0f1c3a9f7b08bc9d69e78d7651a688e7e919c4c54cad4215f5237afb7d9ab29f

Analysis

max time kernel
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 14:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 871KB
Sample260629-rj8ymsg13k
SHA256 0f1c3a9f7b08bc9d69e78d7651a688e7e919c4c54cad4215f5237afb7d9ab29f
MD5 8a841a805bbd3687a65d36688d126b9e
SHA1 7793b47e1d78e9eb8c45d29cdccb66ea8ed26dbc
SHA512 cd26713641bf49ac4132fab964184aec3ff42af1284594dc7c827c7e57dd4fffc66ebbd98e0682cfe5e64369c130560966020fc35a4c679f6662e839da21912e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDL9:A3kMGT1LljG
TLSH
T13A15BF17E79014F9E9178138C9A64A22E7B1BC260770C6DF136896262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 52 IoCs

resource	yara_rule
behavioral2/memory/6464-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c6cb-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b4-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c7b-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1516-60-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6464-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-199.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-208.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-227.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-246.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-267.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-304.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-347.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-439.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-453.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-484.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-486.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-506.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-513.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-514.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-515.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-522.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-553.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-590.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-609.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-616.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-632.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-645.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-646.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-653.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-654.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-655.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-668.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-687.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-724.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-749.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-756.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-763.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-771.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-779.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a4a2-1034.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001a561-1090.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019e0a-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001ac41-1246.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001ac3f-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001ac3a-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00020000000066ad-1884.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 49 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c6cb-6.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b4-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c7b-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-199.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-208.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-227.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-246.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-267.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-304.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-347.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-439.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-453.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-484.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-486.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-493.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-506.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-513.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-514.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-515.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-522.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-553.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-590.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-609.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-616.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-632.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-645.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-646.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-653.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-654.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-655.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-668.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-687.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-724.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-749.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-756.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-763.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-771.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-779.dat	aspack_v212_v242
behavioral2/files/0x000300000001a4a2-1034.dat	aspack_v212_v242
behavioral2/files/0x000300000001a561-1090.dat	aspack_v212_v242
behavioral2/files/0x0003000000019e0a-1128.dat	aspack_v212_v242
behavioral2/files/0x000300000001ac41-1246.dat	aspack_v212_v242
behavioral2/files/0x000300000001ac3f-1368.dat	aspack_v212_v242
behavioral2/files/0x000400000001ac3a-1401.dat	aspack_v212_v242
behavioral2/files/0x00020000000066ad-1884.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1516	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files\UnlockExit.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_90781\javaw.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6464	2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
1516	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_8a841a805bbd3687a65d36688d126b9e_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6464

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 871KB
SHA256 0f1c3a9f7b08bc9d69e78d7651a688e7e919c4c54cad4215f5237afb7d9ab29f
MD5 8a841a805bbd3687a65d36688d126b9e
SHA1 7793b47e1d78e9eb8c45d29cdccb66ea8ed26dbc
SHA512 cd26713641bf49ac4132fab964184aec3ff42af1284594dc7c827c7e57dd4fffc66ebbd98e0682cfe5e64369c130560966020fc35a4c679f6662e839da21912e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDL9:A3kMGT1LljG
TLSH
T13A15BF17E79014F9E9178138C9A64A22E7B1BC260770C6DF136896262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateOnDemand.exe

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
Size 970KB
SHA256 5e55f398d6828614abd627bde8ed375d5f6322a97e5feee88dbd6dc37308dd6d
MD5 aa01264f760d5e19600459ab7a7e642d
SHA1 f6b452e3b3927595c7aeb9ba6d147503a940ba45
SHA512 825c036e5bfdae18ad1d8da62addae646f9d6b65351f9b9977fc45432a68acaae8ed3498ceee4410f7a758c55881afc1c683f640ce589fe8321381097cde824b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDL62MqDBxc:A3kMGT1LljcMqlxc
TLSH
T1A625BF13F79014F5E567813489A54922EB72BC260B60CADF23A857261F337D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 4f3cdf713a2ff41d39631cdaae3ff16c82d93b92370649ef11ae77dfb62f4caf
MD5 f85b55e2966534d2337b3116d87f79fa
SHA1 6611f99007f9f32a0c4bcc8c543de697c39e3866
SHA512 fe14392d4a671f007e2ed21c5519bb1059bd0f8c9de08789a3a3635ed52909636a2f81e7224ddeb2bab3305543bd8b17e5739f16cd44b09835b876ca05b49193
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLJ0Le5ji0hmxNrM:A3kMGT1LljGPji0Aj
TLSH
T10D658D16F6B446B5D073C179C9D29A5AEA7238420B30CACF1394D7292F337E19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 919KB
SHA256 225499346e5964923b5c04a1252a693fdbfa8d55e52ca78c5790ee37ac06c20b
MD5 9c72f188bb64d584685345aa394f412a
SHA1 97b15660bc1d39ab501055212bdd83be3858b7c4
SHA512 335f4c129c02160e833770c857e206b826bfa1ec76aac2c29fc085a044446abb6b9d735d1f8f7834ee4765047fbd9c2845cfa65d4473b25e2f87437d30be8dbf
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDL4b:A3kMGT1Llj7b
TLSH
T14A15BF13E79004F9E9178234D9A54A12E7B1BC661B70C6DF1368A2262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 895KB
SHA256 b08d7fc8bdef19d247e8c7c101a9aa7e1bbbd976258a6353ff51038a751b38b6
MD5 66f46d06431980759f408f657c72190e
SHA1 eaaaa08672946332712215a454b82fabd20dcd48
SHA512 e724df590c02e7d415441f0931e74f17bb4c2f0a8915a5719870bf004a63e1038eea3be5dd6d60cd2eb2e66b383b5a0b7fbd68f3ca404582b8efaa89934a6d65
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLjZ:A3kMGT1Lljk
TLSH
T11F15BF13E79014F9E9178134D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 895KB
SHA256 4b8593379ebdf33ffecb983002246b855588e2ba134a64f4d6ed10514b3886e0
MD5 cf065cfd695bd653dc2f94c84b2e8f50
SHA1 25f4facd7111e3773b81051c0eff2501d63e6154
SHA512 5ce1988c033bcbc3404327284c9fea84414286289074b755fcbaa05d2f2d7d9449767b7d4b7c78e0f228288d7ff4e31d834607cf50d4627cfd096f8982c76a57
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLY1:A3kMGT1Llj7
TLSH
T1FD15BF13E79014F9E9178234D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 895KB
SHA256 97ad13e05109c1fb306a71f31643d1ab4f992c4c0fe4a941a8749139f45d4ff4
MD5 eee78dc0bedce45385cd6040ef5968dd
SHA1 5ba493809bb138ef3e2bb6925a2050444b25a9cd
SHA512 64c1b37c7bd9ced47c504baf47209042222246d54b2c7641ce576fa389a70b1a27998ea374d82f50ef27ee18f73ad87a03cb34693ad6bc95216ad4dcd1d60d4c
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDL66:A3kMGT1Lljw
TLSH
T12E15BF13E79014F9E9178134D9A64A22E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 895KB
SHA256 e5f93ac68893c76c0046177100035bab761bd99d0a7a3f218c71b080b85dda93
MD5 bd512b89122b1912acc1e65499ecf5f6
SHA1 7b2ec9a1295d144b7e306c3737df3b90a6280228
SHA512 8e9d09b8a663135481f708bd490f41ed380d07fc64039164aa21f542aa7066842260faa84bdae5209d21f764c591314d7dc1b939bc210e14470a4d0cc7e2ec58
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLyN:A3kMGT1Lljt
TLSH
T19E15BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 895KB
SHA256 784b6a26bb0706608441403fdf637f52ec7ba673b95cf00447df11638cc42868
MD5 34c04998e8483cc98b5498f81c12dde7
SHA1 6efb00cbc1684e95cd1ec45f4f4ba638429afe76
SHA512 f66edd113dc09e1775ba8e39e11c8a97ede1be61ed5817da7d6c4fb74a90b92373a1e472636ed7eff3fa5247b1a730e2ee7dd41fbfddae5a05e81e728234fbaf
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLof:A3kMGT1LljF
TLSH
T1F315BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 895KB
SHA256 261485262f1f6d675db733bcec8db0fe6f0b2133df797a503495fbd681086e3a
MD5 2ea84fd2a6052a3e9cbe45adc7b0e1fe
SHA1 83f5a3a6c7b26f075152656e8240dd305287e276
SHA512 12077e655489e5c1d38f0245d6b75f78843c3361cd3cdd1cfbe18f675347f5e5750c9d9f2da545623f26001bae8d9cccf4aeccd2edf86c261998e6046025c133
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLCo:A3kMGT1LljQ
TLSH
T15E15BF13E79014F9E9178134D9A64A22EBB1BC261770C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 895KB
SHA256 816c1169744338207cb11282c61f4d92c0cb94a08527046307deb1bf8007be17
MD5 02d63461d36bf03b11345688ec3d2ec1
SHA1 b6f1de533637a81e1a648520ce18d9e75e32e3da
SHA512 d08913d239021ed5dc1df24b15aef901731050eda8697af3c95c72ed3d58110009bd31cc513fdda25b1ce833bc929fe9687959f94c6e7590204b280f0c37d3ab
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDL2u:A3kMGT1LljS
TLSH
T17F15BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 895KB
SHA256 28be219a7ee002a12a6acc95b75feded68ce30f5089fe13d25dcc7a987fb2809
MD5 069b4cf41b163a3eb552ac55d6f60b94
SHA1 49a4e3169466fb8d6f4cf9cd93c8bae8b0f0bfa7
SHA512 01f52fa73fd6be87eae5ba0740fe4100304b9dbb81a9251c9b671e7149aac63dc773d55b831abc1020014f436b37aceee22ba090dd1e303c7cfeaaacec3d1b02
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLq9:A3kMGT1LljT
TLSH
T1F515BF13E79014F9E9178134D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 895KB
SHA256 c6a32c3fdbafde20c958dc8dc51e1918e2bc78b5ab2d4de18b46fdad0327e14c
MD5 35b6e4f873ff876b2fb5c89df0c792e5
SHA1 85fb2e1a07e256be53403d747561523aa6c850ce
SHA512 b2e8b01bf2022596a4e76706c8b7e5b7efea502b74635992382829fdceb6f0a95e0301da729d96266b5febfde3cf8f0d769f74af689bd25d4e1c888e58a1d0c3
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLqc:A3kMGT1Llj6
TLSH
T1FC15BF13E79014F9E917813499A64A12EBB1BC261B70C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 895KB
SHA256 015fc85a39c8fcf295859d8d31a98727316ba6e0a240c8645bfd9e019b85bda0
MD5 9b12a1885d4859f015d6d69ef7553e9c
SHA1 b35fb4c8d7a623b09943c40ebf4ac69663ad5a95
SHA512 9d18dc898829209779f9517632626d5b47d3fc270f9c7a99b76e67775736b50f3a97ba574da4bdbfb9dfb30ebd9c97c376ce75e41ee8d9627dc4fd68fe0512b0
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLjp:A3kMGT1Lljg
TLSH
T16F15BF13E79014F9E9178234D9A64A12EBB1BC261770C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 895KB
SHA256 d001d8ec534448bf5cabe38fcdf69eb659440fc5e3609f76e701523715d44aa9
MD5 c75d4be8d5da10862da86a6fe90735e3
SHA1 6838d45f749a7570268a39ab861e47787df847e7
SHA512 89f24d9b5b567aeb701ef9e1283c99081344a23bf3b1c0666a63b0ba4d48395c74f87c2452832d3d5bbd46281bb010b6901f93bd6a831693563261909903059f
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLEN:A3kMGT1Lljf
TLSH
T15415BF13E79014F9E9178134D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 895KB
SHA256 277d2bd8ed5b3b987f24a2b9fb6d000311bd43e396223b1e0ba7b61b66e411b7
MD5 4a7b0e4153ed6e87ef058f20453b6561
SHA1 2afb80648ca7a9b2d0034d75713ac26826a2561a
SHA512 62046315595e4f12984171261cf3390c40a175b2285d27705d41afd136e0fda93860895e1c2dab747f83a7adfb4859d53c1f216cdc284c42677cfbc749504e26
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLsF:A3kMGT1Llj5
TLSH
T1CA15BF13E79014F9E9178134D9A64A22E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 895KB
SHA256 a45f6e0422939b17f341690b1e72537aa81e3b16228fd2bce1fd7bc6f9458f18
MD5 9d527c75e63e2b95c58eaeaa0a764e8d
SHA1 5079f4d603a95ad2dc397ad8cba34c20538c5874
SHA512 2eec8bebaa146bd3a0e46b3d5f27ef7198b0d45ca1db5d99514c8aee682db9a484526dcc101ab95b252874027fca426aebcf6fc6cf4ac0fae3442b87b1803a8b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLZC:A3kMGT1LljF
TLSH
T14815BF13E79014F9E9178134D9A64A22EBB1BC261770C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 895KB
SHA256 bc55c47b3295b41faeec227812f87cc45c8d7b323d0cfd1efedf8bbedd632cc7
MD5 95f73468e4af4be54f53ddbc3ab7c8a0
SHA1 58ab25363071dcab7576291948e7d289193b31a6
SHA512 91011471113fdbc805b2a6d074cc616aa4eb42aac887b8bbc82b8f806b1eec68ab1869452bd6ad99bbb7301f80ea632018d5bd98024d1114b3b9bc63a689c2eb
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLaw:A3kMGT1Lljo
TLSH
T1D615BF13E79014F9E9178134D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 895KB
SHA256 53828667810e72d093088e21a6ed61b8a3ade805396ceae28cee7501d427e8a1
MD5 e49a695611bbdb10fb525134b9ffb250
SHA1 0506638fe5e432f2c0f1202a817e41d75e79f0d8
SHA512 2b8695f6712674e2e012394cb557b3e50c91c9d96b6a5348aea72dc8c4a590658d320f79a7b7525d163d5f33b0154a912f66f89f2576dd36a510eaba0d0115b5
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLhT:A3kMGT1Lljg
TLSH
T17015BF13E79014F9E9178134D9A64A22EBB1BC261770C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 895KB
SHA256 840b1f5777ec9faa19275b1280660d3fba0e35ad3ca85221dcc7ac5111888df6
MD5 803c8dc3935396f4f433b4dcb5ba6b3d
SHA1 ea6153e3df89ed01f2329d910d06e6dcc722f36e
SHA512 7c943822979c7fa012deb6a221b61817e7075e8642943360bd18161e575f66d7bd104580ea041c557b8b314f8712b2bed00f6ebd5cd6fdb88e289c979fd94ef3
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLPu:A3kMGT1Lljf
TLSH
T1D915BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 895KB
SHA256 3c2dcdab4271d87e917ea83d2b5af10175cb69557ea2f4a54be1947d930dc404
MD5 b3165736b06fc2e24d8a4550536213c4
SHA1 8113d491cc043d65f7093f433129dca159d0b852
SHA512 138eddf475dc78c4021a37ff118e66663efad82daa17e07ea3c573adbb419ccc47d691b86d5cbf40ea474e6ac792e91a4f322fabee1ab894b1eae4b8cbb409ef
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLzb:A3kMGT1LljG
TLSH
T14215BF13E79014F9E9178234D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 895KB
SHA256 7297a135297547e1ad766d9d3d668e38849bafeaa287aee654029989a85d9081
MD5 5ef124950ca74e30d881f8a0f57fc1ca
SHA1 b57ebe4011ef9025266266cfe4eaca074bf934a3
SHA512 7dee71cf12440c2932f07303ea87bb5307d50cbbbcfd9a20cd7407d88584647c92cb9ec92b132b048dce4cf594e387f43e5541a208dee7efd90a15b27013fbf8
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLHf:A3kMGT1LljW
TLSH
T15A15BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 895KB
SHA256 299e6ddf9975f76178881b0dd271e835b9621f6a2a35eb9ee322f65f567fd15c
MD5 f383e2fbab9577738a99fbe2e71ca016
SHA1 35925ecc9bd197c558367a06cd590d67971cb39a
SHA512 bd52792045f1a01cc4de43510de10e5cc84192f379ba0f13bb1c9428f239e8f520ec8b21f0da754f7d33e0758c5b4b5ccbe26698933cf6380a514541a4503e70
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLwK:A3kMGT1Llj2
TLSH
T17F15BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 895KB
SHA256 d2487c2167df14ecd8b4d6fcf54986fce86a1f53958400fa97363c34bf64d45a
MD5 4e7b344a84e8e631c3f28af994d0ef7f
SHA1 4e5206dad59fcbbbdba6af2f2bf6886c34545cef
SHA512 b9c7eb7468081e4c8b5f9405650f8e192fbbc8544db29f95e69cdbd7ad98b0ad97c0f15165c7a56c5b1cc68182d6918a0e1b45964ac2845e02343a9412bea742
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLtk:A3kMGT1Lljr
TLSH
T1A015BF13E79014F9E9178134D9A64A22E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 895KB
SHA256 9782d372e621c7c4b3e39c301c7f433e57d7a31410a09b5e4cc63bbe5acbe3fc
MD5 c6bd1efedabf238d1a6bcb8cf69d6297
SHA1 31831ad0562644d4827a7e3775d0220695da5d3d
SHA512 50f2144462adbaf4dade4c93f6dced1666aba7f1e6fd04f470b8f58d8c2d8884df7ae6d6686926fabce4e3cab7c97269bc8b54bb365854f1c9a231b1a2d42abb
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLy0:A3kMGT1Llj6
TLSH
T1A715BF13E79014F9E9178234D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 895KB
SHA256 32204edb430e36a291b65ada4656f531769b0bce1d28248c6e6f41cc796ee151
MD5 42d6f3423af6d910fa8092cdd784b662
SHA1 2122a88dfbbed6b4e9e896f8f5f7a61e897449fe
SHA512 898cac129cbcadb507a929e7db607bbae2c57f79e37b9f9322903e894e036b824b9dcd777c28c1a6d167f7bf335ca1dcf26912e15b93bfdac12d2db60571a121
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLBg:A3kMGT1LljD
TLSH
T14E15BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 895KB
SHA256 b8820a3fa5fbebd8a487388b4d86afac7a1f94719d2f21f5ab44367dd4f01ed8
MD5 bcbf6564200379dc3e822ce3351bef3d
SHA1 442ceaeb05ea0ec1c528f8ecf9c2981714003f4c
SHA512 866d2e744e32595572b8be9fffeef5b70fb0359e67a5938bcf0a53561e6e97a7178d252c4f82294d480116da0223a7601f88157c623fda63657f5d0faa0e90be
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLor:A3kMGT1LljV
TLSH
T1F515BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 895KB
SHA256 6c485c468a06c3774c0c00639da5807b91451a7b50e73a047f6e5ca871152369
MD5 d1dbb6c7f0a9182b91b5e4a7d5b88623
SHA1 ebe1c378893d83ed8a6bdc12bad3e0639bfe36de
SHA512 e18e021538d200f8d0156ecbfb5edbefba530d89bb6479ecd86cd66eae5dbaefe3ea65ad5bf9952b14723f88080ba96001319481d66722a3a9516cbbf80457db
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLGn:A3kMGT1LljH
TLSH
T13915BF13E79014F9E9178134D9A64A22E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 895KB
SHA256 0add19268414431ff1484408cdcf877f72efde3b906300a9f2452bc6d1f068af
MD5 96a8175d486900a3ea4dbc854106944d
SHA1 c64a051f99913ea3db78ec94ed41f7e215e32e59
SHA512 46336a4cc1386505fc1b8a6ff5121ae78d4bba6217c5e8f5179244e23cf1a7f768ea477c31174d7709403b9fd0d3747d04b9f77c87d4c7a25615b2440e5d4cbf
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLMx:A3kMGT1Lljd
TLSH
T15715BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 895KB
SHA256 26d19325525f72c99cd10f20f5c6bb3b0f247ec5def0dce3b1e1de10d46f575b
MD5 6ebe02f23d8bf4f0e5a5db940c911810
SHA1 8d33e449ec3398be6aca183a88b2407c0cff6336
SHA512 d1ce3eab1d2c8b44d8f266bd612dc114f18ab4ac751c5a62e2b700e4140a7f4e5b13cdaf3b645c961c2055a34c4923f455bee3a3a8eb3004fb9e6556ccdea72e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLGA:A3kMGT1LljC
TLSH
T16815BF13E79014F9E9178234D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 895KB
SHA256 ee20a183d3fe0aa3682bf6e4f53907e74c785d5db406ac0efcfefb4e99e18032
MD5 0c873f4dc7ff1aa00f28669f091e2b77
SHA1 d139931c5312229cbdbeee11769be7318a4ec2eb
SHA512 ad75bc2c27fa9db952210e133e39251f894387815bf104435c2d70b8f727360d04ae5b36ff27bd5b0f7b58065f18f719cb93f27d781ffe396a4004076c964647
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLf9Q:A3kMGT1Lljf
TLSH
T14215BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 895KB
SHA256 b631c4b6c31df18712562814f923c0cb11cf5605530f1543617c84c126c2d38a
MD5 6c624bb4de0c93023aea350f1a83f235
SHA1 558fad7dbd26af129c765ead6772339f2764b4c0
SHA512 753d9d7849908029a854e7e675c6f0c6b929a1c7b8a08cd33d27427019389dfff4cb7ae22c7c09ca26b3ddad3d07b1ee22a3bf23658484ee4fbc73ce4c0381cb
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLW4:A3kMGT1Lljg
TLSH
T1DE15BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 895KB
SHA256 f2271c49e01bf347611f58a2c02ffa4fb8cd47ab959dc16f82a038ac1cb14fa3
MD5 24957195d75c5646e161513b4af2236b
SHA1 354bc4fe03cdd1b3a658d55c03516d7bf1e3167d
SHA512 957af546162b8f6ca6947a770caee4339f8e0b86e0338f73fd8934ab351c905bfad660e459b4faa54e52c5ff1432808be5c27faf1e03261e28f3473d9669ee67
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLFu:A3kMGT1LljB
TLSH
T19015BF13E79014F9E9178234D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 895KB
SHA256 98773f0f3361a665d1825e6f1c57c4a864546dfc926dab0829cabc96e709defd
MD5 4a383a4befc8a6b469335ebeb3bfc525
SHA1 79387445345d91f7467917cb9693d4ef7dc76378
SHA512 48988120787faa6ee5ac737d32414d54c7c30bd2f75640b394ddf0784f1426a2cb7166ad43162cff75f2ebb011102022f88d11da3b0b2df1bda3c34184f2ed9c
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLYj:A3kMGT1Lljr
TLSH
T10315BF13E79014F9E9178234D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 895KB
SHA256 c7cb954696e4b276c4352a2245b1d28374d3a8374eccc0fdcc12776e38fba305
MD5 095be669e0abd3538c115cc456aaa3d6
SHA1 59423b7e34c3291e092a17973147ee5ed238509b
SHA512 6fa903ec1920e63c923af20414475f6516b1dc2b76b1fd2fa250e1f1949c8bf7289dc44b3e9a05974b70bed262fc44943a83c16b3785183652ca3d9f4d9dddbe
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLpg:A3kMGT1Lljj
TLSH
T15515BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 895KB
SHA256 32f9a94afe389f243ed5de00bd3e52d3fe92df26bb914d3f63c386edf30a3629
MD5 a26b22b27fc05cb157bc02ccc6ec993c
SHA1 ceb7db566b024a2646acc15f1cc4258366965d6d
SHA512 ddd122db494817fb05c812facc447148b613c66d1caad36c4d9bd1f3d5a888dfb7508d3cdae53a1e8da68cca6d00118a34ce4afddb48ca3512e181fd94560601
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLwI:A3kMGT1Lljq
TLSH
T13F15BF13E79014F9E9178234D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 895KB
SHA256 5c7730498bdb2d967dd37631b432b8c8acff5cdc9dc7286b7e989f4b0d9d1ab8
MD5 16b6b31285e620b7d52c91faa04ee4b4
SHA1 86248fe266465a728664d9ab77881deb03465f3f
SHA512 912f1dbee9bd670ee2ad08353c6996df04a48eb876f2a8d8c4f763f0672f6de961f2f337acb4340fe25d72a37fbb3b28f4b8a1140e877a240f589e5073752d25
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLyo:A3kMGT1Llj4
TLSH
T1E415BF13E79014F9E9178234D9A54A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 895KB
SHA256 c4f9dba2b202dbd265c7fb96d3852444938c50fa67993ae02d805ba40de35714
MD5 694488873b30d77cfe7fc391c754696d
SHA1 902b8cc3a2dd5dc5e28488459bee14f337984058
SHA512 2e1f2f22b22a883c8fc934d663eef3b6ec5d8a751e9e36ed650a00ad8516a1da256f9a091ba69fafd42736f3dddd5dca641c080536e5d46d328d3ecac7d2f89a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLp+:A3kMGT1LljF
TLSH
T1FB15BF13E79014F9E9178234D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 895KB
SHA256 dabbd35935fde147842a8d48da4d8c0ec417847135ec80e34feabc391a62bbec
MD5 4b280ded483c9841a386f3d0571cc342
SHA1 f95dd87a79bd95a59da6bd1c6024c1bf802397b7
SHA512 77ef2a3efebc38d783559f42f2304dde94d418395ec0ffd744c35efc1d01b40ef161f3c4730f9064567db1b91fd6155a8fc83b9101db05a5a58675cd7e94d332
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLXQ:A3kMGT1LljN
TLSH
T19415BF13E79014F9E9178234D9A64A12E7B1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 895KB
SHA256 4b2d562cdf16ef3aad894e21b6bcbfc1d05b974fe49c2999410306e5e026253c
MD5 3b5bf51e386ee51192bfe209cc45697f
SHA1 a6c9a68e763001277f07254e974cb61d46d75d88
SHA512 155915bdbfadf04f1fcfaa9127251511eadf3fdaa2eaf848830934fc7ab934a773c84d366924f1e421a0a1cfe185a0ec0c2193411bce59adb77607db72001a2c
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLsX:A3kMGT1Llj5
TLSH
T13315BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 895KB
SHA256 028d8c5672eb198c2fc43711f744b37d4439d2b55f3055dbec1218bb639819b6
MD5 861a1f36a4fd4d4266b11f63be3ad0ab
SHA1 3c9db3b959b12dae42c5bf505a85555bc83a28e7
SHA512 32837ba7af26ac2628ef310c4493336d7c356d559d735ba94f62d43aabde2edeedacb72a7dbc202563a55efc66c1d83f342c652b395ca6ab6bde742f479e67e6
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLKL:A3kMGT1Lljz
TLSH
T10915BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 895KB
SHA256 af9fdbfba0d3f311ce693d8dec1ce449256657ef716a7f0265d6279cce4b5059
MD5 8a05c0d96d45d2127f66c10e1a7f189a
SHA1 aae4b5c0967ecf4300d39a8c7be9b2466b7d25c2
SHA512 66b3728274ff3f73d5d296b7806a9145951ef4c767db3446bd0d97bac0cbde3792e374428ae341add35fcf804737e27139b4ff93b71d5d4f233c1998a31d9ea1
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLuM:A3kMGT1Llj+
TLSH
T12A15BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 895KB
SHA256 92fd1d179b8351de443c5494c5a7e7e516b1599f1d3bc3333d1c319c2bb7d227
MD5 b927ce2828c544e5d2f143b12352dcf4
SHA1 64efc9f7f925da0768d4ee0a8f77d0a9f20df703
SHA512 19da2a7e3d2555b48c95a11d2fb2af2522f89341539d6c5fd16bcf7367d269b99fb0e2648eefe7e89a8e04cd5a39cd68d1ae80d321d6a5970771dc36b516df51
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDL3h:A3kMGT1LljQ
TLSH
T1E415BF13E79014F9E9178134D9A64A12EBB1BC261B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SDXHelperBgt.exe

Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
Size 905KB
SHA256 d76afea9c9a2a94eeb647a35e75aa8455920a1f0f571def01b0d0828ffc550bf
MD5 8022b36fefb1af2d2f237573d48b16f2
SHA1 bcb20272455833f64780e2ccc562213f5c41be16
SHA512 d9358f0bd430bf9f4025f845491e6dad156b39ca6754890497074b0950ba4e26045bb391785cecc33fef20036464743db80f97662ead9f66a192401723f55384
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLk1:A3kMGT1Lljj1
TLSH
T17C15BF17E79014F9E917813489A54A23EB71BC660B70C6DF1368A2262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SETLANG.EXE

Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
Size 947KB
SHA256 fa7a9d1861f344a7697e1f5a3a66a07041d17ffb542c5aac27afb09ca683be09
MD5 d092f05a19275ba1951de9dc396257a6
SHA1 cdde558267444aba53bab59804d3a6f3b3010cf4
SHA512 f6de22177eceea9885c83e2339c6884681c7dab46df89e4d97d6137660e66bcb6216a1fe968ce7dd377d1e59e12f4730c85fc1385ca72a647c024f2d3c7507fc
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDL6kUl:A3kMGT1Lljf
TLSH
T11125AE13E79014F8E9568134C9A59A22E771BC260760D6DF1368B3262F337D06F3EBA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wordconv.exe

Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
Size 915KB
SHA256 139074a20e000588a93469631c1c4f6194068fcdfdeabd7ed79beef774d2b661
MD5 fbf3418bacaf33dacf94c48ed4e0a25e
SHA1 4ff9ec7d4486acfe51988fcec2297a91a3e5d600
SHA512 0467ca91e15a1138c3a1078027a05379c258e7cc88dc00ce112a67a7dca2aada680213ecdac478356af5033cfd11c8fde6a8040cab33ef204ea2921a5af0f7f3
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLEwE:A3kMGT1Llj/
TLSH
T18C15BF17E79004F9E957813489A54A23EBB1BC660B70C6DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msouc.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
Size 927KB
SHA256 933d877158e8600eab40622b3646a18aaf87d42b52896ff9426b15edfc0e143d
MD5 73c74bce59d2f4d7e0893d231a3604af
SHA1 3ef5eb0ecf28b81d6ee31eb4cf2dba5d81c4e0c3
SHA512 42d0f6312256d2deccc6a7096a22cbedf96c85d3030f10eaf717f9a11ae1674eddd2e2a1a96bed4907ffc556e61546ec8430af4a44a3d15e998e820226c26aaa
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLL2+:A3kMGT1LljJ+
TLSH
T1BF15BF17E79014F9E917813489A54A23EB72BC660B60C7DF136892262F337D06F3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

osmadminicon.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
Size 933KB
SHA256 56adcfd256f52bdc0ccf4190ec905adbfaaeba5da5b87070c89b4b808e2f02ab
MD5 a21d33c32581db3ee4700502c017a1b0
SHA1 8484d4082c3543dda8f2f8d48a0deaf6e9b02654
SHA512 410096642e73d23b7c37eb9dc1abccea689337f1b9124c3496f49660b8a244bac3624676ad67fb1b5ab201560c9dee9b4a3723e59f588653a75533f43577fe0c
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLS:A3kMGT1Llj7
TLSH
T1C3157B63E69008E4D916913489994A12E771FC1E0760C69F177C9F252F33BB07E3EBA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sscicons.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
Size 951KB
SHA256 5907a635176f87a1fc208f18eb9b9732a07da84726a823eaa37a0da365d80661
MD5 bdaf4243f36612163bb8845dfb9bbdd2
SHA1 cb0ba96f017913a949d0d7de10775b027958cdd9
SHA512 78ffc1029197d32b12d01a155564f3b0eba05684502b5c9009debef95107a402f70450bf27834cd868db731b7127b35973de2a41b1739e744c56fadcf467eb72
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauMTWaLl3z0zDLpF:A3kMGT1Llj+
TLSH
T18E259D42E7D014F5DA568134CD9A4A12E771BD920B60CAEF1368B7266F333D07E3A7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1516-60-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6464-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6464-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads