19da0d423c59564dc5f942d4962de1fad1806704cfb73b7a517b9eccade411f8

Analysis

max time kernel
97s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 810KB
Sample260719-2yrb9ahx21
SHA256 19da0d423c59564dc5f942d4962de1fad1806704cfb73b7a517b9eccade411f8
MD5 3cdeb26ca28f5734975511227ac9f7e4
SHA1 5d06cdd9d2ece39976299e4c13b37a20e46507c7
SHA512 cb3724762e36a306d0500a7324253ada9bbe9e53f15ea12acd5c8c84e76e9f32462714e5a8c0d97e85ed2846868375477aa02edc497c7a4a7c24c0cf420d609c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLf:A3mnXoZjzyaEFo3+aWiausOzylpLf
TLSH
T13305AF13E7A110F9E116823499E65A12FB75BC221760D7DF236883252F327D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/1112-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5c7-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/472-173-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1112-172-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-434.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb03-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198d4-514.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-715.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-975.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1355.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5c7-6.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-434.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb03-489.dat	aspack_v212_v242
behavioral2/files/0x00040000000198d4-514.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-599.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-715.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-975.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1081.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1130.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1174.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1181.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1322.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1336.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1355.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
472	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1112	2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
472	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_3cdeb26ca28f5734975511227ac9f7e4_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1112

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 810KB
SHA256 19da0d423c59564dc5f942d4962de1fad1806704cfb73b7a517b9eccade411f8
MD5 3cdeb26ca28f5734975511227ac9f7e4
SHA1 5d06cdd9d2ece39976299e4c13b37a20e46507c7
SHA512 cb3724762e36a306d0500a7324253ada9bbe9e53f15ea12acd5c8c84e76e9f32462714e5a8c0d97e85ed2846868375477aa02edc497c7a4a7c24c0cf420d609c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLf:A3mnXoZjzyaEFo3+aWiausOzylpLf
TLSH
T13305AF13E7A110F9E116823499E65A12FB75BC221760D7DF236883252F327D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 1e698ab34458e5aadba95adf6ac187c006b6c03cdcd0cbace74168c317297de1
MD5 ecaa17aa3f50a58abc8e945d5e03045f
SHA1 769d5d158b7b57932db8036aecf24e7f4835112a
SHA512 bd4c5ace1fb55d3625e871db1a79e5ec0532156acf8a413c77e11b6dd709dfb33777e09d4614a6bda1602485e8b19df816e70b46955fd003ba93f0f975307a76
SSDEEP 24576:A3mnXoZjzyaEFo3+aWiausOzylpLL0Le5ji0hmxNrM:A3kMvWPji0Aj
TLSH
T16A556B17F6A402B5D073C179C9E29A5AEB7138521B308ACF1358C7682F27BD19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 825KB
SHA256 d0ace5a19434c51227a11ca00865212e59acf4d8439d9f21779a45e6405dd172
MD5 786d1a3cb58d3600255a2d69ec43c5a7
SHA1 370d727a3419e0f3faeffb2d8b2303e2edd11716
SHA512 01b5025feea459f23349962c62415603a2be7feb26f90c190d23110c37080d2557a37a9495ec17ad005c1f30a1fac8238ba64f9eb269aaf3a3f1cbbb30df6df8
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLNa:A3mnXoZjzyaEFo3+aWiausOzylpLNa
TLSH
T1A2059F13E7A010F5E116823499E65A12FB75BC221760DBDF236887252F327D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 834KB
SHA256 258bd73f25f2d159af23a5a2c9f507998183b7713cc595fb7d4d5e220a345a50
MD5 2b34b07d2b0a0a4b8ff2c144cf06133a
SHA1 f2cf8ba2cd18908216668e0428dd2a2a3d74d625
SHA512 90d7ed2357a9d085ed29a8f07738ef26f60173789eec874fdc9f72a0941a61d13b99c9309ab2cdc911837f0385a944b4d5e6ca7762f4b50b3feea4adafd4c177
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLE6:A3mnXoZjzyaEFo3+aWiausOzylpLE6
TLSH
T1F2059E13E7A010F9E116823499E65A12FB75BC221760D7DF236882252F727D0AF3E7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 834KB
SHA256 797635a7367aa3435c503cfaae794f8607c1fb102acb2a923d6fa0e90c05ae9e
MD5 7f8c5093d21854f2e6c4554736060dbc
SHA1 f98cb97aab015948284047cb19d4beaf305ad460
SHA512 23abcfa2fdad2234e00af3429a861e5b7f33c238a323e63809c4e06bac2422a0a0673c45045724967ca2727141d961a9eb5b94d1813e8c9841f117be17099a6a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLgN:A3mnXoZjzyaEFo3+aWiausOzylpLgN
TLSH
T12D059E13E7A010F9E116823499E65A12FB75BC261760D7DF236883252F727C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 834KB
SHA256 408855b39faca3086c53e650511a053aa3a92d0b96558e1740c17d0fa6362d29
MD5 ffca797176a13870c431889e62c63a5e
SHA1 6bdd097f00c8d6b20abfff248cb96940e1ab5a40
SHA512 cf46af2a5969e2ded0c4ad6d65a25aeda5b60cfb8b37b718bc97f055b9ee9eaf16299be68ba3522dec261a36d3e6e69195e631c9091f306fcb44d0380246e402
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLOf:A3mnXoZjzyaEFo3+aWiausOzylpLOf
TLSH
T143059E13E7A010F9E116823499E65A12FB75BC221760D6DF236883252F727D0AF3E7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 972KB
SHA256 9b4dd82177ca4fa8607624f09c116454c335ecc98ec1f80d6341156ceaa6335a
MD5 5782591bbaccfedc3e67617eb0b6936b
SHA1 d57154b9c028df7186feb7115a1b9dc4203841a6
SHA512 653e42d7111f5fa0cfc4a7836f9788455a12067177be5bc661eea78573c6c02dac8a2d1988a0bfc284bbf01e63a6115badbaa0b43048d38815a55556378dcba0
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLsyPz5L87:A3mnXoZjzyaEFo3+aWiausOzylpL1zy7
TLSH
T19C259E17E7A110F9E126823499E61A12F775BC321760DADF136887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 834KB
SHA256 4da87c4e6ae2840b84101455414b3f1df12eb9581d471afe066fdcfe27c3d871
MD5 abd44fc473dd162e7b847f7d3b6dfe8a
SHA1 9056eabd85158381bae49a62fe05d1f8a081e1b4
SHA512 91b3f992ca158639104769c404876b6d0644c6ccb9f3a20d7b7dda72af83cb16750cc740fa434c8f714f943069099582a5876bbc56c2067a3ea52421377ec2d6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpL4o:A3mnXoZjzyaEFo3+aWiausOzylpL4o
TLSH
T1B7059E13E7A010F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 834KB
SHA256 a2a0ca494fe602bae880b7257e668aa769755703936df2ca0d23cd250cd99569
MD5 bb418ee95d264c8e8ede027f50655196
SHA1 0018aea54f93448c9eec8ced1f58dfbb0eaa63a5
SHA512 2b572cdefe44f492aa0a0f6856516683927ab1c183472666197600f67d69d212fc752b3cbd90c27557de579ea1953da9ba0bbb71fb7c89f34a450678e843db56
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLIu:A3mnXoZjzyaEFo3+aWiausOzylpLIu
TLSH
T188059E13E7A010F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 972KB
SHA256 26c5cf536c95532b4dc8aa170d839a0768943e55aae1c1b6c88c23b83d19d11d
MD5 86babc2e16fea6697c55f6284132074a
SHA1 61ffbf7c7a07beb4970bbe28236bc15073603b08
SHA512 34fce362fc379a796b9f5e201c1e5e520e319bfd82f1232082cf80f73bccea3baf8e0e1cc8afc43558a988dc06e503c349f87010e3ba2769ca253e203a088239
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLtyPz5L88:A3mnXoZjzyaEFo3+aWiausOzylpLEzy8
TLSH
T1E1259E17E7A110F9E126823499E61A12F775BC321760DADF136887252F237D0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 834KB
SHA256 a50de3721e0ac85aad6f91a6159db629fb257ca89d406c32860373769cc215c5
MD5 b3ecfd358e533e2209be220a7bc3e89e
SHA1 cac0555e60022ef18534f2e1c9260e5164792900
SHA512 3ec021917d472cbfa6a789fe2248ab243014baa76fe0c0e921153e1cf85f87e2d6b5fd5c19aac88d0e6f88edc6f6f1111303d9ce490b5861a82117a5132f1296
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLc9:A3mnXoZjzyaEFo3+aWiausOzylpLc9
TLSH
T182059E13E7A010F9E116823499E65A12FB75BC221760D6DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 834KB
SHA256 8697f299f64d92e2d3e5cefebd1d6506e32a49cf3dd93b8a01ff763e12562cf6
MD5 04fedc58cee67a8c04a5a2b0f722ddd1
SHA1 a4bd475b17b61aac527d2e6d1963acc1430c12be
SHA512 cdab5b87a445980b9246e2d19203a43a2b260afbf4c00fe24e946670c152f15e4eb86d81d6b9b72bdb5dfe6fd04bb0a84311734a8f9cb85ca7f9b7e87888c975
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLEc:A3mnXoZjzyaEFo3+aWiausOzylpLEc
TLSH
T1D6059E13E7A010F9E116823499E65A12FB75BC261760D7DF236882252F727C0AF3E7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 834KB
SHA256 b368ed4b04065025f5fd305102034417f62498af48ad8fd8cb3fadac25d9ebfc
MD5 8a55f7f62accb2780c7c92871134ea45
SHA1 70fb587551b23a0b4111c95b3e68ebbdfb0b6dfc
SHA512 baed9f6c1dbd84c252dc99192b7e410f29da9f8cd849d6e233ad245dcc26c9bab07a06a2e5381f0aa56e9936dabeb92705931c6427126d49cd7da438929dee7d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLdp:A3mnXoZjzyaEFo3+aWiausOzylpLdp
TLSH
T120059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 834KB
SHA256 c164f501c2e9497ff8f459908bdd611994ddc747a7ab256ffa8a7a94656991b4
MD5 468cd68ab1fb53dcffeb6d62fb9a9b97
SHA1 fd2a28e3a309457dbb011b2b71b10732d0207664
SHA512 65f7b9eca5ac571b4ae88c6e3709ebd357b1bc47edc5852b0756f632da686108625c2fe3cab2c8b3e554d0e5adf92c0e0ed0aecb7de687a8bda694148efd0b76
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLi0a:A3mnXoZjzyaEFo3+aWiausOzylpLiN
TLSH
T1FC059E13E7A010F9E116823499E65A12FB75BC261760D7DF236883252F327D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 834KB
SHA256 a237998e35c73dd988c85047f2cf408b160476d921cd3e9ba48d92217d7edc61
MD5 bc96a712978f3528d2e41b399d5e3921
SHA1 beed51fe38b2eb960b3a9fbdf7eeee87eb7b9262
SHA512 d80fe35de169d8e757ec61dbd256364ff3bdaa8f5167b66975fc0cdb7fd945653fed4b9a3f92f04b379d0aaf7aa39d84768a44c7c9e3bc8c64eb320dddb05269
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLGF:A3mnXoZjzyaEFo3+aWiausOzylpLGF
TLSH
T1E3059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 834KB
SHA256 3b5f22e56928e5c44b1190e338e204e99cb251374c8594e8df305bc0bfa88798
MD5 67b6c4d8ad5556a2762a59ae1ee27589
SHA1 0174f70edfb5632b64d6adc44050fba574103299
SHA512 cd5146e5699d55be6b3112a610afa2484404fb9334f4b0e80771c60ae46c0212a495d04623a4d785e1a718d94fd1938d1500c87c5d73f9243dfdcd1bede8d909
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLTC:A3mnXoZjzyaEFo3+aWiausOzylpLTC
TLSH
T197059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 834KB
SHA256 aea26a0026fe45e781469e7c1b1b3fe0f2654f8728fa33361c6c027011b67a2e
MD5 8cc98bd4404b9bc6450682ab5f4aa630
SHA1 d5dcb246a02b6f635a759ac8667d1ed889265d1d
SHA512 23614695608ef1290a8657b0e1d47dcaebd0207c235ed724976089a270c0ddf171af697f2a63dc7e374e284f87e105d5e88edaff5c5dbb3e663eb123d0e76966
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLcw:A3mnXoZjzyaEFo3+aWiausOzylpLcw
TLSH
T1FD059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 834KB
SHA256 81f547ded8db33713910c15dbab281bbacbc60309457026b740b0213c29d578a
MD5 f503ebb380e5c5c93368fa9df1f5e3d9
SHA1 aa049bd97968c13ee742b87e49e5c993107472e7
SHA512 283bd532885631a682fbe00059b6d19dfd2e16455d1fc46178d2f166130ba49c48cf438ca813395d166b9d33a9fecb3d72c491d35db5f9360588e26da6f40fc4
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLTT:A3mnXoZjzyaEFo3+aWiausOzylpLTT
TLSH
T19D059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F327D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 834KB
SHA256 bdda4a20bca18b7d660d88c52c7c1cf70b9d77fadcbac8978af168ce586df82f
MD5 6eb24c83d300310b1066cbfd4ead0e27
SHA1 b96efc6254bc1bb99c570dbdbe6f4eca608d58bf
SHA512 af179699a0a8342801668de6319fb87cf8d1fb6d19d7b43fdd570686b45378939d498848f6aafd1302f81ebf0f766df14e8f78436cf9280295db042989c9adf7
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLlu:A3mnXoZjzyaEFo3+aWiausOzylpLlu
TLSH
T176059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 834KB
SHA256 e318fb5bfb1dcddd13945355e5a944138fa3869a367e918cf758dd2495f054b8
MD5 d90589e6b8648d25ebdbc7c9384ea908
SHA1 93d206e8b352354106130701aebf844fd1c99a08
SHA512 4a45b6594ce337cddccb0af02ab6f41eb0ce03bb3717f6f200d48a98ed2160eabab7b43c22dc81f14c704fdb3fcfb30641479110821dcb8f71d9caeca3d58f20
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLtb:A3mnXoZjzyaEFo3+aWiausOzylpLtb
TLSH
T162059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F327D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 834KB
SHA256 54ac3aedbe0776bfe5edf80435794ce95fdf517134e358e4fe1cce9fe3560149
MD5 14b30eb5a8977ecedc05ad87a14b02df
SHA1 75d02584aea52ce005009c91265680ffccb20dfb
SHA512 045c214216149f8adcddac90a9c13add79989b981f096666557ddec6e3b6296bb9d76b93c2d5ce8f57921a4a7f66685e31c391f6fa989bc8447d8402e9f1cfbe
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLdf:A3mnXoZjzyaEFo3+aWiausOzylpLdf
TLSH
T1D5059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 834KB
SHA256 360cb1c0a631147dc256c75babf4d0095ea30e22602ceb43e7e3aa3ba904ebe9
MD5 1535a18ff837a07184ded48bef180eef
SHA1 c9e8b9579f4abddc18705e7db776bdf87b9d852b
SHA512 588c2cb48198deb1ca0051c79292afcef205a9d3f14f698554621d59812a05149bf1189119e63f351d2b6ef09a091c83c11fde62a62a4df84582582c07948f89
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLGK:A3mnXoZjzyaEFo3+aWiausOzylpLGK
TLSH
T17E059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 834KB
SHA256 dca7bb3d9330425aba18088b2e41d4215e0555c2177aaa89ba8c38b8a2c2c90b
MD5 860dc6bad13c4549939bec731763fe1f
SHA1 a07d1a39b430ef60a3cd478810fc653c61604936
SHA512 328f6e46efcc63c11c436d57c51a702e8bcd7cf8ff14406d8967c55cfc864bb1e53d1c6a767dd7b06a7514e0d0579dd2fd526373cc3d11d43ffea77dabca8623
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLzk:A3mnXoZjzyaEFo3+aWiausOzylpLzk
TLSH
T1CB059E13E7A110F9E116823499E65A12FB75BC221760D6DF236883252F327D0AF3E7B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 834KB
SHA256 009c2866f160708fb142a59bed3b101353cb65170d3fe8ea4466d35015d561b7
MD5 258c0650fa425011239a10e828b7d55c
SHA1 c1aa740ceebb658ddbd53702e24e1757157a1129
SHA512 33b52d806c118f95c2b407909db54a5edb1ad3d9227a3c2f74749520bbfe6d532adb07d586af290e408ccbfe1ffaebe9139abf0832c9ec1156143a9bf1eb117a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLE0:A3mnXoZjzyaEFo3+aWiausOzylpLE0
TLSH
T12F059E13E7A010F9E116823499E65A12FB75BC221760D7DF236882252F727D0AF3E7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 834KB
SHA256 9a531845232df37d5c85cac13d105a2a5eda80a347d1cb0f555a194a440c9767
MD5 92ea5c47c9f7b17b703145925d19056d
SHA1 647115e609c9e1860a6d548b9d1f451aa9340ea2
SHA512 ccbf70dee269fccb7f8bc3440a86d16a004c08b06ff2cbe0b592b2b8a31985657a5f62035237b48ae4ec8f8924716b49c8059f673b5bf4b218c2bb6b33b428a2
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpL/70:A3mnXoZjzyaEFo3+aWiausOzylpL/g
TLSH
T1A1059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 834KB
SHA256 65273bba424ec33ff0d6f9f41f075f6756acf289ec42046c401f05bdc9adbc63
MD5 fd2382136a811454ecf4fd74ad942e6c
SHA1 82d7e9fa5065cf2d0aa09db305c3973904f35a47
SHA512 e1e0f51e755d8579658cdc1f87f2895be7f527e1bf6339db7ec6be1d23ddfebc0cb7fa05f4d6c4b3d93feef3b7f0d40bea3879d9c0b18739df381a3d2049e0a1
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLSr:A3mnXoZjzyaEFo3+aWiausOzylpLSr
TLSH
T140059E13E7A010F9E116823499E65A12FB75BC221760D6DF236883252F727D0AF3E7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 834KB
SHA256 fa2665fdfeac490d8e12864722ad72105af894d67ce0a7e8609b324344f57a31
MD5 3cc6b1d17f9305c94695716b720aa50b
SHA1 17e1ce53706c52c4e9b18633011a8b9b3be6e577
SHA512 688e217f7d4e74af221fccfb6688285f8710e79f6de060a8519fbfb8e6cedf3a09f70e28f91ea2894eb94e5e2dcdf8f9eae645cbc94cb0dcb4c8955edd147c4e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLwn:A3mnXoZjzyaEFo3+aWiausOzylpLwn
TLSH
T131059E13E7A010F9E116823499E65A12FB75BC261760D7DF236883252F727C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 834KB
SHA256 c7483ef68547277e796a551c9ab34be03abca73974399842432c82355db017c9
MD5 6d32669086163c64d933a7727cf2a305
SHA1 4cba675a9bac4fb53720aeca4c8759db345332c9
SHA512 076cc46357429e1b92d12cc81e5d4199fefb4a538bddbae1e43d3f54abb0cdddda1e5e53b02014454b817b09807776a9c83485d16f4791d98babeedf62002c7c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLOx:A3mnXoZjzyaEFo3+aWiausOzylpLOx
TLSH
T108059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 834KB
SHA256 9fa3ae3010c53f748b767eb59876c32c8afc3db9370b7fcfc8d0afd8a3d66ed2
MD5 5b0994aab594b89504a20b1cb37cf3fa
SHA1 a495899afd55f056db31af59430d769091074078
SHA512 5b4e2da32e4ac61345a55abf4d14f6635fa40a996f592890de64c6698a9c0c10d76491ed74a3f90cee658457d49ad1ed5bf77d1f987e830f5f086341d48c9bdb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLoA:A3mnXoZjzyaEFo3+aWiausOzylpLoA
TLSH
T15B059E13E7A114F9E116823499E65A12FB75BC221760D6DF236883252F327C0AF3E7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 834KB
SHA256 2d23e0918bbfb7da80b0d33c8d56213a607006d957a967afc2661f5fedafd779
MD5 66773999253770ddd229d9cc5fff13a1
SHA1 d8cf20efdcbceb757b99f0c01bf1c43865aa1228
SHA512 eba55948867d13b003c9780e47b036ba11807dff555eaefd71f7afced90badfcc37a1d2f29d6f88f53684fef1af23d9dec613b30e316a440ae4fb841b1319350
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLB9Q:A3mnXoZjzyaEFo3+aWiausOzylpLB9Q
TLSH
T109059E13E7A114F9E116823499E65A12FB75BC221760D7DF236883252F327C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 834KB
SHA256 c225c9eb838402e1b532fea8d60a0561c9e705480de18f384732f99915729512
MD5 c8a01211d2786b281e9f0e495dc290d5
SHA1 fdb375f3ddc2159ac676dabb3868030842e67ccb
SHA512 6b28880e65b7430eda990ab3c1601e266c78921e7328b533eefa1757d768783bc58a229168a6db0fda61a6d9b5a0a1d003d304be79436af5d850f70e79f033ad
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpL04:A3mnXoZjzyaEFo3+aWiausOzylpL04
TLSH
T124059E13E7A010F9E116823499E65A12FB75BC221760D6DF236883252F727D0AF3E7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 834KB
SHA256 0c00587f6afaa9bbb00cd9d3d4b80a8d809c9ab621d554465d95d67fdde1900e
MD5 59bb9a00673801bd433c8eb6fefbc880
SHA1 6bd27e0d7ea93bc70c9ccd1e5e9a52a8bedd0dfe
SHA512 738231a530f21cec1ae2387096782e5e7c0637277d051f3203080d22987ef15c36d690db5990c58ca0318dd9ef645ce103f88b40e5913bea825af71a057b74cd
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLfu:A3mnXoZjzyaEFo3+aWiausOzylpLfu
TLSH
T1F0059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 834KB
SHA256 1dc4d578beda82b569961c3c178563b9c0678366b41f3c2492760ae7a42a09e7
MD5 c04b4783e34acaf880482129e6a3a21f
SHA1 9cde8c2f2aa25fc66877c76b401bed77923a97f7
SHA512 d0bed943cb74c39c6065779d77e7a549fedcfb3245afbc33210c0e6e8dbd0ba14bf6fd6305a6e0b5304253dd3d45a2d8e38409296002627eaa17858b727c5c3c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpL6j:A3mnXoZjzyaEFo3+aWiausOzylpL6j
TLSH
T1A6059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 834KB
SHA256 5edc3f2eee2a9c547296511c9ed9930977260d107492c9831ed035f2a1d2d047
MD5 bfcc17ca273e8575bff7baf2d5a57704
SHA1 56a6c6412c9b9337c74c7f453d1181c2f502e9fc
SHA512 caca6853b84b7d0974288d258ab9279a5615cf81f2a376b00ce52d8be926418aea6997c23b477d14fc089a9d5c8b104df40c0dae37c022e11298e1cdc62718ef
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLng:A3mnXoZjzyaEFo3+aWiausOzylpLng
TLSH
T1B5059E13E7A010F9E116823499E65A12FB75BC261760D6DF236883252F727C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 834KB
SHA256 0c04ad600db5691f597caa098d45de226c46ef887aceddfd127f48655141c53b
MD5 f91565283886fb19e929b3476f93593c
SHA1 03d0843b35239e565c3e20209a5969715ecc8839
SHA512 bb8062d28b284ffb7994c2fd29844af9e47cd7325ca1dd0793dfe0d69651f662bd770e4288370e29ea9ab27510f152af54c3802dd01444db42f1ce06aa0bbc24
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpL6I:A3mnXoZjzyaEFo3+aWiausOzylpL6I
TLSH
T156059E13E7A010F9E116823499E65A12FB75BC261760D7DF236883252F727C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 834KB
SHA256 0f9395e05f6ebbe70d0d1e32d0cf6d7bebab0136544c9c9b0d1141e3a97d910a
MD5 1c227c2ad50675d493ca79dc2b038992
SHA1 2b7e380421cc5ed53a85a90985cd3598574342f1
SHA512 f14e60872cd62bd02b2f2509cf5d7725c554604340c326fa2154026023a171d5ecfe4a90de938ce1a8c3999308ab65f93489d2d5dac7acc0a5b08ed02f23e0ed
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpL4o:A3mnXoZjzyaEFo3+aWiausOzylpL4o
TLSH
T102059E13E7A010F9E116823499E65A12FB75BC261760D7DF236882252F327D0AF3E7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 834KB
SHA256 0ab7491c6622964eb454a8138e1a638a90721c79d9ce948d1ae6ed01ce3ce844
MD5 0ef09f21596eab052d7430eeb2aaf26b
SHA1 3fbb0538e85d6c9a898fdd14e33cdb1db9e81649
SHA512 6c61a117d59626bd11b50964dfe93883bcb39d284a197bc912d605e0a95d1f718bad75391faed20853acf56def028e9acb28fa125c33b1bdfd8ff13ebb804f7b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLL+:A3mnXoZjzyaEFo3+aWiausOzylpLL+
TLSH
T19F059E13E7A010F9E116823499E65A12FB75BC221760D6DF236883252F727D0AF3E7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 834KB
SHA256 cf068a49b2a3a54f9d153d77bc62658b0ed0822b752624c840299e8aff49f3b3
MD5 b491e07256234e710eed178bc2aaada7
SHA1 6dc63fb3d12ae68ebfee2cec249129d7997bd4d5
SHA512 b174b63464da8268cd7a6740bbfa53a19adf535d6fec76b2e93f2740d620333e0b2d8d615eee3586b15b48c95d4b0eb42b44d91403d28540c8b8e91bcb6d0f76
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLBQ:A3mnXoZjzyaEFo3+aWiausOzylpLBQ
TLSH
T1D9059E13E7A110F9E116823499E65A12FB75BC221760D7DF236883252F327D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 834KB
SHA256 4089db88453ebe077656ee7d0e52268e83a6f44a0f30900a9d2e6c93a24be6b5
MD5 8da5c0e31ecfb0427a77e4da04a59629
SHA1 0ac34d6db1616a0912a36ca0f66c852d0e83b369
SHA512 16c57d05fb0e8d1f3d4efd5f92ad75aba71b7bc4844657936446402fb1ae05d617e5293211ffc840b2a2f7badc26a8f44704fe3a7862afb8ab3c8dcd912b167c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLGX:A3mnXoZjzyaEFo3+aWiausOzylpLGX
TLSH
T148059E13E7A014F9E116823499E65A12FB75BC221760D7DF236883252F727C0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 834KB
SHA256 7dda503623f0b25bdb9178cd77a24f1706aa6546686e886260834fab92cf52cd
MD5 08a0d26b4355b0529d275b0da91857f7
SHA1 f97cbee44899a6fde8030c81fc7ede291578a566
SHA512 b1a2103cb76939827d7bf2f1b9c03a042e1eaad4cea1df926d8ac07ad49f190155f1e0aae564d128e3b90e6aa67de2b06a71ec763c251e5e7beba3a1f44d0888
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLAL:A3mnXoZjzyaEFo3+aWiausOzylpLAL
TLSH
T1A9059E13E7A010F9E116823499E65A12FB75BC221760D6DF236883252F727D0AF3E7B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 834KB
SHA256 a71a93e2bdc636898481f39512023772e62b841ed7f916cbcca05715888bb824
MD5 2d3d3339e438ec63df9fe5d617cbdafa
SHA1 f753841cb34b3e7fffed07abcaca555db41138d8
SHA512 5dedb72e350c06b52469b332d5c5c2aa687a6275e04ff5e982048393407dbc21bbc93755eb643341b5c862ee980e8e009406390ad087aea981ae301e46f37e9c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpLsFC:A3mnXoZjzyaEFo3+aWiausOzylpLsM
TLSH
T10F059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 834KB
SHA256 88523433f9e5674f77de02df890d3166adb9af7454bb49aaca82861d3a545b4c
MD5 077e4450dca1d4840a24eb84646b3613
SHA1 e7a3977dc4b0d71c58093f3908dd460c0560321b
SHA512 0ecbe3061202cd5dd86208e436c50b2acf929b928c68b2d954367ff8ac8b39c202fefab27635905c6f4ff4a8c1240841241b6022f382d227859b01a49b3bb60e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFo3+aW0zausjyPz5L8lpL1h:A3mnXoZjzyaEFo3+aWiausOzylpL1h
TLSH
T16A059E13E7A010F9E116823499E65A12FB75BC221760D7DF236883252F727D0AF3E7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-173-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1112-172-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1112-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads