46ce84bc791bc78b80f20e5971ace2606afdabc2271c8191fb8c8aaeb7125720

Analysis

max time kernel
105s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 21:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 907KB
Sample260716-z78a1set2n
SHA256 46ce84bc791bc78b80f20e5971ace2606afdabc2271c8191fb8c8aaeb7125720
MD5 72c959cb5a1a9fd00b5e760b13fbc9bc
SHA1 f4f9a0fc8b917f6c096c32631f51be882e2094c3
SHA512 4a70da3d1a16706e0f76244d546376caa5ded2583120416b83c01b483a9a4369eeaaef6acc1e122e03aed29e7ee5b31f909d8c7b060573681ed77ae24de5f80a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xz:A3mnXoZjzyaEFyKUluzyAZVS9l25xz
TLSH
T18315AF03E7A410F9E55A823499E54A12FB75BC621B70C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/2532-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000019f9b-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b2cd-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2532-27-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3344-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c8a-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001ba9c-232.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000018a5a-445.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-500.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00060000000198d8-567.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-610.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-825.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-909.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1095.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1212.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0008000000019f9b-5.dat	aspack_v212_v242
behavioral2/files/0x000400000001b2cd-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-40.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c8a-60.dat	aspack_v212_v242
behavioral2/files/0x000200000001ba9c-232.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-264.dat	aspack_v212_v242
behavioral2/files/0x0006000000018a5a-445.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-500.dat	aspack_v212_v242
behavioral2/files/0x00060000000198d8-567.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-610.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-641.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-726.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-745.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-794.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-825.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-857.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-889.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-909.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-955.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1052.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1095.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1170.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1212.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1324.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3344	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe

Drops file in Windows directory 63 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2532	2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
3344	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_72c959cb5a1a9fd00b5e760b13fbc9bc_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2532

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 907KB
SHA256 46ce84bc791bc78b80f20e5971ace2606afdabc2271c8191fb8c8aaeb7125720
MD5 72c959cb5a1a9fd00b5e760b13fbc9bc
SHA1 f4f9a0fc8b917f6c096c32631f51be882e2094c3
SHA512 4a70da3d1a16706e0f76244d546376caa5ded2583120416b83c01b483a9a4369eeaaef6acc1e122e03aed29e7ee5b31f909d8c7b060573681ed77ae24de5f80a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xz:A3mnXoZjzyaEFyKUluzyAZVS9l25xz
TLSH
T18315AF03E7A410F9E55A823499E54A12FB75BC621B70C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 8ce0ed100c011b8000a81a56a6f006b8e4dea8c099729296ebe30c48c2e0546a
MD5 d5ea453935ae1a9e8e4dbed4e278ec75
SHA1 962e135c1139344a9d77edf1162010908d4cc762
SHA512 24c45ad5ced75e714cc3bac9c880140f9f02895194dbc265f2a3e547394c26978f10518b2c58013a980869822961ac335516ff1a1542acaf7184810262815ccd
SSDEEP 24576:A3mnXoZjzyaEFyKUluzyAZVS9l25xG0Le5ji0hmxNrM:A3kMjKJSPji0Aj
TLSH
T1C3657B17F6A402B5D077C178C9E29A5AEB7138521B308ACF1399C7292F237D19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 922KB
SHA256 224b4ecdbcb68694957749007715851a267bd77cdc97fc48a9c74b01b2837dbd
MD5 2f9af073fd9c173ede702e81eddc49a8
SHA1 a534c63383cc8db16f387acd34b35ec3b760bdb9
SHA512 9e7f46faa50c24c980b2409d799158a8a92dbe902cf465090527259bf4c94e4d46220d7f0e7dcc5d61b15f5434032ecda4543943a9aa68eff317b8095d0fab20
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xQa:A3mnXoZjzyaEFyKUluzyAZVS9l25xQa
TLSH
T18E15AF03E7A410F9E55A823499E54A12FB75BC621B60C7DF236882252F737C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 955KB
SHA256 60557e25505e1593cf87de48dd41c1a80d74d8f7320e738e2840a1480c6171eb
MD5 4917441e426cec14c7017da11de73c37
SHA1 b6285d0b1d179f054a2ccce90dd2b56e33163e53
SHA512 d7793b7bae14ac90fde453c2f5a9dc343ccfd8f8223d9b631f17cc13bd3e5d82b9d3321463f749af411c6f7e3757fd558751f8d2f22308bf37262a1271d51647
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25x7b:A3mnXoZjzyaEFyKUluzyAZVS9l25x7b
TLSH
T14025AF03E7A410F9E55B823499E54A12EB75BD622B30C7DF235882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 931KB
SHA256 c05c5852b73e0c31bf8f39f4a2128db48f27626724edece18e0984bb7c53cd0e
MD5 5aba2b4edfbdeea9dfae53230a42e437
SHA1 6d46cb214c90791a755be9fb96bb63865b768f83
SHA512 fd45a6630c828b65aeeea8287253abc56087b3d6b7f6bfaf0d36e1f4ea38c642c548d79a725fd34617e7abdb25ab5b928eeb34543e1d2801ba548196bdfd16ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xp6:A3mnXoZjzyaEFyKUluzyAZVS9l25xp6
TLSH
T19B15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 931KB
SHA256 c31f1025e5d9e2712990c713f7f86d34af4b180067e27781a0b425e1085851db
MD5 9cf8a647e9c4d7006a5a08f7db985cc2
SHA1 9c973e4c84255bc32692702ada2d8c4bebfb999b
SHA512 4ce5364d807139097a6dbe08e6642457b0f38b9a401169fdd08ef024a5b24921918d6835edf0afa6c4eb46750ceef6185d8183781981b648bbdf333189cfe2c7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xHN:A3mnXoZjzyaEFyKUluzyAZVS9l25xHN
TLSH
T17915AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 931KB
SHA256 f1f64e16b9d870fc6dac92bb5bfe1b5794ca86cdba0d8021d27d1c7aef0ad57f
MD5 c43be346ccb3efd2c8465c3d658cffcf
SHA1 40a44cc9a6df8d7f8d93f24df0e50340c865815a
SHA512 ae734a94fe4de95b7547c935558edcaf8dd34a690c5735342dbc0938d8d8faace6c1a0d171b66ad9e629b8ee196cf108082c58d4fa0f23f2eac2563506d6e6f6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xdf:A3mnXoZjzyaEFyKUluzyAZVS9l25xdf
TLSH
T1A515AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 931KB
SHA256 cdcf1388ebc7febb3127fbd89236a20247e43282efdde568e80b8ff99b68c186
MD5 cd181684ac2d67af1ba13015094f8cd6
SHA1 7c7918bffd7a6a3b633ec0f8d9a7b8a7b8687dc4
SHA512 712aea00c4fe22c6fe8f2a9866b4f61d2518a3ea987c807ca564e56c89d0f1d183f56120d4a4caa009a663adc49591eb061a9f12697522d0c3fe8923a2eb84db
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xfo:A3mnXoZjzyaEFyKUluzyAZVS9l25xfo
TLSH
T1AA15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 931KB
SHA256 613873627513a9a7f2285fd966131eb1812bd2558311898d87b1748e5cdfa833
MD5 2df6c04574b675789520ee253921e821
SHA1 c5e8472a9ea55cb09ea6ae108f1bbdc89d3f3fb6
SHA512 295077b7a239255d1fec5576debe04e06d607ea8526d29da56d85ecdf0c7f024532a7d56e2e2979210bae8c272d2c4820d07202f7b61fe0c56ef18410e742226
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xDu:A3mnXoZjzyaEFyKUluzyAZVS9l25xDu
TLSH
T1BB15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 931KB
SHA256 74137ee685aa4079ac5f4c58e9f9e84aebeb9b5a782c32227770a96da8132521
MD5 d7106af0476b8b416f80ef5fd93960ee
SHA1 a52fd18f5cbe5cad62b313985358ba16d7f7e3e5
SHA512 252d097144199ce87d55a0d40aab31c1700f905df4d83b9732e4c02c2f3bd39d3eda66133f57324d2658dcf3322b1db6c6e0349bb55fc421f6884c8c895e8ed8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xx9:A3mnXoZjzyaEFyKUluzyAZVS9l25xx9
TLSH
T17E15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 931KB
SHA256 0581c95e616f2b1d96653259e7bfb6af498362c158092faaabd38ac62ebea6a2
MD5 fb30eff49cf1d2268d4213ff10a52546
SHA1 0a2446ec333c90c39fd28c4bbf9e057dbad631d1
SHA512 526cedc4f54c9e544c8f7b4d5a2a0d5c903a6bd214d3c487a9206e0c05880ce3834bbc249da86f07e12653c2c3ed596cae04acc4a593d3bc011b9eaaf7f2617b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xtc:A3mnXoZjzyaEFyKUluzyAZVS9l25xtc
TLSH
T15215AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 931KB
SHA256 fec8e6a8cecf2f40877e4d265027afba5272eaec179691df4051c54bbe91da72
MD5 436d89a8e9b75eacc040e9d169eafcf3
SHA1 7ed4618f8b17043f9f2f7505f17704eeba3a6811
SHA512 3cf2d8b017a9a7364521eee1f8bdf582457b9f6c1f2a15b3b9ea59aadaae00cc28bb8795ad207b8e7510a7d737ade15a6ea6f26e556ac9182df7c6a28dc9b522
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25x2p:A3mnXoZjzyaEFyKUluzyAZVS9l25x2p
TLSH
T11615AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 931KB
SHA256 f8c8adf77782da889dbe7c0e8cf6d8924c4befc9db0c74ef215f3e4068421437
MD5 d03e1c9316cf2b8285dbf98a252a026e
SHA1 7cf222b13523d493dc4652dc31aaebb3343fbe35
SHA512 ecf890458d647c5432438b602429711313df56f4187b0070786802ee000e9c2165dc695a70925fb2a4567c625cb72d75fff2983a48ef90cb600467392eb15cfd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xZ0a:A3mnXoZjzyaEFyKUluzyAZVS9l25xZN
TLSH
T15215AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 931KB
SHA256 9fa3290242c0908e7edf798d79afd48bc9664555a18c285589209c10585ec462
MD5 5a0c471a17dc29b83d05f09d3c23c4a8
SHA1 a3cf48c773ed9803f47fe57b3a9e1c4348e20c62
SHA512 4dc52e777859caa7d5b0818147de218dcf6f3eb6641bd3fb8b78912e26675293bb87befbe66f34bc45bac1cc5742e1b9cd55059a36c1e911106ea5f64cb884d0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25x7F:A3mnXoZjzyaEFyKUluzyAZVS9l25x7F
TLSH
T1D515AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 931KB
SHA256 021f124595d93cfc3d8aa15fdddb73a3f91b155db8d0f649f3d7a30e5a4f3bca
MD5 d112d65468902f9401fc281f044f9dc1
SHA1 1a437e54a2c74c2fcab980d4dd771eba04d8cd86
SHA512 fa2366e655773db7c34496c264b7537437e854ad488b9d55c3bdacf3ef73fd5cee8d47200821acc2f2595513879a2800c4a0aef1d726bdfb10b3d4d006fe9fcd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25x0C:A3mnXoZjzyaEFyKUluzyAZVS9l25x0C
TLSH
T18215AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 931KB
SHA256 8e210abfc03ff7c801bd7289750d617babd96431ec283182a7d57753256b17f4
MD5 76992a32b307c9025ad91b0e26c002ba
SHA1 747a0c96b27a367877802b52ee4893febb95219e
SHA512 eb4e1e7dd122fbd7f5e960cc7dfef5840d8b8a641f1ffd4cb8bfce6d60989504ce9fa6e6cd8c58f6489b52eb3399e02e9ca9742bee6611dc79b6a808c6973540
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xPw:A3mnXoZjzyaEFyKUluzyAZVS9l25xPw
TLSH
T1C215AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 931KB
SHA256 056debfc12b0fa45be5fd0a8d3c4eed3341dd745cc4ede31c7c9d6e5e4ef6333
MD5 c8dfc57694a3f3c753e0ab81cc31045b
SHA1 ece8ecece16d4d8a4f3e03d5cff1a5e0cf0a4659
SHA512 160793045177c6a19ff8fb21a8292ed77271fa166448095d3830bb3935c4438f8513bc506392c9c55bff6a363956ae9fdfd5e12de576728e0957adff5353a9b0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25x+T:A3mnXoZjzyaEFyKUluzyAZVS9l25x+T
TLSH
T1AB15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 931KB
SHA256 eb5f571a6ac5689ffac2c529612844957e029e97ef6e32a7117efb8a376a6f15
MD5 98f695478074b56a38360a7a2b35dac9
SHA1 9c98849dd95907235d911ad4513bd586e265dfbb
SHA512 eaf83b5d94afecece94b2ae2dc22bc27cc57dd6fb95eb3e62d013cc5ad4e3107f60914e6ba1b0e110ccadfae60461f08b42c4d246a646a75dce6aba7ef9e2527
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xGu:A3mnXoZjzyaEFyKUluzyAZVS9l25xGu
TLSH
T19915AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 931KB
SHA256 35083ea3d14401b4d8488449a2aa85512204c2614378fffe2647cdf0804f9616
MD5 b0062affb4725edc2fc574b18d0a2cbf
SHA1 324ad9bfc3b6e062c83b98eb229f2d409f77bb4c
SHA512 5db0db6f97ed5b5fcf37a55b449658ed7ffdffb5d52dab1331cb8d88282cad23104d566523c330634a551eb77f52c2cfaa334dccf78d9ace42abe066b7baf724
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xwb:A3mnXoZjzyaEFyKUluzyAZVS9l25xwb
TLSH
T1F915AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 931KB
SHA256 e3a049e9c2202d2c1b72e27eac42403cbdcb5f699ea976662c32e5fd7c13cfe4
MD5 f00b6a3fb01617ae2da14d3967a5413e
SHA1 ff4e7066d24b8319f5224eecff1543d52e5eb62b
SHA512 4e84ddec827abc98de3e2bb4c6b990ce3449ee3685d2c3084c3da0b2e081d0aefec729e0ed936b8389831951a8f7cb3267172e15dad914565799fc191ae7102c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xef:A3mnXoZjzyaEFyKUluzyAZVS9l25xef
TLSH
T10615AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 931KB
SHA256 a205437258dc263cb37d8f10e66e8671de9a9ec20bbdb4c61001f4906b4ba6e7
MD5 ae9a3ae39e0cd42b401d42ff5c6481dc
SHA1 2b813df568f1809873da964c9295ac53a9f7776e
SHA512 c9009fef25faff04f5c9b42c96324289ee7c21357648e970ea799aa715831f4818cec724e1acb69a3323289e98a6665dae22a8b621c969c2bb824e83d541d1e1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25x7K:A3mnXoZjzyaEFyKUluzyAZVS9l25x7K
TLSH
T1E115AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 931KB
SHA256 066e6de7cbb3bfe3b43f32edfb49029e77faf9920f7cd88d2933fb2ebb71dd53
MD5 79c1d387f7ce47231e10a64b6dde1b7a
SHA1 d8595f699c47a4b8fcac085f2d37f805ca86aa06
SHA512 536a4d338b57e5a11ceae21606e9fa6559fa03d902627ce0cfab873c68d11684a8ea1566b2cf10657314740bbc4f6b69923d398ee613f7cbebd16f722ac39e97
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xMk:A3mnXoZjzyaEFyKUluzyAZVS9l25xMk
TLSH
T18F15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 931KB
SHA256 825af09ddcb2aa643ca880ba9447bfdda0305c7530d415d54e16bfacc9e1ba6a
MD5 11404e15e2f9bc5f0ce7c5b123b298ef
SHA1 c13b521d5edf931ab90ad05a691ca91c8bfc50b8
SHA512 7976cc10932bed2951dbec56b037ecbd920ef7c0e08e83538a63f03806972787dfb6edb1b442696a1ca9ade135966437e1ad440e9c7ef2fb875835af50505186
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xF0:A3mnXoZjzyaEFyKUluzyAZVS9l25xF0
TLSH
T1A415AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 931KB
SHA256 cf674890d1865e4ca7ff6cb1ee8f09425db0c6e650aa4142e723a79a506cb6fe
MD5 eef1f09eede30d0999d524f122f103d3
SHA1 024d5f223c758f0375fd339f211cb8ad1133b9bb
SHA512 49f1a4478463d63bc9ca1a5a10c873fd2b6e124b57b18510d3a8161b98f63c3570e9f4122399fe1416f2200a1ed8f0ea076d4ac603dd8529fd0e8ad8002de6c0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xI70:A3mnXoZjzyaEFyKUluzyAZVS9l25xIg
TLSH
T13015AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 931KB
SHA256 23ceaf255980e74165a1b6e81c14b9e752e58ec9f6eb30c87e187c1a4e1a5117
MD5 65def8543aadb4b3308f68ec9e9060a3
SHA1 cc2ba881eb89a8fa45c41e3ea057cd5a001a03ae
SHA512 a8a95573ceeae42c9ff5ad07545c7f0b91240ad58cfc78463c007c80e00fd33a6acf78c4b4cff919cfb4aadb5479c09a16042d5c71dac3b496cfa6337d8b604f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25x9r:A3mnXoZjzyaEFyKUluzyAZVS9l25x9r
TLSH
T11415AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 931KB
SHA256 9caa37f5cc0fe8077e5dd8466d065093f6235988603cd77de3cdb3e30ed39254
MD5 050b2f7ba4ed04fa63dc15f90ecdf89c
SHA1 02a8c66f48ef5d4a0140fa55bd826d4cc9331b64
SHA512 1424627a0deca63789f411a99917f18257a8e19e0baa257c64b4314556439b0731d9673a92b7699c5158e3caa0fd5dc03cdd05add9a6e16dc69930640b22984c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xHn:A3mnXoZjzyaEFyKUluzyAZVS9l25xHn
TLSH
T15915AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 931KB
SHA256 d5cee3edb58c5798ffd32dd8c7805d07a754bf1fe235e9d3681e70be3fcfb1b3
MD5 8a919f6279922322d369113f4ebff7c9
SHA1 995a784e82fd5aa897bc075ab9134d68b630f14f
SHA512 d35fdd990b8fb92919e3a59ba6a0a2089d9c43d5ef89384d0d6bb710d9a358b5532521f36f41cf84be8c1992a7ccb41359747dde8f493a279fbabadea27c2fb9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xjx:A3mnXoZjzyaEFyKUluzyAZVS9l25xjx
TLSH
T1D915AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 931KB
SHA256 c1e239d985f15a589e3443c1fb3060bd06e59684eb4cd5903e98c3cbe7326a60
MD5 e24581ec5b8e618fc405a736b46cadac
SHA1 4c9f4c5a674d12c58da112d615ea81d924e1e3e1
SHA512 0a6395f8e29f14d006feca88137c46aecd3df98335c6b069e9086c5a170ea4c1dcfab8107542b1aca738083e05d39d201564e477af6932065d11e30991c45fe4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xhA:A3mnXoZjzyaEFyKUluzyAZVS9l25xhA
TLSH
T1BE15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 931KB
SHA256 f8ebd5cfd75c3e73093c2a2a41f98ba6a97fbc8dd5a645eed7bcf9131f4f9cba
MD5 80d416d538085fc7868faa0c1720293e
SHA1 22bf7059633bd5db23ead3e2ea84b76e22c4dc06
SHA512 4cfebb133ef3b5a8355cf4f0c8342ac1f11d9f60e546cf7c9dd74c30e9c5ee43564095859f6ced29ce8ed7e2353df22b97e93ff1b8caea632c91195cd794fb3c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25x69Q:A3mnXoZjzyaEFyKUluzyAZVS9l25x69Q
TLSH
T19315AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 931KB
SHA256 8e7a63a3c8c478998051f6ea19d9690406682db6437d5dc8c7c7c8ade9bdc277
MD5 aa0aac5e5ad7a5713e0019871d02166b
SHA1 52e7fe610502461e6b1f8c51654cf62d6a61ab71
SHA512 6d1f264e09eb50c8b59870920b92968d29c6fd76b0d66c9fd493aca298ef6987d42ba0e7f81c1a6c3b292f2d0f4107d9dc5b85068f1ba5729c979537f94f71bf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xv4:A3mnXoZjzyaEFyKUluzyAZVS9l25xv4
TLSH
T15C15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 931KB
SHA256 0e6c1ba02a86afc447a80d3d675b19ce84c3547c296332d131c6aafce07d2362
MD5 b97ed202c54563310525f51b1af19d79
SHA1 8072f5e0c858673ca13856d13e1ef2d8edefb744
SHA512 b19b328ccf67a3b5126a45d7236071dc3953be91ee016854fa350ece41047265d8b9a3fa10c6e382d417c44adda7af7c354b1d99c5d6f451a088aa999fb62473
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25x+u:A3mnXoZjzyaEFyKUluzyAZVS9l25x+u
TLSH
T16415AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 931KB
SHA256 6636794be65ef0f4d83c1af92cb7395b48a2b47fe64f7835508ae54c741a9701
MD5 3154b72aec86740edbf3b87b19acfe90
SHA1 931b00183104a945ad5822608776daf10b8b518b
SHA512 1c90cb98004e0b798af0ee4f4620e6d5bfc5974540d84cce3e4e623df3a5ae88f6910d437e492bcaf2ba53c0ed74acc080fd13ef196a2e66c7fc3fdd67d7d4f7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xPj:A3mnXoZjzyaEFyKUluzyAZVS9l25xPj
TLSH
T16D15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 931KB
SHA256 91af01633ab1e822bb849ad4d84ed3b94d1d5066404ab7ff033337f839a83371
MD5 68e7662be8e8d18187b0354583212059
SHA1 9a52eda06f2b0597ccd33a606cefd3d871b66dcf
SHA512 b7645b5d6511f872822f5a85d81e2d8034208aecb78645c0f39c5ee009e11368ebe91fbbd9597ffdbd5f92c82fd7f0480c9bbbdaa42d70a281666ce3567b5342
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xag:A3mnXoZjzyaEFyKUluzyAZVS9l25xag
TLSH
T14E15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 931KB
SHA256 63fa70cb5f332a44a22b006378841f7efb62499d41c1c13ddd81a97dbb204ddd
MD5 639b21b7ae12547c61cfc94360acf1c7
SHA1 7cf6fbb8e6a0cf8943128ebcd6b3548aac5430f3
SHA512 eea8e38f2531f39f04e737674e64f8e748580c0a8f9d9c719220060d229a706625d25cd3598b7049b8a58c9f1f06f8299f86088cbe91235bda7e18544d2f38c2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xFI:A3mnXoZjzyaEFyKUluzyAZVS9l25xFI
TLSH
T12A15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 931KB
SHA256 cd07e88d53474d1e0d9683df8cc834a01e6f3f86c74b044613490ecea7db0ffe
MD5 773b4879cb406f0916278ebefe2df2f7
SHA1 c30804191a1a654482525c759ca89f5e2e2c0814
SHA512 a5556395d350d14827c1e85fb83e1b9d28a6bb961307c654c597071e6cc6ec4b5bce81aad5527b87675250e34a5a2f93e7c51a4b8082f544ae90bb5ef6d4469a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25x3o:A3mnXoZjzyaEFyKUluzyAZVS9l25x3o
TLSH
T15915AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 931KB
SHA256 0773963109eb0556178dba2993ab0c619bbee224a7d3524b9b2d57483ac7aaf7
MD5 38c509525bf50d9d506f245273345325
SHA1 212f9282bcc09353a5c681c85a76f6e283837e38
SHA512 759c7ea0bdd2107d500fdeafd8ceeefe285fce25a5916a3dfe106f69fa2766b08fc687952ebbb6aceab4f4d274d45c1e701d6793ff167c52b6e6c6a96a02a64b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xc+:A3mnXoZjzyaEFyKUluzyAZVS9l25xc+
TLSH
T1B715AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 931KB
SHA256 288e61974fac521cc676c60a569c4f586c239d06e473bea2badf040c9d9de145
MD5 4bcb09dfe357aa16ab7d795ec0b04028
SHA1 5317b1629c6c99604b884cb8f645560416e05f6e
SHA512 e98f36d8e4e4834788cf24b4d50a99eb5d0195f4ee866c868d29f19c009b0ac5d534f4091cfc846cf4359749dcc62e90d476f523f62a96caac2c7537c6620473
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xkQ:A3mnXoZjzyaEFyKUluzyAZVS9l25xkQ
TLSH
T18615AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 931KB
SHA256 7c40108083890fa2f606999fffbc42febd69d220c6dc03cddcc431165ef30930
MD5 ffeefb59e32f45fae59f2796a795a2c7
SHA1 9f9c4e0cd4fc61005f657fb66ecbb7422f6f1373
SHA512 a4da9833c151aebf8416e8b2daae66be095551abff8daa4082126bb0743be52443799581f2b237c3a3501e72c4e581e60e9c3159794019696503687e37c37485
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xdX:A3mnXoZjzyaEFyKUluzyAZVS9l25xdX
TLSH
T1C215AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 931KB
SHA256 cef10b99865092ee885e164a200dcea661231d529d244f9ff7faa3e2f7df129d
MD5 c2023c4679eaa392340660617c7cfcbf
SHA1 55cbd3d2646335face144d0b4b1ccec5cb8b9dcf
SHA512 25461aaff9ef89b32c307db1654d83d82cd2969b970970ee123e85477bd426f121b15c54b5326a0818a858c7c833212da4f5577065fbe9df92a99640cd5ed99c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xfL:A3mnXoZjzyaEFyKUluzyAZVS9l25xfL
TLSH
T1EF15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 931KB
SHA256 739a248cca1f2412e96dc0fc6c0b6d8bf54dcbf394e16cc48df791bfed7ebb57
MD5 3a182b00d8d3ad86b432c045722574b4
SHA1 e469534beee03bf4ac61bb99ce72197eac7afc6c
SHA512 5011bad741d1355eea943241c723467448b42e82e431b2b1aed2b1b64351e10ec970d0b3fb277708750903d72df34bd195cb4dfbe3a5f139267df70c97a6e4af
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xVFC:A3mnXoZjzyaEFyKUluzyAZVS9l25xVM
TLSH
T15F15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF236882252F637C0AF3A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 931KB
SHA256 1fe802b615004398914bdb20260ee6be4463b47aa5a397ec49a61d80a3709a42
MD5 9f487faf406b538a470ead861987b1e4
SHA1 67bde47326ae67c47e36940c1b08687be6b439d4
SHA512 33c600b5a428198518bd3e094dc9a1bf9ff25253c54dae76f6de34b0c75fec69f97483c867b334923098ae938625d50bc8cfe71ff888a7d100964f498958d05d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFyKUlDyPz5L8AZVS9l25xmh:A3mnXoZjzyaEFyKUluzyAZVS9l25xmh
TLSH
T17C15AF03E7A410F9E55B823099E54A12FB75BD621B60C7DF235882252F637C0AF3A7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2532-27-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2532-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3344-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads