d3c560af89d62b27111adf477de4d6337e804c43bcabcc070251251b67b0a519

Analysis

max time kernel
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 946KB
Sample260705-vt1a2ah18p
SHA256 d3c560af89d62b27111adf477de4d6337e804c43bcabcc070251251b67b0a519
MD5 1e215608c13c5bbe598bf9081e4cdf83
SHA1 982858db8b6dba9ea88d2cd5a78919026b759eee
SHA512 e620e503f59499cda3e2bb68d7baca2b287f9f51f42e1bdc4d4eaf95f770f19dd4700f4e0cd2177dc23e3c487b10e99216ed3b093740d31d8465a489ff2ae2e3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYahXvGoc0/F:A3mnXoZjzyaEFyKUluzyAZYahXvGoccF
TLSH
T13C25AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 49 IoCs

resource	yara_rule
behavioral2/memory/5356-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001300000001c5f3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2ee-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fc-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5356-40-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/692-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000600000001849e-177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001bb7e-210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-230.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-249.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-269.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-270.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-271.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-308.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-352.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-439.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-458.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-490.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-509.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-516.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-517.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-518.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-531.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-557.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-614.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-635.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-648.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-649.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-656.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-657.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-670.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-707.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-759.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-766.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-773.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-780.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-781.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-825.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cc5-1308.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0016000000008f20-1415.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 46 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001300000001c5f3-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2ee-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fc-39.dat	aspack_v212_v242
behavioral2/files/0x000600000001849e-177.dat	aspack_v212_v242
behavioral2/files/0x000200000001bb7e-210.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-230.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-249.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-269.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-270.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-271.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-308.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-352.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-439.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-458.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-490.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-509.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-516.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-517.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-518.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-531.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-557.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-614.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-628.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-635.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-648.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-649.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-656.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-657.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-670.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-707.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-759.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-766.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-773.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-780.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-781.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-825.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cc5-1308.dat	aspack_v212_v242
behavioral2/files/0x0016000000008f20-1415.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
692	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_91390\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5356	2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
692	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_1e215608c13c5bbe598bf9081e4cdf83_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5356

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 946KB
SHA256 d3c560af89d62b27111adf477de4d6337e804c43bcabcc070251251b67b0a519
MD5 1e215608c13c5bbe598bf9081e4cdf83
SHA1 982858db8b6dba9ea88d2cd5a78919026b759eee
SHA512 e620e503f59499cda3e2bb68d7baca2b287f9f51f42e1bdc4d4eaf95f770f19dd4700f4e0cd2177dc23e3c487b10e99216ed3b093740d31d8465a489ff2ae2e3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZYahXvGoc0/F:A3mnXoZjzyaEFyKUluzyAZYahXvGoccF
TLSH
T13C25AF03E7A410F9E51B823499E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrCEF.exe$

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
Size 1.3MB
SHA256 24c514e00d69065ceb52f8c5f418451fb0e79fc6df73470c2f0eef00122b39dc
MD5 a4e42faa1114225faa652bcc31b676ac
SHA1 ee03f5180cac841202009c69440bed4836b34da8
SHA512 53e53842a574164ecc4aba10d6070b039d6038b4159ccff924510692bc6751e90142fb54424cab3b28d8c50988d204c923cfd294546a39c78336675412a61c90
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccN0IaQ7:A3kMjKJr0Ia
TLSH
T19A559E13FBA410F4E56B823499A64651FB7578665B60C7CF2364831A2F23BC0AF7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 61664d045e2f216164af571ac16c7db191cfb8d5484360008ba2976fe3d2cdc9
MD5 0819df3d6cb9221b29b26e43705df84d
SHA1 99d7b697d213db55c53bda1567e99f9052644cb9
SHA512 ec6b9b4a0fce6af917d38f82deb609141a0eb47eeacfa44b69f0515e7572c96beb31bd8fe22881e4baa3fdca03e76f8fc7bc55ddf00bccb9cb65d5baf1aac952
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccB0Le5ji0hmxNrM:A3kMjKJPPji0Aj
TLSH
T107657B17F6A402B5E077C174C9E2965AEB7138921B308ACF1399C7292F237D19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 961KB
SHA256 aa9b978cf074d1761af7c5007f4872a8e53e28fdab0ad874ec60b5a856ef2241
MD5 4e26fa43192a98e726cb5afafab2573c
SHA1 1fbf5340975d4d43fdc21d140859c959a40bada1
SHA512 1e130bf56724e44480604f709266249d99c82c1602a75d1b0b16df945370d18e83c07d912cb3bb5c0a58cecdc1155306c47367b78b1d812b3495f873ac1fe1ea
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccDa:A3kMjKJ
TLSH
T1F425AF03E7A410F5E51B8630A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe$

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$
Size 970KB
SHA256 2b0a51a3afa94a2e13fcbfa2f67df07a15d53fee54ef0a69af6b82de456125d8
MD5 e3cd809cd0f8abfbcad1a8434b9c2f8d
SHA1 0fc3c01118dcc2489c6110e80647155b346682ba
SHA512 71ceade6f5e88f16b7ceffdb1805889689cbe3b5bdd21cbb4723eb81b4ffaca57f4e38e8978c98ed49403034639a207fabdee50f94ac8bf409733a3f8644c3b7
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccex:A3kMjKJ0
TLSH
T14025AF03E7A414F9E51B8230A9E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 970KB
SHA256 9cd1e4488f6aec1bc46d1d61bcf11b06533efc1926b72dfa17729fea20a2a2d7
MD5 60f3e23ff3b6ad2e5db56339afabca42
SHA1 99ba18e6224115a2722075dacd15768aa89a3a2e
SHA512 f7c5f37f0b553f8919deedd045b2df5668b4d9295f58bd55859ebbd011e5f6eefae995c37d4569114fa7bb9e38fe913af8fb85264774898f97554fb60c71df75
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccss:A3kMjKJ3
TLSH
T1A825AF03E7A414F5E51B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 970KB
SHA256 bec81c4a72494aacbd60ec0a0bf29ad6cbe70340ea5355511882bb580da47343
MD5 79f3c6e9c67d051402784cc3564be8e7
SHA1 e8be182729a48b84967271974a726a77ee69b184
SHA512 698e53c2a86ce16d6bbdf1ea92d51e1b3536f5586cded3962a8679f72a0bc8000ca4e654149db2764465071007f5e14acd0d17add03ad16c2ef4492f65056542
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccLZ:A3kMjKJj
TLSH
T1FC25AF03E7A414F5E51B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 970KB
SHA256 7977179664584b019a753c1e728353b8d6008d802484e0b582487e720e02a1b7
MD5 4ba2c67d002dad2b4acbcd7b8215c981
SHA1 4914c149c54afbab2dc1a6cc29ba63328cc283f0
SHA512 25a770c5d814eb7ce9e92c93511e7b30e7645e31b80d1dc1dc0f7f43dab84e89b6d963c40bde31af1e74ef524e5f66749e02b55393ce32ead4e9b2bb113cb8ea
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccw1:A3kMjKJM
TLSH
T13525AF03E7A414F9E51B823099E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 970KB
SHA256 56ffaecdd2637b719befca36d82171cf0642d156a864735a7a55268f12f3a844
MD5 3b5c09829efee414924d7abbbdd42d7b
SHA1 8cdc366c89bb85eb74d34b0d2ea1402080c04992
SHA512 28a790be63e27d82574857fe65efc52b0fd7004dc647d48351a3c326a249d2619d740efe434d14fd03a402239fc6d5c2ecf399da442c3d70aac034c2831896fc
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGocci6:A3kMjKJX
TLSH
T1DB25AF03E7A414F5E51B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 970KB
SHA256 e69bd7a880a7661f2cca04987f4f913e7f67f6324783cd75e8683e8b7aa6d183
MD5 7ae984ff296b5caf2a234136dfef8597
SHA1 8ff997f1360fd9e88d7960479f402ee9856b878d
SHA512 9ac677cee9455a8d78f64d6fbce517ed6c9f14a839e2387ba6a1f38793bf4f0cc3121ba9909028b45e52c4231e16e560d273e3cfd9c925bf6d0e02e35127abcf
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGocc6N:A3kMjKJq
TLSH
T16D25AF03E7A414F9E51B8230A9E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 970KB
SHA256 d0957d6eb7f9f55490e0ad600939b665e74c3cf52e929b0df28115855d8d4f9c
MD5 e3d0a92a1fea686c31cdfccb9400b4fa
SHA1 75099b72908d5b3556a98e2c295111f4269b6535
SHA512 028df32933b3482483a31146ef37d65274516c2c2cb28f4d7c9ef7160fc73a47138a50ca6fc726d3abcb78c0f8854fafa840a721fb7dee0258cf9fca60a3b8fe
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccgf:A3kMjKJG
TLSH
T16125AF03E7A414F9E51A823099E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 970KB
SHA256 9a78c33448a54d689ae4493a390e6e143f10ad9d327a64bada7283cc015a93c6
MD5 2097cc3be3ff16c71f0b9ca9113fa309
SHA1 9d32aa9c13e593cbe95374aabdb6a43781a36428
SHA512 1b3fc80a2a115ade50a61be9e6954c5a2686810369d682dcf9d3923b21bb3f1a67317dd6e105368ce284df56223516a5bfc5f4fa87a2410dd6acd56134ed6d67
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGocc6o:A3kMjKJn
TLSH
T1C625AF03E7A414F5E51B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 970KB
SHA256 7e79912d604819754f7081ad5cc082c2353ae530ff2027b10949abe594357c0c
MD5 f70ca78e799b1c4009865d493875adb3
SHA1 4d9652a11ca2852f570903ac7d3b227008207b3b
SHA512 816445fb2259881461fcbf2fb34301d1c10a9e8c941f31ef9dc2273613ee2e4c19795eea5b8b0ba45c6d63b6fca01e58ea1399e96ac85a788ed4f6b59d5c6a02
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccOu:A3kMjKJJ
TLSH
T1F025AF03E7A414F9E51A8230A9E54612FB75BD631B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 970KB
SHA256 995e669a954a1b4b34cde0f105592a95328e4eb47f23513677af65af9754ea2f
MD5 4403d33ac412bba573b16f1cecc627a0
SHA1 71930a44729e591a43aafdedf480a2d13a926797
SHA512 6c5fe20b3ca29ea84e8ce284ba19563a27b961a5aab7903664a79fd6e3d4e0e3c0f9361307238fc4ee18d82dc21d89543bbcb2e52ec9b4909f700ec19b9ac7a4
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccC9:A3kMjKJk
TLSH
T1BD25AF03E7A414F9E51A8230A9E54612FB75BD631B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 970KB
SHA256 9c95b068487158c7cbf50deb6c0b08031b2863462f0e2bfaffa02e1d44993156
MD5 3e793ad88bc894d25347e1949e6479a9
SHA1 b2b4db0002b9781360f4dc51507cfa51a20855a2
SHA512 669d80b2c8c8f1ec887891b251189499740dce14c878f287ae279d5fcefceb19ab1e44715527de1d7ec26d70e269f6e5afe36073b9bcccce9734f408955d4bfc
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccCc:A3kMjKJN
TLSH
T11325AF03E7A414F5E51B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 970KB
SHA256 a7172cb001db13c8697b7b34197f1554bc2fdc9f06c63b9215ae052dca8222ae
MD5 31c983a0f582d6055d09ac880281cc23
SHA1 23e969e0846669eaf12a4994369a365382bf1d7b
SHA512 ffc2c4b7c639f74621f1f713fec3358e4bfbb75b493b501a9600af6110af560f9da58983627ea6bbc4dedd0cfd39dcfea2dfb9f4e7761fe80a4dfb309c5a4c4e
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccLp:A3kMjKJT
TLSH
T14425AF03E7A414F9E51A8230A9E54612FB75BD631B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 970KB
SHA256 91c17d4699a9f2f3762880dc6cd71297c0339a40e9734e0fe37c69e40b67859c
MD5 b60620a9684cc1224fbda2921983fbe0
SHA1 9e5b0e90fd93af040eb716931edab5cce092beb7
SHA512 715da6683de84fc18dfecd4cab78564a4789fcb48e690826aaf7661117fc637fd1fd7d8b234b8f51333f1c6c438e119e640fee13e33b52d658cf184a50f24141
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGocccN:A3kMjKJo
TLSH
T17C25AF03E7A414F9E51A8230A9E54612FB75BD631B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 970KB
SHA256 a6bc2c9ea25f12613ddbbc00f0962a75815855d3f0a5f9cbfa405b74c15d5b6a
MD5 a89801e06c3cbda0bd710a3ff5a86dcc
SHA1 0040f55b1faa6142736b4cf71f46c5d88de43cb7
SHA512 a0c558d101914298bf26370d9f0a3e412977395a14eeed99cc0dfc6defb71ee1bd3165c9e5deddfad36c2fb0f36f861566ea99108d4a41b5084ae73b921bc5ca
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccEF:A3kMjKJ+
TLSH
T10C25AF03E7A414F9E51A8230A9E54612FB75BD631B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 970KB
SHA256 7a8cb765d59064da51f82b91e7d45f38f71b6e18c297e59519d7aca61385c33c
MD5 39101e205b93c5628281e87d19008f44
SHA1 fff831ab229f5bdd8dec5ae56ef5ea00bee04a88
SHA512 2b2f635de832fd999e6385404436c8afc3f314c05f6d9ee60783a999f0ccc3fb75d8230b0052dcf4a78734bf8e989c49eb561789f22b091ef315985271d9a4e6
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGocchC:A3kMjKJa
TLSH
T1FB25AF03E7A414F9E51B8230A9E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 970KB
SHA256 7300f9379da7d60a7814e9f349f8c88667472d4706faf6bb7d4abe6eec3ea657
MD5 5d96166202a50a3988257ff9cabe3104
SHA1 84805a2624a32bb3c727833872d371b520cb7fba
SHA512 499c966d3a8c28f9986bb473090776465a71557167479f74bc25701fce4ba01a53d3377fa330996dffb8a4d546bfb2ab87018ab2243a4952856fd60e1b1e85f8
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGocciw:A3kMjKJv
TLSH
T18325AF03E7A414F5E51A8230A9E54612FB75BD631B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 970KB
SHA256 99f4643d0b49657284af2d0d36b4112916b0f5be594c0e1aa16dcaef9dbbc7f0
MD5 ed4554c1e6167cb6a577eeba5fdbedb1
SHA1 02c801192d8a3c081902e77a13572166efe7baa8
SHA512 dd58085e9cbd1297af8f9301a3e084e8fb8361762588b01e618704931eefe9be416d104ebf2c2400687824e0f6ee57a74d912dc9fbe6791862dae90dee6acdd4
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccpT:A3kMjKJL
TLSH
T1C525AF03E7A414F5E51B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 970KB
SHA256 1ffe060c4fd56a611211cadff08f76bffe5b5febf2391f7b7d44c9719d713f44
MD5 7293f3a5987f03fdbe7369a157d7d8dd
SHA1 b7554d4d3ca66da1c984ef53863b60fd9dd704eb
SHA512 851631a60e973ba9ed3bc3515a2344e9b4e6a9fa66f17d40fdaf2c2d78666931569ecea97f35fd36c3db8d4112be4471bcd93e8ef0ab204b323654d5e17fc8b6
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccHu:A3kMjKJM
TLSH
T1CF25AF03E7A414F9E51A8230A9E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 970KB
SHA256 726d5f03d6685090cbfb381d5bab53e8ef68f7e9b98973119f18d2984472c702
MD5 41d525936d38afb7acd29f8207a89a48
SHA1 3140b0c8cae3dcb44a7bbbe279e3277d51f13f24
SHA512 ab92b1f09def7ddb640c8c00c74224d88592b9281fc7f684198b8c5c2d16a630b2f3ca64a6b02a5440ed52e8f6e3491e4cdfb8d299a4e9b8b8beaade7d1417f6
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccbb:A3kMjKJl
TLSH
T10625AF03E7A414F9E51B8230A9E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 970KB
SHA256 077569ef665b99637a1fc9c3d557c3d8888987c96e4cb6a6c34739a13c3baf79
MD5 b3b451975c47f17942d33e43deddaa72
SHA1 8a21dee83596666279af40d3042dd96ac15e5c2b
SHA512 43d0020dcf87dd992f49f4fe8aaf52449691f708707ae5c9c640358f7071cd08d443780c0c69fc58b40cba4a16fa3d689d89247f398a348898cd1ba0182d641a
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccvf:A3kMjKJl
TLSH
T1AB25AF03E7A414F5E51A8230A9E54612FB75BD631B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 970KB
SHA256 13b2d239f601bafa0ca08309220a212b527251abc9a00ce0aaa3b5c178bbbb58
MD5 8bedf5c10598e2c998bc9ffccf0fa327
SHA1 8464404561094a9b9db0706c41cdbb5526a128b1
SHA512 22bcaf5036841515942dba822c2d4d943909ce7cfe779768f212de795134aeb57f56b692004dc2535463f5eac0f29c4fc7f7c57b8768d1550ecb8375de7a730a
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGocc4K:A3kMjKJd
TLSH
T12225AF03E7A414F9E51B823099E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 970KB
SHA256 7b9fcb473ef81675700a1f22d6f63dcf79d460c2915e86b65c2064f4321ebdb6
MD5 5c287c482a4bf0583ae42fc7a2c2e9c0
SHA1 a47479f142389bcf9dc5577f9c8712ee7c462f8f
SHA512 ee31e0197118494439a49e01f5715a8515323c3d9bab6c00190276e39db4f3d00ce74256580556e7bd9375469bcf1b4bdca067ddca281812aa458fec6447d507
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGocclk:A3kMjKJ0
TLSH
T16C25AF03E7A414F5E51A8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 970KB
SHA256 0cfe9073e14512386d496cbcc41d8f59939773d477fb36e98c231db961b01b75
MD5 394701278cb82f33a6ab9f017efc283a
SHA1 8dcaf2d9f3277cb036409749f2836abfc33e8bd7
SHA512 475dfe0d98ef93c413c46e3f54f0b73f38689eb5b922589ca899218e19a27a36b61815b4b82cd555e34f0dcb9bd52ad11378d795230e9e171a3220331b353e09
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGocc60:A3kMjKJ9
TLSH
T1B325AF03E7A414F5E51B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 970KB
SHA256 cfdf83a748a87a9438a4a6af0a17453377ebc66d5ddc4bb9ca713ed93ee51d54
MD5 431cbcfa9796336efca4987a175e0856
SHA1 ebb71c325c5a748e55e5a36e433803214d471f59
SHA512 744bba80c935c7d003ea143490cc6ed034ec89ae1ac281d19dfa7b19401b92fe1b7a24fb337dd7ff559cc2ac6b6566cc8f3005f05a8ecab38d3889dc75d45d47
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccpg:A3kMjKJM
TLSH
T18E25AF03E7A414F5E51A8230A9E54612FB75BD631B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 970KB
SHA256 a62a41c9688609c38fae2962be7acbc86d40703040d3c173623ff5149f080ddd
MD5 9388b6fa016b141d4ade95846c2572ab
SHA1 234db96a11b7f05884567580aa01cbaf6406ae35
SHA512 b11253bba0f74f56e1c71a052f76f7386adc6c72cb10a06738f4c5b721358eb76aeb4368d47152419857666a473b22e78e661d6e92aa5bef3a65da88ec4e3e4b
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccQr:A3kMjKJe
TLSH
T16C25AF03E7A414F5E51A8230A9E54612FB75BD631B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 970KB
SHA256 63f456431ffb00df1d6a4f6cfd54fa42cce8ed39570af516ec9f82e2c8896bfb
MD5 b8b1e528aa5d39b83bca6a63fdefa8a2
SHA1 20cc2159a3605d1f6d14e6a3d59c960f8e8b620d
SHA512 a04282156d5301e68b0193c85177707b718e772d625db2720a70fa02996a5ee4002af58231102dd250ec9b8869d23dade8cd9f4ea615e28e5e4a260a33b9229e
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccOn:A3kMjKJo
TLSH
T1F525AF03E7A414F5E51B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 970KB
SHA256 b91d2ba48fc288c6cdec06cdbdc310a0345c4be68107913b0663b3bbe7738558
MD5 f2fa3a4b36f2f167496ba97e12491b5e
SHA1 eea993ba733b713f7cce61e64103ae1bee315b22
SHA512 8ff7c7cbf962c1bb383da5c18be25b72d0e86153ae3b8afd415c58c22bb42b405f736cf71b5fbdf0fc332bbc9ca83beb33ccbf8d72126f4075de2ef736c0266b
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccEx:A3kMjKJ+
TLSH
T1F825AF03E7A414F5E51A8230A9E54612FB75BD631B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 970KB
SHA256 ad33ec3b7995290ae7e37315e3c21f8acaaf229b45606c790940f8a06add7098
MD5 ca889dd4db17e0ec946ce40405ff18be
SHA1 0e65b485c99108a34a65ff0185bec5d567a99ee9
SHA512 c2b29c9c236080e458e247f675465b7fca99a5da43a0a7f23204348da8d5d8e039891ba33d93977e4cef06347393c87c4cf1d78ff6087a63fa6db5b5c81a8ceb
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccOA:A3kMjKJ1
TLSH
T17025AF03E7A414F9E51B8230A9E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 970KB
SHA256 e51e13c151f9ebf41cd0217bcae83a2d100c3b0d04c3b2ead36612429458be43
MD5 6e011301c1c0a8322a42f5e6232b8ba6
SHA1 0956b38312b32c8f954e1eaa6c028dfae0877f48
SHA512 8f696634f9e76ff0ccd3966b5a5e435362410d45090cb5a670a475b3bc4e80752bfcd09aa1a09b1f801d08cf5d7a5a90638580dbe46ce5f932702a90e9843f6e
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccH9Q:A3kMjKJ0
TLSH
T1F125AF03E7A414F9E51B8230A9E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 970KB
SHA256 94a9681eb3b7ed7ba61ad34210f5e8438f7b24925d019527a11cc072035cccb9
MD5 c5f6296798b39ca1dea22898c7125138
SHA1 bc79323de574288a1ed9061ddc3e28094ba1d779
SHA512 d37ddfee8cc2396b8c6beb094ca7273d973e4a3601b86c37e41d95e8256cbdff54596a1c96fc0b310bf2db94ab3dbc00edc31b683a16206c913549dfc0b2f310
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccO4:A3kMjKJ/
TLSH
T1F925AF03E7A414F5E51A8230A9E54612FB75BD631B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 970KB
SHA256 89a0ed60ca52ccbc0a6773d6392747308f97c065692b402781877f0540a2f67a
MD5 0722892103fa115f2c16e1b9d04df405
SHA1 b87bdd9b554a51503cdccceaa706afea7d183b75
SHA512 9350d822aee1ba13f2bffe5b6b7ae7a9c4716ae474fffe93f0e9e377068a5346eed9be967d217cf99e573dae2991253496d4e5ac3b1bbc0ec334c8e4dd787071
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGocctu:A3kMjKJy
TLSH
T17325AF03E7A414F9E51B8230A9E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 970KB
SHA256 9600aca5912718ca0011ff4ff11c892b9b49ea35b2d6b41c749e0c3a552fe5bf
MD5 e7ac2bbf5b34cc40aeadd38ebcf0cfb3
SHA1 e19aa4ac5bc6795471da43a344ea3b685e6982fb
SHA512 34b87ec471dd2f4018e5bdddd6b99d592ba2b5a2d02b351f82ac8e35b9c762e382bcfd215fb218a0639a89ba3a79bb74a7555e10153b649422e942d6466edd17
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccgj:A3kMjKJs
TLSH
T19F25AF03E7A414F5E51A8230A9E54612FB75BD631B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 970KB
SHA256 10a09a17aad6c1a446b4a9305aec3ce5fc6ad2c722633837a08b6978f6d97944
MD5 1b73c3a41acb79acddded1581da64f4d
SHA1 17a481d3b99c9b01152ef2019fe8a02259c62f03
SHA512 7ce68040c6ae813957b93ddbd27a447d26ae7599782a4204ed082d6d2a75de8e0a4bbafdaa69e8c6b035558b1fabc7fda197139509bf2aff65c7b5285ea9029b
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccRg:A3kMjKJk
TLSH
T1EE25AF03E7A414F9E51A8230A9E54612FB75BD631B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 970KB
SHA256 5452d95fe4443ff4e71c75b8d6c6f3d8969e621fba45f07ae94ac5fc1689527c
MD5 6af6dce72c2c84e51f952b497fd34ffc
SHA1 6e2eeabe6afd5c0a9e27c9d28e86e24fe8b6b6e2
SHA512 8a4dbc0d718a2b2cc04c6bcf4a59596720c0b24026d4dabcab5a5ce8dc73c0cdc728fea6b246f528a9aad147c38a305a2384c6025925bf22391cc7c16698df59
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccII:A3kMjKJN
TLSH
T15825AF03E7A414F9E51B8230A9E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 970KB
SHA256 0094e144790aba8cc36397aa20875cc1630b3b23e79395fe06871d74a8597419
MD5 12ce1467518533bda8bd2c714a93877b
SHA1 02d49441f17c068270df8ebabea670102194821f
SHA512 f950813ca20c4b547fb44a2ddf8c35471d6b58648a76fa63a9f1e18bfd7cea7530863a87f8ea4750639d6d2db8f54e1bb14e096c2039406d59cccf2c03534909
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccqo:A3kMjKJr
TLSH
T11025AF03E7A414F9E51A8230A9E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 970KB
SHA256 222aa98fb2f63ee6d60c9ce64e20b3bcf919471aef1410cd36d2b3624b5b31d1
MD5 9ed9b0f44058a7df910b03d1b521bf40
SHA1 4a4272870f792b7cf89c4d416541943d0dd25f64
SHA512 9dd302f76af9cc62dbca357b793a3e0318447a626e777bbe9900a5915a945be83703210f55e20e7c3065013be9939bc2a81a60a0492a53126b71e70fb3bda5dc
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccB+:A3kMjKJu
TLSH
T17725AF03E7A414F9E51A8230A9E54612FB75BD631B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 970KB
SHA256 a7bbc4284277ac1e39b16ec2eb89714b45819f049bc343296df51f20bb6bac3a
MD5 4339378a473471ec25e41f6b0d87c1c7
SHA1 1edfddd5175fed17bbeba03e4eff23e6d972f0f2
SHA512 1c782ccd7adc7b29fb8d6345712f522ba4a6d07c6a1ef472e06df6a3a526e7289b550dfa833e453f4ba0c2d9cba51e33a506bc6072e3ee97f2d1d1b6b7ebd782
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccPQ:A3kMjKJa
TLSH
T1DB25AF03E7A414F9E51B8230A9E54612FB75BD621B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 970KB
SHA256 f9a8ed8611f286f69511567cf79918cfe5349c56efa81c8b02d77a81921c3319
MD5 624cc2574486444724b9e03401c9b088
SHA1 d940b7c4710491f1ddad077a6da34afb175e9fea
SHA512 b8c9cf942656fc0a0dec7b9a658a2ca0f008976b05103b906be5aee1229bc49cb9c8e362a0252ddc1111d04d9c4a21db5f1eb01fb432fb4418d9a024c562478a
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccUX:A3kMjKJK
TLSH
T1C925AF03E7A414F9E51B823099E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 970KB
SHA256 268f0a7be39ab09a8e7e553287523a3b50a8d67f660835f3f4100e4154f22c4b
MD5 d1f0186bc9da6886a8bc3e8e21dc11df
SHA1 bc4ebd89a09460e2981c269003d2fb41921649fb
SHA512 d18b2438384612546f715a2fe6b066cfd20a9823af8664be57200542ed1240a05c5b63581e66a0bce9074ec7d71afcd868de285c9303a10c84d97aaabf554576
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccyL:A3kMjKJk
TLSH
T11D25AF03E7A414F5E51A8230A9E54612FB75BD631B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 970KB
SHA256 771f9a73edb1466b7b2d276c56038a25a0c0e686ca18d90a944aa38b2db01f86
MD5 7d8a41bf80b0dd552cfff7768b885001
SHA1 54abfc5201052f8c44f04fb964b27d12fab38343
SHA512 2ea1c05641fdc8c8c88a8b880653bb967e597fb144e594b5c61ec237a978addd7783afda46a9b063e7fc9caab03b3af8d11e83b00d462e87160a94fc9dafce36
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccWM:A3kMjKJl
TLSH
T1FD25AF03E7A414F5E51B8230A9E54612FB75BD621B60C7DF236882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 970KB
SHA256 3de87e90f37efcb27ff9f3c2e0c88a041368175985580ebcdfe909d21505be0b
MD5 dee565e0f9abdb152a505e5f110e2d91
SHA1 3e499c2fb514c5b2eee05e55235cf3030dd0b7b7
SHA512 85ec3c1b540019b7eed12261d2ad854cdea41f6b0253039eddb0c87dd7534a02869774d1f510f8dca1bfe1db65fc3a3fa360ad85fe7deb100775afea16bcb0fa
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccfh:A3kMjKJ/
TLSH
T1EB25AF03E7A414F9E51A8230A9E54612FB75BD631B60C7DF236882252F637C06F3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

misc.exe

Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe
Size 1.0MB
SHA256 e04f65af999dd525cead2cae665998f67955df9af6ea5a46406ba324c52d6153
MD5 77b5446646b3a8e5513b1cfa69ff6aed
SHA1 8094cfda842d464fd3627329430d04665fd12741
SHA512 47425f45fc28a81d6c7537e93c5ffa3b258f97a7a6ef845440e8303bb0bc5ac035103938fc4ffcca83e0a7cf78bee85888c9c2c3ebc68c4b4fccdfb4b7908eb6
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZYahXvGoccRF:A3kMjKJx
TLSH
T12B258D03E6E410E5E6564130DDA54A12FB75BDA21B608AEF2368B7252F337C07F3A764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5356-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5356-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads