47e0fe95fdb548228d5fdcb386a1af8799e5ff74c0fa4ae58bd5de4032767af8

Analysis

max time kernel
116s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 507KB
Sample260531-l322jset2v
SHA256 47e0fe95fdb548228d5fdcb386a1af8799e5ff74c0fa4ae58bd5de4032767af8
MD5 01bfa648626e1295901a4f9d21234376
SHA1 3b70c712bb3d1e0dd526af29fa626a65ed924d19
SHA512 7edd1aa6456148ce15a280697c3f74bd3ccbad669413bc6ba986a99945be92e645e80bc2a38f2a189309043f4d9c9bf5b2efed4705e3d726c9d2f342b1cfd48c
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Tu:A3ZUnXoZ+yPz5L8aEFo4VZu
TLSH
T1AEB4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236486262F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 64 IoCs

resource	yara_rule
behavioral2/memory/1620-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x002400000002b341-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3100-7-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000002a408-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028d63-58.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1620-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028d69-72.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3100-73-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289b1-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000289b0-209.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289b6-247.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289b8-248.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289b9-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289b3-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289bb-300.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289bd-313.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289be-326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289bf-345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289c1-358.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000289c0-371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289c2-384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289c3-397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289c5-410.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289c6-423.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289c7-436.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289c8-461.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289c9-463.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289ca-464.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289cb-471.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289cc-485.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289cd-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289ce-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289cf-500.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289d1-501.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289d2-502.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289d3-509.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289d4-511.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289d5-523.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289d6-524.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289d7-525.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289d8-526.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289d9-527.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289da-534.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289db-535.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289dd-536.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289e0-537.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000289e1-538.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a3f-551.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a48-564.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a52-578.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a53-591.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a54-604.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a55-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a5f-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a60-632.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a66-639.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a6b-640.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a6c-647.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a71-654.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a75-655.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028a79-656.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028c80-675.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028bc1-724.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000028bd2-737.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 64 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x002400000002b341-6.dat	aspack_v212_v242
behavioral2/files/0x000200000002a408-12.dat	aspack_v212_v242
behavioral2/files/0x0002000000028d63-58.dat	aspack_v212_v242
behavioral2/files/0x0002000000028d69-72.dat	aspack_v212_v242
behavioral2/files/0x00020000000289b1-202.dat	aspack_v212_v242
behavioral2/files/0x00030000000289b0-209.dat	aspack_v212_v242
behavioral2/files/0x00020000000289b6-247.dat	aspack_v212_v242
behavioral2/files/0x00020000000289b8-248.dat	aspack_v212_v242
behavioral2/files/0x00020000000289b9-262.dat	aspack_v212_v242
behavioral2/files/0x00020000000289b3-263.dat	aspack_v212_v242
behavioral2/files/0x00020000000289bb-300.dat	aspack_v212_v242
behavioral2/files/0x00020000000289bd-313.dat	aspack_v212_v242
behavioral2/files/0x00020000000289be-326.dat	aspack_v212_v242
behavioral2/files/0x00020000000289bf-345.dat	aspack_v212_v242
behavioral2/files/0x00020000000289c1-358.dat	aspack_v212_v242
behavioral2/files/0x00030000000289c0-371.dat	aspack_v212_v242
behavioral2/files/0x00020000000289c2-384.dat	aspack_v212_v242
behavioral2/files/0x00020000000289c3-397.dat	aspack_v212_v242
behavioral2/files/0x00020000000289c5-410.dat	aspack_v212_v242
behavioral2/files/0x00020000000289c6-423.dat	aspack_v212_v242
behavioral2/files/0x00020000000289c7-436.dat	aspack_v212_v242
behavioral2/files/0x00020000000289c8-461.dat	aspack_v212_v242
behavioral2/files/0x00020000000289c9-463.dat	aspack_v212_v242
behavioral2/files/0x00020000000289ca-464.dat	aspack_v212_v242
behavioral2/files/0x00020000000289cb-471.dat	aspack_v212_v242
behavioral2/files/0x00020000000289cc-485.dat	aspack_v212_v242
behavioral2/files/0x00020000000289cd-492.dat	aspack_v212_v242
behavioral2/files/0x00020000000289ce-499.dat	aspack_v212_v242
behavioral2/files/0x00020000000289cf-500.dat	aspack_v212_v242
behavioral2/files/0x00020000000289d1-501.dat	aspack_v212_v242
behavioral2/files/0x00020000000289d2-502.dat	aspack_v212_v242
behavioral2/files/0x00020000000289d3-509.dat	aspack_v212_v242
behavioral2/files/0x00020000000289d4-511.dat	aspack_v212_v242
behavioral2/files/0x00020000000289d5-523.dat	aspack_v212_v242
behavioral2/files/0x00020000000289d6-524.dat	aspack_v212_v242
behavioral2/files/0x00020000000289d7-525.dat	aspack_v212_v242
behavioral2/files/0x00020000000289d8-526.dat	aspack_v212_v242
behavioral2/files/0x00020000000289d9-527.dat	aspack_v212_v242
behavioral2/files/0x00020000000289da-534.dat	aspack_v212_v242
behavioral2/files/0x00020000000289db-535.dat	aspack_v212_v242
behavioral2/files/0x00020000000289dd-536.dat	aspack_v212_v242
behavioral2/files/0x00020000000289e0-537.dat	aspack_v212_v242
behavioral2/files/0x00020000000289e1-538.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a3f-551.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a48-564.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a52-578.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a53-591.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a54-604.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a55-624.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a5f-625.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a60-632.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a66-639.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a6b-640.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a6c-647.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a71-654.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a75-655.dat	aspack_v212_v242
behavioral2/files/0x0002000000028a79-656.dat	aspack_v212_v242
behavioral2/files/0x0002000000028c80-675.dat	aspack_v212_v242
behavioral2/files/0x0002000000028bc1-724.dat	aspack_v212_v242
behavioral2/files/0x0002000000028bd2-737.dat	aspack_v212_v242
behavioral2/files/0x0002000000028c1b-750.dat	aspack_v212_v242
behavioral2/files/0x0002000000028c1f-763.dat	aspack_v212_v242
behavioral2/files/0x0002000000028bfb-764.dat	aspack_v212_v242
behavioral2/files/0x0002000000028c51-772.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3100	patcher.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1620	2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
3100	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-31_01bfa648626e1295901a4f9d21234376_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1620

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 507KB
SHA256 47e0fe95fdb548228d5fdcb386a1af8799e5ff74c0fa4ae58bd5de4032767af8
MD5 01bfa648626e1295901a4f9d21234376
SHA1 3b70c712bb3d1e0dd526af29fa626a65ed924d19
SHA512 7edd1aa6456148ce15a280697c3f74bd3ccbad669413bc6ba986a99945be92e645e80bc2a38f2a189309043f4d9c9bf5b2efed4705e3d726c9d2f342b1cfd48c
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Tu:A3ZUnXoZ+yPz5L8aEFo4VZu
TLSH
T1AEB4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236486262F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.0MB
SHA256 a69b841112b74ffcf369d395c7b599e20c00e1e891652a23cbb49675286c7b93
MD5 e4293a847921ebf5777a2dc9cd1ff631
SHA1 01160fcebf21df853ec99363cffadc3013ee530d
SHA512 f63890cde2ca9e86768ce3f948e3f129ef960719258cfc698e97dc4990e456bc20d831a24482ad473abda46d61cf2159f182ce1ad2300b9360f406fd87b8f93c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo4VZqXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:A3mnXoZjzyaEFo+e0Le5ji0hmxNrM
TLSH
T1F3355B16F6B443B5D073C0B9C9D2A65AEA7134421B308ACB1395C7783F67BE19A3A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 554KB
SHA256 9237b346e49d98c9a746801d3253e33df15f5c6f7a3f8da67f13b99819443ff5
MD5 3906b25f5306d4c6861a4b625b5767e2
SHA1 b996d47dd7960f0435d3f96e4e918618e42a2f67
SHA512 c792174abdc81576955ae5af8f8766359129b60d37373e7666949a906b943034e82b14af5636f34a628aa17908548c1fdf0139134ddfdc419c4a4c4c1fb7acb0
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TTcr0X9:A3ZUnXoZ+yPz5L8aEFo4VZTb
TLSH
T104C49E03E79410F9D11AC2349AA54A22FB75BC621730D6DF236486262F73BD0AF3E765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 866KB
SHA256 a8dd64f193ead5ec969bee15063e3df0a978b7b1f5919c1ad18cd12385f14b5c
MD5 aed3b3c99e440157436dca1b33450c0b
SHA1 d64b525d9a46ebf84d7ac8baa3c483a8d4e60291
SHA512 bc1839410534e430cfc6bcd60db949e8fb279abc817b1a1af22b24ad6126d1db09918519f5d8cbac306d05b2d69d8b86a67a4f6d7d97dad38f95a19e7a2709cb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo4VZWAwSfxL/2Dc3jDLLmt0LDQewsAjRE:A3mnXoZjzyaEFo+raewsAju
TLSH
T12515BF23FBB090B5C27B49705B65C712E7797C210B205ACBE3A88A591F317D06F3AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 530KB
SHA256 9f986519594bec4d2f0b9697cad64f7e9a20ef187faad3992f8d31948bafabb3
MD5 030bdf4de83522564f42615bc6c31940
SHA1 2eacfc292c1f81955639bdbd65331a5b1ad4aa96
SHA512 29ac24f9f4529446d62555560cd5fe5ef02504b756ff16a346e67267235f2d0c0be00b6d768108f916db8161157c999a09b89ea121cadd40f332bae401c14c50
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TcJZ:A3ZUnXoZ+yPz5L8aEFo4VZ6Z
TLSH
T134C4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 530KB
SHA256 65e5ceb9430650af81092a4f18a3f0dc71f01a67c03508a1b658b77f81f62c9c
MD5 36d24a2bcf2ac5c9a64e9829c8b83fcc
SHA1 ee92a801ae982405e20d0d2fd7e2b4dfd1d657c7
SHA512 0bc330237fa0065844e0a7ace6e1a4027d76cf05d98c990b8efe35d97599ace4c9672de6dacc98998a7a8c89dce9cd22d67d955c4a12bcba120b74f51fcfc225
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Tse1:A3ZUnXoZ+yPz5L8aEFo4VZF1
TLSH
T1EAC4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 530KB
SHA256 59364e9ace8b398c80a7a3c5f8769f7b230641fc7fd369fe3035a504047ad35c
MD5 4f8816ac22379695bf8467b1e5b6b7e1
SHA1 251716ab55efff47130a70b629088e6222037802
SHA512 f4ecbabb26703844d92818fcbd0df6914080e623bb900c0c4c11f1793b3a1fdc679c494d9c6c705b35409068f2414fdf8d71b4fb31c64670ad260c072b287bc4
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T4E6:A3ZUnXoZ+yPz5L8aEFo4VZx6
TLSH
T133C4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 530KB
SHA256 e5e8027e057e5af84ab43097b996d2f8ff35f8089f94f020c25935e82771c890
MD5 f6adaeffd921d9dbc76fdb521f793d61
SHA1 139b6faf42b8d56448f372650abeeb6fdca467cd
SHA512 b15e4471d72280dc85c856ce7eab1733165a5d12b0499a20b4b378114affe8041b191e46119f0c1b3fae42e1a8fb9fa36ee1435cc2000250ee2cb4824d374695
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TGio:A3ZUnXoZ+yPz5L8aEFo4VZXo
TLSH
T1CEC4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 530KB
SHA256 7fea53339bfa7f2beec64f1616bd6e593d3fe0286dcb331ddc49a75e777677bf
MD5 835582c5ace35865d0b9c389a0e5cf7e
SHA1 1db24c55b68015c22cb986f90c57740ae5a3a5e4
SHA512 848a2b661e350bc30e52fabe1190782f9092305849bd61c69fd83fa586e47bfb91ca3a111f5bcd456032ea8fd858a05ce97bbb35d965316bfeb5fd9bcb7d0189
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TPTu:A3ZUnXoZ+yPz5L8aEFo4VZbu
TLSH
T12EC4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 668KB
SHA256 77b72840e6b38ab0376ca0f3372834e7020daec75998816e5482ecc6cecf6c4f
MD5 e83c90ee0a7d5b02eb6540c0da6d6705
SHA1 0987467625cea6268eecc324db96ed51848f4e3c
SHA512 0b8161309c321db5cba140370fc169db1aba93da5a9ec2a58fbbf187aaf65e6cfa06ffd394308105408f75c64d3c2d7ecfcb0caf1dc5a78c7a3a9e1c2c807a8d
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TIc+D/0vxBzv:A3ZUnXoZ+yPz5L8aEFo4VZIyPz5L88
TLSH
T147E49E17E7A120F9D126C23489A65A22F771BC7617309ADF136487262F637D0AF3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 530KB
SHA256 ebf5067e21225d1bb6c0805dc54b71602c99e296363c7a4229029e0f4a1ce500
MD5 0cc370b5cf6ce944760eb9590f745d7e
SHA1 c6bd89a24480ed3acd73464536ad7c4b774a8fa2
SHA512 b6f2d4550fd9adbc46cc5a8dba94245e60be259c04f9b0a42a7cbe8750b4483e5925b4c8c54c1c458a7005b7f76b0610f2e8a4325769d56fd7187433abcbeec7
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TwI9:A3ZUnXoZ+yPz5L8aEFo4VZJ9
TLSH
T1DBC4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 530KB
SHA256 afbdbcead128ce68a4ddd6a608183cbb3e3a590e9e454be4e8aaaad36d6ddda6
MD5 8b87560385519466c06eb46c0e4b56d4
SHA1 df97b5358d161c84b9e042554a569c33454599e9
SHA512 93c231068d3998c97ec76e77f507ec45f9d1bff2eba4781517905838fa2357e08dc19b7b4ff7f424bc1a11a9756a2a0bf423bf877ca6491015f383ca205af777
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Tlc:A3ZUnXoZ+yPz5L8aEFo4VZlc
TLSH
T19DC4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 530KB
SHA256 a9983b0ad6bc64e0512bda622ec3454e8418189478fac399600473b496ad36c4
MD5 8d01bf8b11cb3c0d6e791ad6b1fe0e1d
SHA1 a53882d06c9c387da4a873aec08353b5866bccfc
SHA512 d4250ace3b2d17708026c2366b54dca1951683ae22b574d9a339c9d626945649c8bc32b47e3dc696ebd4a41b33275f39e54dd499b06ff697629c90d7146ff0fd
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TB4p:A3ZUnXoZ+yPz5L8aEFo4VZep
TLSH
T141C4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236886252F73BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 530KB
SHA256 d404384e8478c2d338b558c8a8a58e90f375915927934a09472e07386e1bf6f9
MD5 6b48fceaa4f719d46bc2f31f3bf55bee
SHA1 72ce1263df24af6652836efe65812f739f6aa7b8
SHA512 2f739e87a99631095e686ef7ee93f66a45efc681a8d943ccb2e2b6a705156502ff9c20d5b0f323e224e3b15da86ee70cb40de3c975e54a3f8c6e648b2472135c
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T2Re0a:A3ZUnXoZ+yPz5L8aEFo4VZR0a
TLSH
T1FEC4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 530KB
SHA256 86117bb2df5436999873fdd3ab8a2d68cdd8aade3b103d4ccd822f21ebe9548c
MD5 695c9ef94c291b8714729ace72874104
SHA1 767bedf9a00f05736d89d3cfb5c6b511f173d8be
SHA512 e957e592941e8a53ed51a253051e027b4d423021ad36da69b3f45d29658702146ada13853e82d02f82897b23bc2744772cbbacc7653682f7506d478fc64cf51a
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TNxF:A3ZUnXoZ+yPz5L8aEFo4VZzF
TLSH
T1BAC4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 530KB
SHA256 abd9146629b5d453f98fd585a8555c68faa8a15ed55f41883cb68a8b1c92e901
MD5 d16f6af986eacf7496126c0f0154eba6
SHA1 8ff453c4980ae829fefcc52f494c01d691f21c6f
SHA512 9bf4dfdc7e13e1dec4b8e412732022ec858b3bd8f69f1c17b8bb39ace9ba0d96a1af976e9784ed54e0dc969a054861d37b76f0b4ba88d99ed6ee326654594cc7
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T8nC:A3ZUnXoZ+yPz5L8aEFo4VZcC
TLSH
T185C4AE13E79110F9D01AC1349AE65A22FB75BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 530KB
SHA256 c50f3a02f611b9f43577762cfbf0fd5e0edc3d464e06f3b501f8ffb526247484
MD5 ab5407b16493d6008810e22c89f54ffb
SHA1 3758f6451ea0286f50988272279cebd9a3958b93
SHA512 a4e7b94cf79faa6d42d16b6a29409f71b4bab3734899ae2388dc1559d01b4d6f2460c80e0ccf6fc9452da972f25d6b22c1a8cfe8abaed6528a405d6fa0bb9ca4
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Tmiw:A3ZUnXoZ+yPz5L8aEFo4VZ3w
TLSH
T149C4AF13E79110F9D11AC1349AE65A22F771BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 530KB
SHA256 8d5eff0fd14913bfb8a1feeae36a1637d9c774a38db017fa1fbbc6e9f4cace41
MD5 97155faeb5f47544f2e345dad53e5e58
SHA1 dcea176710ce4fbc8c7204c9994912e5f1a93fc1
SHA512 3b2ef1969f8f1e7f6a19b85896c317d411458735968d575584da7ca9a45f2c4dd5c0f6b16e8d1d01132e9ec593cb85deaadcd11fe13bfbdfc6825202ab2002ee
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Tx8T:A3ZUnXoZ+yPz5L8aEFo4VZmT
TLSH
T1ECC4AE13E79110F9D11AC1349AE64A22FB75BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 530KB
SHA256 7a9b8e6e8ca9feeaf284b0a56becc96bb22862b01d5ca6568cf154f4f58a9737
MD5 876b5ed83bd85f84ce86d0471aea6ec2
SHA1 d06e77c36c8375790f7ab74e1526f9cd867ee06e
SHA512 10ebf97aab3203dfe4d1a66daff9aff8ed072f14470fca5519f8d35b8c7477c7a395acd7257c6b44d28d1a576f010e7dc95235b0ec88c2b5fd98055decb36b2a
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T+nu:A3ZUnXoZ+yPz5L8aEFo4VZeu
TLSH
T164C4AF13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 530KB
SHA256 67e3640445d0a29cf7dd30e77dff6fb12a2aef53774f8d73d2ebd905f5abd208
MD5 479c8477cefaf067f3823c2d938dc73e
SHA1 692920bd60e52d6ddedfae766352e45cff88a9f7
SHA512 dac93225955e3ac30f3de52a81e46735cd85e6771298327a0827c837fb9acda4a41b2115cf46b6b3e9d0c127f4ea57aa2a6ce682c7744c556639fd0ab6c08266
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Tdeb:A3ZUnXoZ+yPz5L8aEFo4VZYb
TLSH
T1D7C4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 530KB
SHA256 9601187993f8100a6335f51c69b21d878a733676c0179c318c8b8c56374fb267
MD5 7bc4b969ad90917fafa8d86adfa30e85
SHA1 0da016023a2ef784f15fb905a490f71ed7d476a3
SHA512 ee7493c320202e2b50d0f5a25cc490710b6b1c2883918d10d0026879b03b7a2a56592da5dd4a590145b31ea27d52cd2963761be91ca14d147fabec90ca3d65e9
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TAhf:A3ZUnXoZ+yPz5L8aEFo4VZGf
TLSH
T1F5C4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 530KB
SHA256 9edeade1bd2cce1f269826e4d46a202b9e14e5688bad5b0b996bee53eafb6e97
MD5 19b884e19c5cc874fc3e6e0d5298ec4f
SHA1 d93105c798ae7f691e7df4ea2d86ec935d167870
SHA512 e6771dcbd9f941d263ed3b8f5097f2e3a1f36f21b615b7e4959f47a6a844287913a40ea12e563ee7a8bf4c6b113c8dd57e2914e2efbfa0e3d33de7b82303a121
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T+QPy:A3ZUnXoZ+yPz5L8aEFo4VZDK
TLSH
T19CC4AE13E79110F9D11AC1349AE64A22FB75BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 530KB
SHA256 4e48c36c25ac004087e77872faad0a47590d5926e624f6c7b4fafe8eb6e90a2e
MD5 9df01e5514ff160a0bdedb6e344446be
SHA1 58f84ed6f5f08ee9b089c0613f7e0844e8f8cc35
SHA512 c2453b73018e21e5c043b272fa2f3f543d4689739b74e1fdd14f3ee3e83c6ce4ffa99c2abf6726c75bc404ac4740918fa84582b416b85312fd611db09de0c356
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Ti1k:A3ZUnXoZ+yPz5L8aEFo4VZkk
TLSH
T135C4AF13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 530KB
SHA256 56dc1baf2746d5002ac7885661cf5298a7d8011ba4651787d6e8734a6335ba42
MD5 00c1018d35e0a1c97808f7d867657ade
SHA1 c1470346e51f03e149b180f5913c4152944d5a1a
SHA512 2c05e8a6c21e5b7e1b0ed30cbcab099144a82e74db5e20e85cc5a1cbd1705cf2eeca7bf818c83ddc2c7bf89257225cdb7c3e3c3cefcf35d325d2daef8d0e01eb
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Ty+0:A3ZUnXoZ+yPz5L8aEFo4VZt0
TLSH
T1EDC4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 530KB
SHA256 d85aa1da6496043d022a5dc866849c84c43a51fbe5287ca1f660c4d784363d1b
MD5 7ec96526d50de9fc6dcda2aa4341b4a1
SHA1 efff87b3bf9a602a9301b7f0b1977a1d2a44c8c7
SHA512 d6d1652cdd3bd0cf0075fe426fc32aba6d811537eb4ef219d29c844d8a2baab11a0e67996a0951904b3116571b4aa5cfcef0532bd77a4e8096f1e9b8fc1994e1
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T+J70:A3ZUnXoZ+yPz5L8aEFo4VZw70
TLSH
T1E0C4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 530KB
SHA256 14145097a29a229edeb30f9ea1ed281e96327fb2908a9d7ad09e5a56d7045f87
MD5 0a81a4327e37d1b33913a82786d6e11c
SHA1 b327bca885aef1fcc0b4cae8667cede7af7c0df3
SHA512 3c5ab84d1efd61e5593a9e26301d75e7027df6930ba7765efd1a6a56a4536893edb61012e0349fd447d3f95128f27c59575816a9d5f46ae14f7eec5732b648d7
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Te4r:A3ZUnXoZ+yPz5L8aEFo4VZFr
TLSH
T107C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 530KB
SHA256 951ec01173e79b446a5ef6d51ef76efa61d7f7fb087d73c10e43311c7c7b340b
MD5 1e94e7074471a0779f1bd64684adff74
SHA1 97297f061f291c15aa61b8593bd78215fe14c026
SHA512 62672c108fb2073fba3a65526da0047294fc77d192ddf4a0b71f99d8b3a361b07e74c60d8316ab5c9a0463a8b9f9c1eaf6d865e617e43b068e9ac25b78304643
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T1hn:A3ZUnXoZ+yPz5L8aEFo4VZPn
TLSH
T109C4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 530KB
SHA256 c1272f259ec553c8a4084551c3430a32cf39ac058ee34ce6aecface8986a2808
MD5 ec295a601b5921c67ca9cfee0476c65d
SHA1 45bc70ccc70386af70baf782f6173a8512c054de
SHA512 da6dd657f3666d8416fa67076565634bc3949255e165fa6b6a6ed89eaf5eb05edc389f01519957c4acc2dcfb6cf5b2ae75eb1cdf74dd7b8b52df89a41e304c2e
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TIix:A3ZUnXoZ+yPz5L8aEFo4VZ7x
TLSH
T15AC4AF13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 530KB
SHA256 f9fe18e87f0e7113b23a5ab13123c94bcb09f6974f8a76e07f8b78d6150aae2f
MD5 660c51391dc04bafcca830406396556f
SHA1 4d23994196851c085cea2d57ff5a55e3e78ae807
SHA512 6ca0ce9b58d6ec2fcc65d6a9fbec87595db66263ec693d1fabb705856d7134c1681a4fdb9694bf275499b8061e0c55bd5d73d53539b9ea8abc1bf104157c3ba4
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TYwA:A3ZUnXoZ+yPz5L8aEFo4VZpA
TLSH
T1D2C4AE13E79110F9D01AC1349AE65A22F775BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 530KB
SHA256 4014fbb6c99bda99abe41dafbc862d21f7f8dbced8a603af03c5c27b8c65b947
MD5 019aba11d7a6f5cc2468589d6f84db79
SHA1 4dfbc6aedcb4e844e4bfc25341a0fca82b50c805
SHA512 9fc864f476f5a04a13d0f9b45f22ea0a6bb5d95e3177e192650bdd810108e59e0123fb51c9fd68930960b822154db01a79f2f2cb1a80f40003ccf1247a25a882
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TBc9Q:A3ZUnXoZ+yPz5L8aEFo4VZi9Q
TLSH
T137C4AE13E79110F9D11AC1349AE64A22FB75BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 530KB
SHA256 b72ba78641baa25d27008745f83d2aef810e7f738882e9f4742f8cdbc183be32
MD5 fc9aec23ada4d1b8007d8faedd86cd33
SHA1 1f1bcc8a5e33ed883f2fd820e64210a27fa711e2
SHA512 974437ec4a62cd3f2a472ba75c5904ba7beb36567ddc770a445e90be79bc99c186c0c7b72050720d249c2cb8ebc83b4c2e50f680cb549af4ef03daca2c344565
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T1R4:A3ZUnXoZ+yPz5L8aEFo4VZH4
TLSH
T1ECC4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 530KB
SHA256 11485d8a2b2e823211acf321e5f13ed790216dbdc9f127df6188ad1bec23b82e
MD5 5ace67054ddecac47bfac91166af958f
SHA1 1bfdc0cf6b9b586d0700be3d02ca03789f5a27d7
SHA512 a250b0f4e9e4d46c47e3f7b081607fc88ecfe04dc2390d2d411cf145cc66fa127505cbd689d2fda2b1c579f2836b5e30cb7b9a3b084efa2228ffa918efc7dd5f
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TtAu:A3ZUnXoZ+yPz5L8aEFo4VZmu
TLSH
T101C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 530KB
SHA256 43c39b8202f455ece22724a0ce5b292a9845b23383f9e693a1807e53dae6d542
MD5 54d9e330596355560e44727be40d4da5
SHA1 d7347197cc54794d2eb9d05f658fdb4983d8d358
SHA512 8c43657409c2949fbf7d6d461c7ba2e206278401cdcf436303b321a394cf879ba129066467a6916e26521e57909b9d363f96998bebff44200d0e0023c4d19a97
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TW8j:A3ZUnXoZ+yPz5L8aEFo4VZXj
TLSH
T126C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 530KB
SHA256 6e335676e38b844185d5476386e1d4b92e05cd408d61501c7d773407654ab992
MD5 3b91341bc301cc0b38bfc0656e0f78fd
SHA1 c286c589d474de93a14ebe647958b2c4ac026181
SHA512 0a454f5d405cd1d0ebe27e4381a057aa32bdada593be59a88221bf6bf386fa376225fb51549e18134e7cef43ad4c6841df24fd59386d176cf795c8762bd48569
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TAzg:A3ZUnXoZ+yPz5L8aEFo4VZCg
TLSH
T111C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 530KB
SHA256 5d6d5d2ea9556dfb89062a22ef5014984134cb43a049e4178b3826ac962bbaec
MD5 acd648bfa73f3d853a5598c377219bea
SHA1 83b8f8e87a33b230e2f589c2f141e1fb9cbdef4b
SHA512 59398055ff9b54082d610cf489a7762356109a10da5e4fa2eee03bf785638317ccfc60cb296f929eaf1ff2382cc0a51fcf19efd8e7fbe704d5215757769c5845
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T7xI:A3ZUnXoZ+yPz5L8aEFo4VZ9I
TLSH
T1B6C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 530KB
SHA256 70fc65f822e0a0672b9255b79c4af65eafc36d867fb5366cee0bb1733230d363
MD5 e41dde1889c6bb74455d17f71829c704
SHA1 5d2eb401015d5104031e44770ac5f0011e98267f
SHA512 64189b0ba16771e9e0623beb7da0abb16d76225673d5f112da0a16e362206ff077a655818f3008becfdc6c5797a23f2f8396ccc3f7077f11ef4befdb4e8f6808
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Tldo:A3ZUnXoZ+yPz5L8aEFo4VZvo
TLSH
T1AEC4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 530KB
SHA256 c56702ea95374d7b2cd7c6b8cbb6eabb35762075a9a97b3409c2fe502b04f00f
MD5 4ebf8f02ef92f38f5f937e0123d4d796
SHA1 5edec150d772e4f7abadfffa88d8c8fe8dc817cb
SHA512 97e1b4efeac383aa87efe0a4b4e0a7c0262ca37ef3465a62f010c615e87abeaeba266b7add8068c58b9f485c274b159515130d3ae06c1059717cbfc9d3f65d28
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TLo+:A3ZUnXoZ+yPz5L8aEFo4VZ0+
TLSH
T175C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 530KB
SHA256 02725b2f77fd3251104f685c6015405025e224734e070b0df3184c9b29e6619d
MD5 9b727891d18c79f37ed8a3fed285739d
SHA1 6714d66d543a90074cf670d83a8aedb5ebe706bb
SHA512 c24d8c3f10f48482fdf40736c86f0cea9d0a0e290c11a6f69802bd28802a7e11c26712875a80501509838f60fd23b8b6956f023a2f21ffdc61e81c729b7b9c14
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5THcQ:A3ZUnXoZ+yPz5L8aEFo4VZ8Q
TLSH
T173C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 530KB
SHA256 db0a319dd190f082d2bfca1473cc5ee76a5ae05397be917dab8452d60e22659c
MD5 88d154b2e0a2657f3f228aae8f3c8532
SHA1 b4fa2a651743d03f7382df3f7b33767b3d8e0f4c
SHA512 b47df4dc1b57488f4b8c25de13f56c3ce449cbf11fda0ff96e28bc6a83a96e343674b93ad23e9962aa3e2aea760a75bd6995ae3b84970871af9b7f5db0c3c0e7
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TtDX:A3ZUnXoZ+yPz5L8aEFo4VZlX
TLSH
T1FEC4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 727KB
SHA256 bd95a106e71b98b6379d96993e9a81a53e44a2a7f5592e29999f877e222fec7a
MD5 c612e7ef77cfd96e3f253c864b07e405
SHA1 7fd18d403cd88f8b4a0ec143b1da63f914aa9e98
SHA512 99872d8cec1f045403c7f08882ca7c021c26ce93a584cd89d1bd1c6829a2effba34802ca39d485f1e00253bb545dcab8862ffb69cfc12880c0b9528223ee80e5
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo4VZRQ0dWCXSyCq7IwZ:A3mnXoZjzyaEFo+qjCXF7IwZ
TLSH
T1DCF4AE17A79010F5D567817899D68A27F7B1BC22037097DF539882262F23BD06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 530KB
SHA256 29b5de123491f056e3ed4f9d9e18867693e83c28d4a9aac52dc2b9534e7bec88
MD5 eeef4ed4eadd53b05805849afaeb9648
SHA1 efb2357e0f688807b40a3361cce6698743b2159d
SHA512 26ba08a9e4582141517a82e3cf4036548f70761db82e274999f176a70b41a695bd1d49e2e812f8ebb02059864a4a38e3c1f89eea7fb96544a0d04a2584a4b005
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T2eL:A3ZUnXoZ+yPz5L8aEFo4VZHL
TLSH
T154C4AF13E79110F9D11AC1349AE65A22F771BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 530KB
SHA256 2e1f230e3ca2335dca2f6bfb671ad5146302e8811f9abd12c4d4cadcf9122c60
MD5 fe6e4b92723cdc774b3ca81159913811
SHA1 7d106851207e108b50a2637c422363f53000558b
SHA512 fb41a58c28d4c7aa83c3a7831318f4046f66a8cf8707de4c3576b30b779445ac8a55725b00611fbc297bbcf1d3b5eeac09ecd1ac1bd80aa91c1ebf49b2c61bbe
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TUoFC:A3ZUnXoZ+yPz5L8aEFo4VZ9FC
TLSH
T172C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 530KB
SHA256 e7085ef70fa1678ec3cdc67d5c9f66b798afb0b5dd558fc325e74fd7fa16658a
MD5 20d6b3b127a7f5143bdc3d7e825c3668
SHA1 da4b2f39f24c6a54a4e6571b984b6ba3f133d864
SHA512 9f47d66571e85de6b2720e0a927695b426de807228c447a75716a0b0e2c925855dce60fbf61e8ef8227d8a520c72323e3f3cd138119271dff5689f492ea9984d
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TgRh:A3ZUnXoZ+yPz5L8aEFo4VZuh
TLSH
T120C4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
Size 530KB
SHA256 eeeb8266cda6fea0a7b58c4bc9e8de3f92508c48a9736ea8f99749c723878bfe
MD5 cc943cb42aa3b611a27e91f51242edc3
SHA1 f26171fa8587c37f75a3ddc02cf639fdf982a4f8
SHA512 fccf7c458367c83a8eb28e8a19b8a3e1f722679aa724c49f559210b1916f1847fb914ca803ba6e5a4c5083765c42d2589a2dbb1e44b005c16f06feb1fa188c41
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TDij:A3ZUnXoZ+yPz5L8aEFo4VZ2j
TLSH
T1D2C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
Size 530KB
SHA256 974102c6249f9bcdb5d51a70a5b8a9162dfaedef623a02230e515a6169bc0fb7
MD5 f599a794029a8a649930c3b8b770351c
SHA1 9bc479fa0d4268d377eaa8d5b9b6c6a1575a1d0c
SHA512 b678a4e5dc92e3b464f3fdcd9e6c70fc4c09032b96d7778eedafb187abd24a08ae7df7a46b74c5cebf68a8544a93579a223c7cd36f2a8b242a507ba2d11f2e12
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TWJ7H:A3ZUnXoZ+yPz5L8aEFo4VZo7H
TLSH
T192C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
Size 530KB
SHA256 78e4b309634db2f8de07382a62a4059fc0784b30438af14027edbb9472dc38d5
MD5 622d4ec74d6b9f0cf2fe0844eec42656
SHA1 74580124555106dad945cdac227e9d9a159c5bc4
SHA512 e376c4bb3c068d23e1c7e1fc68df6442b34c01adef7f9b832a8d8303099916d12c18bbef8a22ed3cc268e041de8ee8625ed0d42968791e147bdaf78eddb33e45
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Tz4d:A3ZUnXoZ+yPz5L8aEFo4VZEd
TLSH
T1D9C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
Size 530KB
SHA256 62a5ab970224575772231b77481eea801e472b10ec17256402e80dfd1961e9a9
MD5 e1beef4641dce311d8446a311b9d3f0c
SHA1 ce0619f2e7af064d54417cb4f39fc7bc7a750c52
SHA512 78ef396352d8e32595a32b1c97dd891731bc0566ab7825b35b73c6c3c46193e32595f34f1f1d8ef8b60c2930527c2448266398b877fd0d9312459b6192a080b6
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TahM:A3ZUnXoZ+yPz5L8aEFo4VZQM
TLSH
T1F9C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
Size 530KB
SHA256 7343ecc9b8160078f2a2e586cb47ebb571ef32a6f31b03bcfd4d220e6d9e1080
MD5 2124be137da6a455cfecdec1da4d4668
SHA1 4aa81a3a0805c103e1e315f78284c4b074eabaee
SHA512 1882009e3e4a47ba28f911743b85ca3e0bea5bb7fd6ce585c3d95b0b8f44adb3ea551479b6d699b2e2f1e005aa60ba3b8656176b962b9c443086c71ba621a756
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TyiW:A3ZUnXoZ+yPz5L8aEFo4VZ9W
TLSH
T1E0C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
Size 530KB
SHA256 39868398826338c32f0c11367b61da77129cd963ec0ec5c31b275405f6d8ace6
MD5 db1aefbb054072e3f2e31d1a77efec24
SHA1 b97d175df168eb0a20b32b5b123295945d4932e8
SHA512 b6f9325a04b0bbf860ef478b697d9c3d105f08479320aedd36913295b69291443b0dd48fcb8b53cd3cee000f3cccd9b84b0c649ab65b748f556ff4507439dda5
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TXc93:A3ZUnXoZ+yPz5L8aEFo4VZs93
TLSH
T104C4AE13E79110F9D11AC1349AE64A22FB75BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
Size 530KB
SHA256 13467719bf67c3465f9f33ec6f43a47652dbf1be712f2b7db6c3e57dd8406d49
MD5 d3767fb75a1ea2a73f1717b71d9ee39f
SHA1 b8373e971eb9a1279981e8d708c28ed8d7822a62
SHA512 94eba4055a302e777003597a86a91946e0e995b29ff4feab1e41fc776f3e4454b7fc78cf5423bacb16b0d1abd19125043ac3a9251a5072f00a26de2253466f8e
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TER/:A3ZUnXoZ+yPz5L8aEFo4VZq/
TLSH
T175C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
Size 530KB
SHA256 6bae23d3077cf0e2cfa9b364319976d8df09fe83c883d91b08d1482af8f035a1
MD5 75ca8e22db0fda93d68df4dfac86523e
SHA1 c38dc5ec731b16d5e3e122707418964bd6255567
SHA512 3851d92ca6ab4fcaaf04dad7a60f5599579a8b7dc516eb9fe73c1822ea4f7e5bb684d73e896b4cb7f4468f547d39e445c4d80f3d899e4eed653d090a4d75b947
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5ThAa:A3ZUnXoZ+yPz5L8aEFo4VZqa
TLSH
T14CC4AE13E79110F9D01AC1349AE65A22F775BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
Size 530KB
SHA256 ef65ee0f6f5c9488c513b785531b5dc1e41dc0d559123c781fa729e2dafc9e6e
MD5 9fda84a1fdb85cf08683ea739562dc80
SHA1 62d6ec5db77d509660572abe9c471c0ca87dbbe7
SHA512 29453f2473a59b10427c5ccad8b9813c7359c3d653e9f22e5b007bba065e2afcbca06780df7fd4d5001c78c1fd003b134f99ce1becf68c67b3ab04ae393f2714
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T8zj:A3ZUnXoZ+yPz5L8aEFo4VZWj
TLSH
T117C4AF13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
Size 530KB
SHA256 fa37b2f190410f866cdbd07687d3a064c62d07c5f09ba6d239ccdd4c6135c3ba
MD5 56a3b1b6160dd4212e47897b5894a65f
SHA1 77cc464a17a40a6847d969a3ab14cd4255d57d05
SHA512 3bfaf82afd318574f7a0b7b634ab8892327d2df8dbf362b2c2eb1ea9fc911980231f78dc8555057a78021548741ef056580aa0607abb93924506e3374768ee9d
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TNxQ:A3ZUnXoZ+yPz5L8aEFo4VZHQ
TLSH
T155C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
Size 530KB
SHA256 53cbded283d4c091f26d93cda1a75d4ae29ebaa333e7205712321111d7603e59
MD5 6b217664d882db4156213d4560a12ea0
SHA1 2108021acdc23a6d9acc0b3ba2e57fc420c352c2
SHA512 cc347dc7d841abf824cbcc023b075fed7e7ee38bc0815e67f732f7513a0e694f0bdf741cd13f5b860e02c723585b618f46d5629623c08e66d181e0f77f9eff34
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T1ci:A3ZUnXoZ+yPz5L8aEFo4VZ+i
TLSH
T1FBC4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssvagent.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
Size 605KB
SHA256 c55ed7c7892bfd8b08acca65c9b16187bc7f311af65436a4047ecb64a82c26e8
MD5 7ffbe71bc49f2104eb86af979fc2ef7b
SHA1 a4e9d532258674b6acab650f0092331cc5402d06
SHA512 a6b136dca05d572ca0a3c5fcd8b19cfce18b0b9e50b5dbb4d7037710fb88bae10ee26ca55adf4faf919d3220c0d5c77a0fa8fad851d7b38635f31c2d3eaefa4b
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TyQYfgg8qdB9:A3ZUnXoZ+yPz5L8aEFo4VZyQYfgHa9
TLSH
T1BED48D03E7E510E9E027C2349AA54622EB75BC621730DBDF535486162F72BD0AF3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
Size 530KB
SHA256 6141700389dd3b3676aff261c90100dcf50b04ed1fb1b2e42f4ae566f7ba9d4f
MD5 1486a48307d270bce98223dfcae3ad99
SHA1 9271f4b8fa6ad9c875333dd4dd9eaf10dc373be8
SHA512 73453424c235f8e9fe42c162d4a962fc17db201150dca01ba4328f0c33c3ae2c4317a2028cbf086728a750ad908a000cfb0c31df2fa41256e4a5e71beebacf24
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TgD9:A3ZUnXoZ+yPz5L8aEFo4VZk9
TLSH
T114C4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
Size 727KB
SHA256 f6c252ebe37fa2723f8e60b787e1382c236ddd3eda54f7fd9ee8131e24be1101
MD5 feedb28216e914283471ab283cf6a740
SHA1 1b81db760d22df0776e37cbab20e50a01ff4b0b6
SHA512 dd7d4bde223674966e4b99ae47e4c469fd7439ab05acf6e99b213228ea128ce89612aa84b19330aef5c6b21871fecdb025592b7573a39d1853d02711ee2b1d1a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo4VZsQ0dWCXSyCq7IwZ:A3mnXoZjzyaEFo+9jCXF7IwZ
TLSH
T1A5F4AE17A79110F5D467817899D68A27F7B1BC22037097DF539882262F23BD06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
Size 530KB
SHA256 c5bea59379077e97df9048c4d0c2e16a401ac87a2666c239a9970de2f14116a4
MD5 32e11d32a65a31a2bf210179e0e97eee
SHA1 50c112e57aa60f1fe804894abb42d9d1eecfbc62
SHA512 0aea7f97a85722f64f7dd1eea6da11192ceddff1b5fb599f5eb069705586b21e5a0a3d33b82fa74d71a46554f603c994c4d0545323e70d6082a1967a638fe8aa
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TgEM:A3ZUnXoZ+yPz5L8aEFo4VZJM
TLSH
T1DCC4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
Size 530KB
SHA256 42b90787da73878adc076d25b2cb4a90b48f5e57548f55df10a18b946a86ed45
MD5 3e12ffeaae37928ad8bc7402967a6f1a
SHA1 be0854198995c3d7adb5924d1dc41c50f6546977
SHA512 e8182bde8a0379d98b6672ed5e12be59f5ef28b7014981e7ea2abaa074806e96fc09e0e4c0105aa1ac47c55d2262cb4e60adf3368e50b228b45fca24b3d111a1
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TCJQ:A3ZUnXoZ+yPz5L8aEFo4VZ8Q
TLSH
T10BC4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
Size 530KB
SHA256 cbfbcf1a76e7e7150359fee411d305654778d282e72b5f5746b2c3ebcbc40c0d
MD5 d57caefa73ca2eba047452bb00183f8c
SHA1 3cb71ce2f7374930b63d3dea3fce6289573d9de7
SHA512 e8d816a62edbd88b637af75fe6401a13b87e20edead72b29e299031c33193ecb5aef7c6b102441e1d2079ddeeab2ec4af1cca84d0935ebf72c532c9eb8101d40
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Tl4t:A3ZUnXoZ+yPz5L8aEFo4VZSt
TLSH
T1DBC4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jre-1.8\bin\klist.exe
Size 530KB
SHA256 7a7e20416ebce7aa96a25750b3c762372d261092ed193d2a3226fc2f6b31de06
MD5 fc559b0b7cef77611eeef9eef9b0f7b9
SHA1 7d84e1bf535cadfcdf61b03620edbd74e7aa3318
SHA512 9f4496ee33f0fd54b87f020005443a8b4b46b3318c17c0760bc567c1d792c65307a21a3783b6fafbe4d42aa4d64384254ff1c83eb87c77b1087c8852e170fbb4
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TFhQ:A3ZUnXoZ+yPz5L8aEFo4VZ/Q
TLSH
T1C0C4AE13E79110F9D11AC1349AE65A22FB71BC62173096DF236486252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
Size 530KB
SHA256 5efe2291ea6f479dfa9a0c0084642210c0aa2a0a69ae89852e31918837a6df3c
MD5 5ddb863bd6baf60e6b29b2381464e984
SHA1 1f791851c10de28507a41ffac39ceb790a4ac4fc
SHA512 eb9ddd3bcb84565c52392fd9d3384e21c04165d86856f85d264142e3830fbf6053a72c3835a57cca974371f17a8608b107cf0f4dc857b7b0e602ecaed893a2b3
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5T5iV:A3ZUnXoZ+yPz5L8aEFo4VZMV
TLSH
T1BAC4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
Size 530KB
SHA256 1013e042d47b1205333972ce5ea16bd5c6a3878dfd227e25554def792d8b6e90
MD5 5b3f84665dd737ddfc7b59606308dba9
SHA1 385d531639ffb5a5e237c7261d741a2a4b2689dc
SHA512 491051db25779765209a0d3c32ea9e2e75b6da02268c747c064d532807107f18b2142872de618fdc6ba566a63e63c84e7db56368c2dee988343cf89e1b89862e
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5Tac9O:A3ZUnXoZ+yPz5L8aEFo4VZR9O
TLSH
T198C4AE13E79110F9D11AC1349AE64A22FB75BC62173097DF236486252F72BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
Size 530KB
SHA256 530d122cfe98096562083f44de104174fe3be56a1dbe82ebbf4cd2d0fc8b7bcc
MD5 70fe4964d6bc18cfdf9866ddd14840fe
SHA1 15f919e90031ad69bf4aa4f95eab3975efc6d8c8
SHA512 5445aeb68e33b56dc89bad1339b190d44c7498ac140c68b465198b8f7e8ec3b57c63ed18682f3ad612868d170ae6246f02b67b18abe82bb61e959e5be2804d77
SSDEEP 6144:AQYzNhHynDm0K5eKQk2c+D/0vxBzkiLz9unaEWVC9jEmuSiox6o5TIR5/:A3ZUnXoZ+yPz5L8aEFo4VZ+5/
TLSH
T150C4AE13E79110F9D11AC1349AE65A22F771BC62173096DF236886252F73BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1620-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1620-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3100-7-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3100-73-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads