78a8a9188a8af678013fa4f8f8bf0833ca409872a28761614fb6480c133a2752

Analysis

max time kernel
106s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 854KB
Sample260710-31stjaav31
SHA256 78a8a9188a8af678013fa4f8f8bf0833ca409872a28761614fb6480c133a2752
MD5 374b687bab75240fa1d7e11ce67e305d
SHA1 2283a7a13ab5aed45bf6f2b4ae7dae2de1629396
SHA512 3e7ad20b2dae8a91dbb61ffe3edc31449e38406b18fde8145a5922642bb34bef71959c234c9733adfcb98a2810ceb74b302629225308f124f526e4e9143647ac
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WN:A3kM+k
TLSH
T19D159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/5852-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c54c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5852-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3136-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb5-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bac1-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00050000000189a9-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a86-330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-476.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-502.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-673.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-747.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-796.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001bacb-827.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-937.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-956.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1011.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1212.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1406.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c54c-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb5-60.dat	aspack_v212_v242
behavioral2/files/0x000400000001bac1-202.dat	aspack_v212_v242
behavioral2/files/0x00050000000189a9-257.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a86-330.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-476.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-502.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-593.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-624.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-673.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-734.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-747.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-796.dat	aspack_v212_v242
behavioral2/files/0x000200000001bacb-827.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-858.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-883.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-897.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-911.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-924.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-937.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-956.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1011.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1052.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1085.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1128.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1153.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1178.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1186.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1212.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1327.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1340.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1359.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1385.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1404.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1406.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3136	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5852	2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
3136	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_374b687bab75240fa1d7e11ce67e305d_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5852

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 854KB
SHA256 78a8a9188a8af678013fa4f8f8bf0833ca409872a28761614fb6480c133a2752
MD5 374b687bab75240fa1d7e11ce67e305d
SHA1 2283a7a13ab5aed45bf6f2b4ae7dae2de1629396
SHA512 3e7ad20b2dae8a91dbb61ffe3edc31449e38406b18fde8145a5922642bb34bef71959c234c9733adfcb98a2810ceb74b302629225308f124f526e4e9143647ac
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WN:A3kM+k
TLSH
T19D159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 0ccf0da5452c6d0b96550eefebab47fb40297b85d23e89f3fde3dfc89c4270a4
MD5 e06a0dbe540119cfd97aa29d2941dc4f
SHA1 369dd4a28e8b23a8c19d768d8ff851488e187162
SHA512 c6ebec32e40d202edc4a558c1a64d8563626f48674732e99431feadb5e502b29976b6e073c7c9fa0496a36752fa84b6db2e22fa9946c5f8aa8ec63ecef437b01
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WZ0Le5ji0hmxNrM:A3kM+cPji0Aj
TLSH
T1EA656B17F6A402B5E077C179C9E25A5AEB7238521B308ACF1394C7682F237D19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 869KB
SHA256 d982e153f222b9247764c60f25eefe672a8cc2d928b19af6943a236b74e1e8ec
MD5 abe9e9d5f340f2bf45296dde4900d0fa
SHA1 8028d9586430eaf831b8c26d6063cfd2f3cd184c
SHA512 008d8f0b43349bffb548446a040920f75d597d472c29384f44e3de8cef90a79711284113216d1e9710a9cd55e9c8647402738adb04d82ebc88dc43ebb2c5127e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WLa:A3kM+
TLSH
T187159E03E7A010F5E656823499E61A12FB75BC221760DBDF136897252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 902KB
SHA256 601927c51ef0e112aa1962a3f08542a63482cd33c0ed06780257b908d87317ed
MD5 43569d7b11677a8d03d93d46ce6fef83
SHA1 c63f03445b53f7c085415effaae4c964b9617f1c
SHA512 718ba5c8901146ef1908697c3f2f7ac6cf06be68a8cc2e76f328ef9812bdb8e7966b76eab2afb6221cf3484cec97bba1c18f85bef973835242d82375faf8d1fc
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WIb:A3kM+lb
TLSH
T1E915AF03E7A010F5E667823499E54A12FB75BC621760CBDF136897252F327C0AF3A7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 878KB
SHA256 24e3cf0d0542a87e71aa1b7646b2392689598486f8c6053a6f263c899be612a5
MD5 ba2f501f996323f964dae079dcb5e87a
SHA1 011f9b8d217169f924f815b562cadf7a99bf9b42
SHA512 79cf9c73a7ad556be8f3cd5ed6e21748cecb0d31fee67d0480760dfcb725a97f188772a4578de3de0b812d0931c54789f110ab5a73117dbbbb8b4babed29ec2a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WzZ:A3kM+y
TLSH
T1C5159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 878KB
SHA256 8181002f8c305231e439e9c1306f5bbd69c5da9b49b0d78dab77ccd2e3be8ba9
MD5 f63901c972b405d59f6b244467a3e831
SHA1 e1612bfe962434ea4f02e88115eb8ec2de8ba514
SHA512 60a4ab7974dfc5b3311f517af67865b3a4114bced9cee5a709365aa26fa23e9b32ad54e77698687c6f948f0fb44dbdda32257bc9f3c2f7db8f3e33c7f7e37845
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+Wo1:A3kM+t
TLSH
T1C5159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 878KB
SHA256 4b70dadc4748a44d10413a4f1907d58ec2c1320b49169d321ff57e9a3099bda4
MD5 d109f9b3298126dc252c56609a609e97
SHA1 8e4d3f0433f26eb62abf123842ff60c6290b17cb
SHA512 3e02647e4b3eb80af3339ac6f552ff38b862ca29e025ac8aa0ba3b08429f8cea776991be88422c886bde0c5a19280a0d36bbb11f0f4e0ae9b51056ea168a4f9b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WK6:A3kM+K
TLSH
T185159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 878KB
SHA256 8411d118c497994e5e2df927de52b7924003bb81cad37df50bbf14b5ce59d542
MD5 0b699d70d9e15463eab4e164701aa98f
SHA1 c549dadc92e775fd3f788334f024da0fe8f9813a
SHA512 3488919d92ebb7157cd515cd7b9af4fe0b4b529aca12580016a08e8d6c359db7909a4fdd662e8eaf609718f1143bbac7efee6c1190b2c924147c2f46d9d3f5b3
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WiN:A3kM+D
TLSH
T161159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 878KB
SHA256 e70743c962b1410480726fe5dfde3d75df6d2c1eba4c0b65da7c0b6eac195ca9
MD5 1b6f9248329f2f3754606629a7ef2bb0
SHA1 47e96eee5f3daa94605789554b691df793b0e726
SHA512 d260c0d752480e1e466819ca4033eac11f62a0911bf9bb647b50fd7b65b4bdfbac93735e0e5c0731712982b17084e78f3db4db4cd93e0b08b4b66124c0e84764
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WYf:A3kM+H
TLSH
T1DD159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 878KB
SHA256 6d091d5a8507d1c0f96748f5cfc72f4f86f87168b95da9e70ada71986e3eaa40
MD5 577fc049aa060911bc0b4ccd6ccf72f3
SHA1 bf5f2743b2871f975370920a85213ab824771ba5
SHA512 f6ac667c0a7ada7d860bb1a6e581eb562aebb2dd5d4d012ee38c21e54c58bf1e0c1cf92a1e57d4591650de982512e4f06f07bcdbc14ffb7cdb58f9c8db10977b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+Wyo:A3kM++
TLSH
T1EC159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 878KB
SHA256 e2581e96fc87b143a617583173f7d4e71083cdbc45f3c6b046308a6648628032
MD5 7c9f0fffd945f400ea68330fd5ba1cca
SHA1 482f4c5f3a1874cc198ac5e5cc27975f0d238da9
SHA512 10a8a6060735f42f1f27fb354d9de946075ce75cc629b16606ccb775317edb8f034698471311f36b9c220940720adb0e80649307646ca2b2a2f8dcc20087cd7b
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+Wmu:A3kM+4
TLSH
T107159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 878KB
SHA256 832791f45e81d795ccfd601621a43b95a910089003184315a88d614fdba2b393
MD5 21cf4cbf201179d4bb446516b955e83a
SHA1 f2317753bc5fcb919c00897730489e10426bca83
SHA512 b75fa247c6bc6f44d89fba6826d58fe633288da8e67899341f8264ad250b4ccf8ffc8c7aeeee2462711c52fc8a1404582b62c33891aadc6814531e7e98ceeedf
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+Wa9:A3kM+t
TLSH
T15F159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 878KB
SHA256 4afa7b8c9c68877e5023f2d1542dc46ef2abc400e6926d6cdd5bd00f059b03c6
MD5 028c2b99af108df3c04fdb4b04645721
SHA1 51c978079e10c68f71e92ee0d6e2f5f0dcd7e082
SHA512 eb86921c3323299fe6c9330611a4924e7266ab1891c8fc9a8a1550285246bdaa781625e3dc34369b8a270cd52a5869d005fdd07849742ed73a9c9d492f31eeb6
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+Wac:A3kM+Y
TLSH
T1B8159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 878KB
SHA256 a0422bfc49616ffed68621e8313473f0cdf2d43a8f891c4ace35222fc6a3b7c3
MD5 7d40f76376fa8dafbb4cff9936c5c728
SHA1 8ab30d42cb620f99a41c3069f1ad3476847f88b3
SHA512 933074a24769ffc14656ce6f17ce7354e8791598f8b4be32a7173a060b9e7129bd91ecfaef493242e8c523be5a7c6807910d526a40d2bd1186eb490c414be9a2
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WTp:A3kM+O
TLSH
T15A159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 878KB
SHA256 3e01bd851ed236f84b487aff1b87d89f391a24b31922dc10c2e7aae8f4fff67a
MD5 dd869daaed2c68e240e65bbeca421576
SHA1 f80d30e840b527d9d31ff18e20f35ec399aaea58
SHA512 a61cb31cdc84d9fc645c51dbc854b66087afc5ebc9212ba62ac729d385e3b3f6062c2dd1b8c0afd30d3144e77dd6c50fb0ca9408d6dc71c19b364d67f77c5f1a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+W0N:A3kM+h
TLSH
T19B159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 878KB
SHA256 e36e283cdf990a522ea18e7b5a662f43af972ee90b182d6f76f9b3d2ffa0822a
MD5 dab7b434d7228f8f69db65262ff699db
SHA1 94f2dcada8b7639b45daac652911327b74b9fbd5
SHA512 29ffea19f8cd6d2e4d6246badfae472e95df0418699d7e7f2cc34660b79f98ef18b13f7b6f2aa6e08329a6d0439e5e497d7807e5cfa4535fd15478bed91b1248
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WcF:A3kM+z
TLSH
T1ED159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 878KB
SHA256 cd76549fdb8f24063d31c18491d44a4e519e3ecdbd266a7d36598333364c0fb4
MD5 ec01b6b2a0ceaf84fcbf9b950f83b5c2
SHA1 2266fc9dac1efaeac7a5b8658508258a0cc9d7fd
SHA512 815e410557664ba7fe11eaf12e02a60a33c4be0976016917fde138a3c2b8753e89b6624cf0ad0bbbda2511779063de23bdb868d2c89ebc9169a444294befdeea
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WJC:A3kM+v
TLSH
T19B159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 878KB
SHA256 c00284ead8fc879b937cb26b424f8be8d2564baf4d65e0f25f2c23b7346bbf07
MD5 012465b2d26a5424563438470efbb3fc
SHA1 24e4c99d9fe2890fab6cb1c4b6fe9ecdf1abe92f
SHA512 cca058938e0cbeadf18d550072ec841caed97015e8ceafd69838d3f906d3d814ad2f19de979c915b802068a8d7507b6d3adf3d399f89d6f7790a96558627a85a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+Wqw:A3kM+K
TLSH
T1F8159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 878KB
SHA256 1724434075e8d5d1526d85aa1e6b980a2a2763d9d334f23b088814bcef5477ed
MD5 179e720250f3e999a50c5ac31efb9520
SHA1 5024806374a893d815f98df016dc192e677e9fb0
SHA512 9eac80be3d54b69bd1ada53572f32a48e1d2d92ae0374ea84473ee937be7a1c286c7e9d8cc54b78f9789c7112dbb122afbb6436b794fcd10d6ecae6253d188f3
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WxT:A3kM+6
TLSH
T14E159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 878KB
SHA256 70d8563b04def93c8796485d28fd375f37b7468fc2794640584497c8f56005b1
MD5 f18f4310c0ba5286031a118f362cdc78
SHA1 c69e581cd1ed07e4ac50d94dadc341801d25e987
SHA512 72c2b74e327c7dbe55a853ad0de028f10466d77d80028484c88bb372da6c615dbf28b1d09fb9d8df4194c140fdf7af7ecb12fb74231e05764e473f2ff91ef74d
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+Wfu:A3kM+1
TLSH
T143159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 878KB
SHA256 61a7dcb0964d3001f69739663e2da48415bdc602870ddeeca3a6be2a8c03dabe
MD5 256f6befb784b64bb4ecd5ea34e4189c
SHA1 8933d9dbd0e2ad815fabfb7e28c6c5fc6696e6c4
SHA512 a615df9306fe2cc7905282be2fe4ec437941ef58ba448ba8d72e4ac9023f8162108d7353422ea57cb6f027890e62c15bdec0148e91d66d826618e6f1b6b15568
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WDb:A3kM+U
TLSH
T1E4159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 878KB
SHA256 910d9edfc5f9c5fc91010ded920cef318980f3dc3355c672c6974c4df706eee1
MD5 e63886d502973188240407ab71323b2d
SHA1 71d3f5d30595a6da9f868e9c20705a6493adf155
SHA512 d79c9b3e559bdd8ac8529b146f2df513327f90b8952f53515203bcbf874d151fc1d863492add1be2993fa82312389e7f8b4efd6f3798fc78f21385aa21c1fbb0
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WXf:A3kM+k
TLSH
T1A1159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 878KB
SHA256 fdd8ca72fb91cadf649e4f25ef18eeb96d4f0858e01ea8e8fb33dd5f56488ad2
MD5 9c129025a08d52919e9247c3590ec2a5
SHA1 541e066dfa04db3dc61d83e8294c253b1b5892fa
SHA512 478e6bb001e18a616218e06138936d82fdb28feb0ea5bf733709bda1df7f3d433cbb53afd3bd5a3699f5c31beeee5b3612c7b0bca803d52726c7a14ef5a11c8f
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WgK:A3kM+U
TLSH
T163159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 878KB
SHA256 630b06b09afe03e512e06d60b8809c0da4c0da233972afda6520f45a52442e5f
MD5 0f9f11504f4f69f144eb801ab811ae34
SHA1 c7786f16db613a3dc7e6bdec724dd29a97222174
SHA512 660767f52a596432c21c18cc43028fc2838f03b0e4ad583486038ac322739c5d21a79a765d6310ff4c590423915e71739a85c619674311e7312f98e34d760345
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+Wdk:A3kM+t
TLSH
T17F159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 878KB
SHA256 02bb907b06112bb4e956293f140d16c1b9539ffea988a52409daa4591b7e889f
MD5 46db676d7a9b8fd5ead84537df126d41
SHA1 def67892ebe8a6a28befa7862c8e4f61eb83c41d
SHA512 f387b0c6b138df81d16608e7186fefeb1e5298a58107e465aa9ca087337e22046e9574b93f4d9836dedfa9d333d9b291568e71269fd67bd7eb6d191c448c9eca
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WC0:A3kM+Q
TLSH
T171159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 878KB
SHA256 0a1ec4bb3a27c27d74e120ede43643fb00338ab5b139b712836b260cbe9a9ffe
MD5 dbe76d56c6e727ff03e2aa8e252ea0bd
SHA1 fd18aab03bbbc1f5fc0038e509212f768aad8907
SHA512 08522bc3859aeb627b5ac347a8cd3a85e72d4218b2b48e606414799bf6c27f8607a6bb716889efbc49d9be0d6080c477eff68de4e9918ca4501cd2c8f6761d5a
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WRg:A3kM+l
TLSH
T158159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 878KB
SHA256 769c4edbc0bfdf8c5fc9dc63717198dfc5e73977740352d985cfe7a5874a9d26
MD5 b4ef2b380ef12c70c0070dfd4bee285e
SHA1 116563ad8bd1e09c859666a414ef47d9e637f6b9
SHA512 7f395baef8fe7a3af3f6e0f46ecfd351fb2430bd0f4376cf2bf39ca9edc3b8ed2d8d0354c080f88babd0046d3ca3bc74e6bbfeff09a839d30af271c96170c05e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+W4r:A3kM+n
TLSH
T16F159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 878KB
SHA256 4305716979b1c57618acc25575645fcf18b768a111f893b71d99d150b2c403e5
MD5 da84b486f9baa5544aea7c4a1702f1d7
SHA1 90d36e1473873ed3225d42e862d8faaf06650f36
SHA512 46351f14924e127d0ec24f3f2aedd33874e2e49c956cd811039edef083a469ff90557ad678e5a2e745c63a8a8c3e190b3161979283b99408337cf44692698a5f
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WWn:A3kM+R
TLSH
T1A5159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 878KB
SHA256 b0f41eda0589575c443a1a6ff6b305a84f18f253278b60df1f1703869e1a02d8
MD5 716d8f599eacc0dd39e64a7604105613
SHA1 0acb21234a7e43745cf8b36f2f3450766c9cd75f
SHA512 d342069d52e0959ea0b8001560ca75f2b5fa1ea5bf1fff07871a91a717b8c50176d5d39316de9410d8a9d0dca9e0b0af2e247c3f2e92ff2cc1909e940ff80d88
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+W8x:A3kM+f
TLSH
T1CF159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 878KB
SHA256 69a28fbed55bcf25abb308804a0195333390ed02c319ef116459c028352a231c
MD5 5dd0cb30c177d22a1a84a4e9e3228ad5
SHA1 7eb02bb5d39b1d9218f20455ec0cd284d7c2fff8
SHA512 6dd63e980d228896533f336d6a64ce76f69413611b7c6d7f9b67bab2aa440250370e0a72cea4a84a02eb96d39ad4d41dc65d2b3e5917113f70a3afe8ce8e82d9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+W2A:A3kM+g
TLSH
T18F159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 878KB
SHA256 dcf9f063b485c93f4938af351f29c8809fcdf7e78742939c21261e78b577d404
MD5 bf8b6d06e4de6366f17df90c28913406
SHA1 2c1e8f83b33fb3f75837ce7a86a78305a4c49a5f
SHA512 ed279d0375ad7e0e1293eed2aefc686040fea60a9c1180fc7a5b511ae84afe3d03c562eba4f1564e5777a0b0d1de8d438b4c4293953ff5f6abb2f4dbd6e0de49
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+Wv9Q:A3kM+Z
TLSH
T165159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 878KB
SHA256 6c6d43227d4617a29b764342c48bd37d6a8b3739547a29ed35e1f3fc1f693c2d
MD5 42dcca05686b7214b8286c8cd25ea5d6
SHA1 4500d4eabac667c23cefc57e34967cc3a006ffc7
SHA512 5cc3b8b2049cb0d3a0bcebc0016e171de16142d8a74457b2782cf8e81fb929162b2a1e4bfd0b317f887f048c6ddc8c608abb9d4764f5a93a7a65568ee620ccb9
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WG4:A3kM+O
TLSH
T107159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 878KB
SHA256 50c2dc801e3d3828f8f6c64b9c7ff92702d83e36a02a9051aed9d4a2ebc39c35
MD5 26259c0b330424c376bf6bfc334bbf9f
SHA1 ee456ad1d3fd0ae8968fff6362fb4937998ff4f0
SHA512 a36eaf955ca66dc18ab933e4719a135e6c8886ec7a45dc2cb0c425ad5ce72153886a86055a45a14c83b2f1c99ae5e2bcd91a129833deae04ce7b812cb209e326
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WVu:A3kM+v
TLSH
T108159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 878KB
SHA256 dbed1815fb7540f254871025d378a1ba866e7539ce45766854939bfeb7fb6190
MD5 3ac01abc10291ab5075d99880f16e4dc
SHA1 3f5362228a37ee085a2f05b40c194ad6a6513289
SHA512 23693dea70001167beff6ee07bad4d445311339c4f13a8031089b2a3187798aad075cb86b481a00cc956e0159b618ad32f01e203d0c288dc47e8deea2bb672de
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WIj:A3kM+x
TLSH
T1AE159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 878KB
SHA256 1f1134b81e145481e5972fcebc73ca758cf0f8a096ec1d13f2384e09c33e368e
MD5 dd3b0369dfccc95e5281336d6d0520a5
SHA1 33036d61ea1bdbfbae63edad72634f8e7fefb35f
SHA512 8d7ed69a709e35381b390a2835a785335c65fe67e060c1ac5f227a380ec68c0c78661069f55367a68edd34e5319b3ec1f8adcd669f506e0337f4a0bc654e9c79
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+W5g:A3kM+1
TLSH
T134159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 878KB
SHA256 216983876bb291eee3ead1f8708044c06a0553b2ad79e71c2e1994bccf05c4e0
MD5 952919b67751dd61dab589b25e0ef25a
SHA1 84a688cfefb8b5fafeb26b0c26f5fbf276efbe41
SHA512 bc762a4022ea0bc1a68aa7e2170f140f14038a14fb1d51f896e2b61b2e0553f1128ec5dd1787a1577e4f963ac5b9d566e4e749e09c08396931a7394f61f6c63d
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WgI:A3kM+8
TLSH
T142159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 878KB
SHA256 ac70c847d41acca2d268442bf40a2fa9abda84d710175985991e6a8372c9c49e
MD5 44a49b2933cef9191f213e8064a33b93
SHA1 ee7ac1a53eebbb872f3e0925dc80f5d80149552b
SHA512 0875c7171e0032aa5156b6a022dbc290da6634df64bbe939dae09ea7d6dd32b3a76baed0d6c08c14978087330e9a8b80d69722cb9e83c8d43e9c2a888888bb17
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+Wio:A3kM++
TLSH
T1EF159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 878KB
SHA256 cd0455f656fb16f20f8c9b640b471bc6e11029046235967840235f32498671e2
MD5 c82ed148761e688f02ace6825c056b94
SHA1 d4db983f7e4d42b42d9177ab614737aa582a3760
SHA512 1ac16012e27160cca1cbe351dacea720327aefb2dc13c82d82af0081ac3874d7ef60471fc972ef3dd0a4759e154ed21d67b02ce1cad42296d2617a427140f035
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WZ+:A3kM+r
TLSH
T1C4159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 878KB
SHA256 63a4b11a8bf3da550707aa6c3fd597c4742d84116f06b48c35b0fba6095c3fe5
MD5 73b6fb5b0c7430a196ffdf618c8a2f8a
SHA1 2305c3fff552de15a1dfbb5bf17b2e5c98b85a14
SHA512 89c8947ec39875419c95623daa986835441f03b52c9de3abe2506f8ce05e7cc81cc1891efcb305987336530f82207902d49456daf5c9b42e0415a15c904999c3
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WHQ:A3kM+v
TLSH
T189159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 878KB
SHA256 194cc5f8eb30eaaaf20af81154e2cbc107cb04602497ebd16c6765c15d32f8c6
MD5 2d54896aa71679c0a95a3ebf4d90a52e
SHA1 4632bbebabb30b9590cb87b1e6cf52fb691c4ac0
SHA512 a3d883cfbd67bb80a068561495d50a21457e85e4d83bab327a7044b6be338a4576e00c90b7db35028a2e9f6dc7cca0b4d157bc648212fa03db12a93eeb680b08
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WcX:A3kM+j
TLSH
T157159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 878KB
SHA256 2a5c23d51cae2d947b7ff122b4d39065f4ed7f66100bcdc5c41310ac7bdf41d5
MD5 03bcaf5f7aaddd64aae37041bdb2f6d9
SHA1 0da63b7161de7a61b86e4453d523a4e35e9ea85c
SHA512 98fd3190cbc5cee4918c3bd10ddcd3c87fdf54bdb06475d4e6472f3ab3583ce829ad4a2969314723d8f49987b1e45c518881cf5d765a871fcb63524fc254a2ca
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+WaL:A3kM+t
TLSH
T179159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 878KB
SHA256 3d950a925a948b386e549e3b7a654ecc49f3b3ee6b3e71346be05013d40ad4a8
MD5 e3eede7c3a83c57365c2efa03c59026c
SHA1 70376dec3b6b592b2b5c9f189c7b4cccbbef767a
SHA512 5c4d564fa8ca0d6ff769d85697172dd85a9bcc3097de80169c8d0d3230b7cc274d3ee289270c4700f78602ab40e163784fbdf0e5a01e2b5dc1477df2b653102f
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+W+M:A3kM+U
TLSH
T187159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 878KB
SHA256 8b06348e0e0dd75ac0fbda202c2e4615c4dcefe253d056663dff2d1a3bfb41c4
MD5 fcee5499674ee300f92bd256f6143d09
SHA1 0bedab36a62f2644d262c79e98a4290c1e0d8c8a
SHA512 80eac354614292490d13884330d3b5a7965ce0a35b89ea0a549a7b34cf9581c9caa176a0d5e8d65f7c9279c468d362ee39cdcc7f78d846d2407377625129a66e
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauRaRaECmzyR+Wnh:A3kM+O
TLSH
T1E9159F03E7A010F5E656823499E65A12FB75BC221760DBDF136887252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3136-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5852-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5852-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads