf0fa13c66dfb1053419b0339daacdab88f8e
SHA512 bd21e72b1ace571bad7c556c27649a74e5f27c59907c569598c9590e56a8ac0cebb692a3e05f0b230c5e2a3f3fab5053500a6a6e13485f23f3ded5e900c765af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZIQ:A3k03kHRJARJx
TLSH
T145259D03E79800E8D15AC1789AA69A23FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 969KB
SHA256 dc99a8de0b029b669582caed5499aff6d42f068ba2d2a81dd79745d923c78660
MD5 6d9935f2930407b3ae3789ef7ed028fb
SHA1 26da6256913346f7ee5365d521d9a42aa0e39975
SHA512 34b3c8253b0cc7fb4ec74c9c7fcc972b108cd53066fa88c8785698f05f01aa82175d6edef2ff6f7c161f149d4d13c4777bbc4d6fcb35b94024c39161c0cf3564
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZBX:A3k03kHRJARJ9
TLSH
T1F5259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 969KB
SHA256 b10488e46cb1af03fcb32f1293a1f4e779a21cbffe1c6ef08df533bdbbc13b2e
MD5 722f03025d5af3c07dd0255cb4cd6469
SHA1 bd18a5c55e45e26ea0f61f69118852f55ced8977
SHA512 2bed6877887eea0f472ade1f74f93229255d004344df386479f1b8a8a2f8be58a52be0d0d891a514ffef1ca37528d13232ade5d4cb192b123fbc8ae96c3e9dd2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZ7L:A3k03kHRJARJ/
TLSH
T181259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 969KB
SHA256 1ffd918ed42adfaad38978d0214a3407aba4f1ae43f17f76fde3a82fc32f36d3
MD5 84814b417ce2a61c9f83b195ad14e5b5
SHA1 38118a40fcb5023c963c8b47c1e387caad2fc406
SHA512 44a33142d7bb764514245f4c668dd13fbc78619f4af176e42b99346384998bb71357bc9a56e1e190a4aa49ba726a2c21ba913edf0dc0f1003204dc49d48f1d4b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZBM:A3k03kHRJARJK
TLSH
T153259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 969KB
SHA256 ee96b733d03db97eb6abd56b9dabf68fb67504c85be720f2ff0363fde4fddd3b
MD5 eb092895d550760978044cd9a6e1d926
SHA1 16a9bd8f994350c2001fb3fe46dc7bd5d3cf114d
SHA512 88878d27fa8cb0bd7a6ad2dced696850ecc46da1412de5747ce3860a3b23c45a55fbd2249de6b7f48e052be2084dfbd54a25300d94eaf7c04aa7a6c362dc199d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERaV8CZqh:A3k03kHRJARJE
TLSH
T106259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3236-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3800-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3800-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads