860efbcd81c958f8ac215a6a37a415c3cdc207040d0f2bfb27435538dc0f22e8

Analysis

max time kernel
99s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 16:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 853KB
Sample260719-vdhfaae13j
SHA256 860efbcd81c958f8ac215a6a37a415c3cdc207040d0f2bfb27435538dc0f22e8
MD5 83c4889c8d3683b172488961b6b612b0
SHA1 12c96921ccdebbd080a624fa03faaa5e443d26a9
SHA512 083517c5bf0f754b173cec98493f3e76a212aab8c967e10ac982abd184eb679cf6bb5484b6aeb88b3a86eaf8f76bb3f4bcb26a6de6b1e9864051035f9b5660ba
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaE:A3kMjK
TLSH
T19405AF03DBA404E5E51B8630A9E54613EB75BD522B60C7DF2368C2152F727C0AF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4116-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001100000001c560-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4116-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1108-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c87-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-419.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-511.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-602.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-718.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-800.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-849.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-927.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-983.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1094.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1164.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001100000001c560-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c87-60.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-224.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-419.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-492.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-511.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-602.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-718.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-800.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-849.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-927.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-983.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1008.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1094.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1164.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1221.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1330.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1343.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1368.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1108	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4116	2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
1108	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_83c4889c8d3683b172488961b6b612b0_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4116

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 853KB
SHA256 860efbcd81c958f8ac215a6a37a415c3cdc207040d0f2bfb27435538dc0f22e8
MD5 83c4889c8d3683b172488961b6b612b0
SHA1 12c96921ccdebbd080a624fa03faaa5e443d26a9
SHA512 083517c5bf0f754b173cec98493f3e76a212aab8c967e10ac982abd184eb679cf6bb5484b6aeb88b3a86eaf8f76bb3f4bcb26a6de6b1e9864051035f9b5660ba
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaE:A3kMjK
TLSH
T19405AF03DBA404E5E51B8630A9E54613EB75BD522B60C7DF2368C2152F727C0AF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 e3bdb9a82dba21c2b3d15f41e6757657f9750ff0f65708116f78c8350fbf05fb
MD5 1564d9443d5e787485237cf741277464
SHA1 52a227b146ed87656149f1d6c2de88c7c50f5709
SHA512 7344deee0c2e62983a6b2d39c8246950d19bc7e908040d29b05385b28dbc48d4dab7d0b4a07ee216d2696e7c34943f9ad0f1d6dc20bc241bc5a0bab01dc44e8d
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEP0Le5ji0hmxNrM:A3kMjKyPji0Aj
TLSH
T152657C17F6B442B5E077C174C9E2965AEA7138821B30CACF1359C7282F63BD19A3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 868KB
SHA256 159ff37387330062d61732a5056ff40bb45927ed5ba9bed472a01ebeea302f5a
MD5 a1b9724272a3c6abf901edab735c122e
SHA1 0ecf672fdef4f35f4fe58d00be2a352a0d767e39
SHA512 ca15727f5e0c1ece3a08ee29ad080052e34dd423b91b43d8e7391d7858891e1f2aca30c08a5b1177908d05508986bfbedb12db31a8933e59b19ccc9e226314ab
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaERa:A3kMjK
TLSH
T16E15BF03DBA404E5E61B4630A9E54613EB75BD522B60C7DF2368C2152F727C0AF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 901KB
SHA256 39ec9d1c0339e45608fc2874e6cfbe511dc9ce6fe2461bbda7566dd892abad24
MD5 0d00ca2f3803d3e134a0a58b927ee0ad
SHA1 9bdc3727dd0c6737f6c570fbc8405f2d2c48f267
SHA512 0cb6c603fa63fa25710644113aab355088f145ddac519d315dbce8c5d5aab629a7d396351e6b6d20d5b73ee0a1e2cf8c0861d24ee133d11c66d2ddc93a920f55
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEyb:A3kMjKXb
TLSH
T15215BF03DBA400E5E55B8630A9F54612EB75BD522B60C6DF2368C2152F737C0AF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 877KB
SHA256 b9594df013d4976f19addf40dbb9dfecb3887a8ab57678a85e49a9455c50e169
MD5 56295275d840f4fe03b2928927c8a640
SHA1 83b47546516fd8a0d7fbc35eb788d82b2718d167
SHA512 192a2b608038444ee8beb3df37b2e54fdded7e6ebec5c603eb4623695069cc6e9dfa88dc48c344b6cc5ef9efc447e55408da7ca14fa6ce2e3ff2d8c46754d6ce
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEo6:A3kMjKc
TLSH
T1E015AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 877KB
SHA256 bd79819d95098eeb887fa6e81dc40e5279783a7b71e08c371e62cd5e5edf0acc
MD5 6d759ae92901a19ec41455e9e7ec82fd
SHA1 ae7d914979fdc3a0e66e9ac7a78a0b1876f2d5a9
SHA512 a2e2eeed0456ee4f7d63191f6f6887004aa97ca211f64a371f03b00cfdd577ce91c073d7bab2ff2f3ee1579a354e067855b9d6723ad772522245fe2f39ccc4f7
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEsN:A3kMjKB
TLSH
T1AF15AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 877KB
SHA256 307a12eb9f87b03a3a6f3140c0a0294d0a11c5a2f7d390b904aa35fa8b1dbea5
MD5 a429fd17cd251dff6463265cb834fcbf
SHA1 5c15f7192060d34c218b8b29cd385d2acf563a5b
SHA512 8fdec03c4c8449a63c59429de036a9bfb44105c3e6ada65dd447d12ae098d2b8d46df90e80bcf28f47ca30f32927f1cd654d925be4d469ec6875ba1921252f1c
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEif:A3kMjKh
TLSH
T1FE15AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 877KB
SHA256 ca1f157324571ca59885960c6ecf6e05bf6a217ccb209fec5947cd0a5a7b1c41
MD5 72754e51f798434bca24206f19e921b3
SHA1 79af02c504395021ec818680bdc993446fc7cdd7
SHA512 3d0d1c67d437cdd65732603e3073993fee694f2babd9f404bb6feaa00e805f6d1f5f8918c076a68938baa07ea920648f30e1c1560bcad35cd6c79bd902446119
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaE8o:A3kMjK0
TLSH
T12015AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 877KB
SHA256 3a210afadd15cc45759312eecb2da87cefa947a1c5a0a5ef9f77b93fa3a3f76b
MD5 81aa8fbec7ba7c24d2e5808eae4933f1
SHA1 46a9b8b74c00bc1c459a600e7f0664fa8f5b33fe
SHA512 1d0cab9bb7b424f11858dfc8c632fcbc87f8386a00185d86de06d8b7ceb83cf24f24a95da5a7f5d9348e36120cfa800622aa0c12074c7fe4f1b7e72c7377bdaf
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEcu:A3kMjKG
TLSH
T11515AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 877KB
SHA256 38dd1e3f87866994a08d39b69da60a6e71fdb8351f90adbc895dc92ae65c74a6
MD5 d2671187af21d99638ff23a862737dd7
SHA1 185ccfaf94b7155c9428c6d60bca8d9872aed646
SHA512 978b15eca6f6b7510a7841c05a204e930aee0b8767d990569f7d0f413ecfa499406428450a3579a0f56e2f9b4eb335272b25db4cc11f5c7bfb64b15582271fd5
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEg9:A3kMjKH
TLSH
T13615AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 877KB
SHA256 7a43fcd8be6c965c76b3119ab385f8b31e6e962a557d93429942c1676150cfa6
MD5 1c748c1331285c35d3fbf12f6ced9551
SHA1 1c17acacf6202dd5279b4169504f4ba7a8ac4740
SHA512 e092cba9cde1dde375bf0b35d23ed291e212f6691ee94b4640558a403bddb60ea829c674fbd0ac83434e27dff810634a426e7cf3c105d76d1b91328f4bdb4ab0
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEoc:A3kMjKW
TLSH
T1D915AF03DBA404E5E51A8630A9E54613EB75BD522B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 877KB
SHA256 252f0c08bf2799500059a02541e7645af13adcba52f3599f1e1c69da7dfc4f23
MD5 b5dc0ca762cfaf3908c6688bd7e8450d
SHA1 ae07306fbf2fe6c76e9bb836b3c0793d3b53aeba
SHA512 f03871fd6c83abe6bcd910e5792acf20b520222b7a3f702857065f572ac652bb4387c8afc09e032658cb2a502d5e8ea4f66274e3ffc33b3d8f9228e0ac841637
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEBp:A3kMjKE
TLSH
T10015AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 877KB
SHA256 5613980fb883470aee47e3ef9e4a1ef5d584b10bdb19589fc0d1c1ce7d403716
MD5 d311a8a6c964110f9f1916ac525a3cde
SHA1 53364817c9adb13a9c807d54a19fb40c97f0a716
SHA512 5667d307edd65787d161712665dc762437c1e07d6c7e34ea57b7c3c631a4bc82e1a4c95495ccbeb13f1d29f5af061b6ee1a5d823ad97215a0cfbb0cb2daeaa3b
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEWN:A3kMjKz
TLSH
T1C115AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 877KB
SHA256 c5695a1bf0ea50f9f7b1052ce501e77cf661c7064d1b9c082f67ca841b4d6e3a
MD5 60e2508f3034305da6e4f97c7155b2e2
SHA1 833b433dba79ea824d3f51b949208378a1c37f4f
SHA512 0c6e7de1c9a386bc7fb912db9de0e9777a7a28634b6579bdbbe35190f67dba8db51e5c6d408f8700433be6efce66137e5f62609300849a78a20c5696c14134a1
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEaF:A3kMjKF
TLSH
T15415AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 877KB
SHA256 9eaa19935304f12e6f69e89df146d97e68cdf1d92bd4f6f50fd711de10969ef2
MD5 dd55e980fcdb5828f921cd5abb6d678a
SHA1 3fdda14ad114cf027cfe70f27de0c2c2c8f623ce
SHA512 b84a9fd342edfc51c83b6cee6f6589611f5cce1a4206dbc6b390d03e7199f6dc6fd733c009d8e7d95050ba1f0157a94d3fa0c8159c939316fcf06976016da9b1
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEvC:A3kMjKp
TLSH
T14A15AF03DBA404E5E51A8630A9E54613EB75BD532B60C7DF2368C2152F727C0AF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 877KB
SHA256 914d6c6c73e036b02b0e3a1bae14b1b76829569ffaaf442098e6ad87c41de375
MD5 0585574fe5f19784afd89cd17c2de63d
SHA1 b22024dea1de966eb0629df737ae6399b727a9f1
SHA512 cc560f942408dce16b669395d5dfbe364af6b0509b4a77ec410b2325035e25229216b0819015607ca2023e9bf989a495375eab20c1dd6cc5d12aacda6c467108
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEQw:A3kMjKU
TLSH
T16B15AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 877KB
SHA256 9189db44a275d19dbfe837a3a50daf924b565a0530ecb735cd6d754cef3239c0
MD5 03be1559ab3a6ca85c0cf03d44376c56
SHA1 7687829f84ed5b36db997bcef78b73e52887c192
SHA512 04f09d706854045989b73af57f9a716a11164e7be8e4ee62f7fecbd2798a700734ae72b3686f3be3b3fb0c7e5166957d0e3b108ad93cf7421bb7beb0e3984e94
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEvT:A3kMjK8
TLSH
T1E015AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 877KB
SHA256 8bb73da2354a800340d9a09788746596f720d9d974c2b7b9bd608da76a40134a
MD5 9f695227a04affcee16eab05abeac1ed
SHA1 90bd77e3ca598eb9059bff96406a543eb2087a28
SHA512 039649ec458186257a29251f328076e26d7f144ca6af46fd8450ffd0b7e5e068072c40ad55618b113d341a42aa3415c53762bcd19e8283d2fd0c40ef919b8e0f
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEpu:A3kMjKb
TLSH
T1C715AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 877KB
SHA256 5d66e80092b569372a8200dbdc7fef3e9726128552e4c18f0fc1d1ea6aa1417c
MD5 0107e522d10eb1de71c0287f071c6c44
SHA1 ffe997c660ff59062e036a7aabd56fa253fa44ab
SHA512 b6627a6662ab91117fbbf3708075f98eecabb4e4d0f1dda09618c16f40d7f84c9c931b0c2019ee13d2c8a826d9d8633eb3cab4021591c3c7da6f03149d22d9ac
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEhb:A3kMjKy
TLSH
T1A515AF03DBA404E5E51A8630A9E54613EB75BD532B60C7DF2368C2152F727C0AF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 877KB
SHA256 5a8e7b429065ab75dea68edb9b8512b9acdcb3021cd944c079f29838097b88e7
MD5 9e0c5220c8ad835beeba29aa02eda95f
SHA1 6734de056df0076c50cf422751138c3f015bbc5e
SHA512 fc2f6957127e034de6a2119e30bb572428153261e3705ad67b80df8512afbac917a8b339ca1b6d86be69a3baa90620eff0e287d2fd75db8bfc0daa0f666f4d1d
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEpf:A3kMjKS
TLSH
T12215AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 877KB
SHA256 eec5ec998eb59f8c4e71742a80a911db999288851d4d4f8f78011c2b46c9e9b8
MD5 1bb126cf12a4e2298f12fa29547369f5
SHA1 c686489dab27354b029008764515068e58180994
SHA512 f035ef9a0d56a18daadb20022b554d6dcbabd6a31f17079d48b41a265f7289251459bfb724434e445ec3a7475eb8187ab10c8372c279e0250d94be0b756e7e3c
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaESK:A3kMjKy
TLSH
T1A315AF03DBA404E5E51A8630A9E54613EB75BD522B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 877KB
SHA256 28ab9fbbfc6aca7f80ae4a27bfbf01e9e0317f04772803228b3bae402699d63d
MD5 2a85c37b6d566607a78fbda9176440e8
SHA1 9112ac15d85d80fc80a854ab3935f686e71c586c
SHA512 59bd388d3b8af332ec7c71c31ae33c36fd6e84c470fe268d4b88eae9b4327835e0bcc6a79f1aad1c31e6ce12baa2ef0169c628a7093f34747dbce22c17698961
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaE3k:A3kMjKH
TLSH
T1E415AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 877KB
SHA256 6c903532997923d5837f6b51634ff8fe0061cf635c0dbb34f89daaf740e72efa
MD5 46ebd28e2e762493b55f46734b197c81
SHA1 4c995f27ef4034270ec9aab6e5610272e2f543cb
SHA512 a0ebc7717dbd7ec0b35fccdfdf010e74b7e78aec99599505c6b869024fa5780d8b2b7ad3a7e6875a7b2e1e2a20c50c180f0f701671f5929bafb1e317f9366a10
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEA0:A3kMjKG
TLSH
T1F715AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 877KB
SHA256 7ca2288e221cbabfe95bb3ecefc57b331f59245468bfb85277f7369c6ff2e15e
MD5 952a209d9cbc89f47f7bb4722afe77c5
SHA1 0596b88ef60f7bbb8240dc74d1876ce8ee8df848
SHA512 42143e81b6a076044f0a7fa766a1e16869b2abe65e5609a98aa0bf0a09f638560a88acca46d043baf817897b8f94c0226cb3176ed4b6f32bb8deb3b80c95bda7
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEbg:A3kMjK/
TLSH
T1F715AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 877KB
SHA256 07ed13aeb5879a86ca0fc509647cfd53ac85c5fc5837e37410f85f5133b5be01
MD5 91057063646088467eb9cb8b4a688a26
SHA1 c040b1956d079fd13835eb6edcf47f1209b2698a
SHA512 83c45d9dace0ca810515368f2294bba438b808833c130e8e616f4457ef2d608ead7488708688245d6284fe3d5a18e7ce69ebcb915bdc40b2c19aab9cfd44ee45
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEWr:A3kMjKZ
TLSH
T17D15AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 877KB
SHA256 c7ac863c323c08ef44210b841850de203d2d5acf7c2e808cd2b28a8f4095ee28
MD5 b034dddec68c37e2846459f81d6d396c
SHA1 5631a37146fbeac171b2ff03dd677b58b7f42b13
SHA512 36a3f3536cd59dcc68e682855e9a49000d11dea5fd5f8981a2cc0e0ec42a0ee51ce096d07b112abd0628f1fdee97904c7227c13461e22c3d27621f356f57187b
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaE8n:A3kMjKT
TLSH
T1BD15AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 877KB
SHA256 e43e4080e8e022b1260eaf15c2f889ea2179e79291742374fdf4d339fce6d7da
MD5 ebbf081105951753b05f4210af7ebd62
SHA1 c22516d86dbd100bc9ae2f90e4df7a91656b1808
SHA512 9343c79fcd3cbaa373dfd584a8904ca74ee20fccd26a72ae0f105759199f4e2ed27e70ad990f7018bae623b35d44cce5a05de3213e406787b4c8b853d905f276
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaE6x:A3kMjKR
TLSH
T15015AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 877KB
SHA256 b792b75017684e23dbbbc99c64e372e5a1406ecdbb96c34732860467fa56cbf0
MD5 f4cbc2d6f28ed1b39f0583f680e01042
SHA1 5cf5d8053204c6d1a9d17aaef6b901247750ffec
SHA512 49b3e0c9813faed34b5f415e017f7e878ad771f68e03221b14e2f46c5ac9679fc14115c846f1274f6be20f9f61d5bb8378823bd1372b8ff16d9013b7e6eb0ba0
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaE8A:A3kMjK+
TLSH
T12A15AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 877KB
SHA256 34c65de9a031ad95c783b33385351eba049b4849d191890c0962a26d1405054e
MD5 d9863726b17bc6d878e1d2560e4aca35
SHA1 71a400661872a9378f548bf284b0e38de17540a5
SHA512 233c826ac6911bdc5ea8eef5ad2a4326e6f09fba263a588e0df9c239d1665f9174b0eeeaa5f11059478bddd98cee959d5f94201746f3a05540d08d6977c20767
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEl9Q:A3kMjKj
TLSH
T15115AF03DBA404E5E51A8630A9E54613EB75BD522B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 877KB
SHA256 55b60b952bfda2ac0510d184484dea6088c5c7f06532782a19c578c93b56868c
MD5 144f1b17b9daef87f7ea9f3877c2d6d8
SHA1 4e8e2b5f2db843fa07c51295f6c397799cc41bbe
SHA512 ce0a7a69b482af25afc86060ddb5e226d973fd3d3f346354a9667ab3c90b212f624a01342b76def347a8d4a0d368381c5a4243229b9a1b3f1d394bb5799b3b69
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEQ4:A3kMjKE
TLSH
T19715AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 877KB
SHA256 2cb8426ee2a85e47473e162188d0992fb6754e5e65365d794dddd091efd57dc7
MD5 1399eaaff2b914f9fb1ad836d9e00709
SHA1 1a0b0a501a769537b74abc2f009dd8f6006abcd5
SHA512 70a5a324a69c6690430a9dfef36a56847cc56784e39ac35f84f90d7044b557e963d3fbf938647a5e6c45c9c58f4662ca2da82b5b3e7c9bd114652c6627ae4d91
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaETu:A3kMjK1
TLSH
T1E215AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 877KB
SHA256 ed4b5d010a3697e5a26b79b1c4f9c336accb01029a4223f6d2b9dcd08ca16132
MD5 0f570462fe1e7fa7e47aefe3a3f6b57b
SHA1 29ea944eb0f05aad7a98602a4040bd1cb8fb3806
SHA512 4a338513cd20ff0eeeb21f6444568af616546cacee8a84b0f932c7722c46a03858061de30738a6d3bfb6e7591fdc7968dc75375f6d435ec5892ff8f57a3a319a
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEOj:A3kMjKX
TLSH
T16C15AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0AF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 877KB
SHA256 a94b840f47803f95c6384448ec6fd66ba492244b25dddaf1b6059d719ac7d0d0
MD5 a49f6ee1c64a8239cf2fef1b7e25fcad
SHA1 e96cc58e221ea1f4493b1f280ffdfd6ab4431c18
SHA512 2c01b8ebed0e5146616fda1b6e844e35f3c29ecc7b6d3968b354419c8378bbbf1acde97387eb277f1b713dc0dccebe1407739f2e3c344bd80a9aa6d3fcda7d8e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaE7g:A3kMjK/
TLSH
T17415AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 877KB
SHA256 d3ed3a8c4d481f267f3e1180c7e906d1c8216935a97e4465b1e4e70ac2fc395c
MD5 72a599133b2a8c99b3c0ea27f4963418
SHA1 366ae508e93383d9908f6faec63e83b3cdf4310d
SHA512 0714e13baa1461680f95cea749560ea3cd3314d6cb343f1679e4a8caaa2924654556890eef3b492b1a04b1791f80ac32ecefded3487a7ab8ed4f2e9fc35da3cf
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEmI:A3kMjKu
TLSH
T17E15AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 877KB
SHA256 d0d31aff309e39c008876eb2762f95d300f1ae9c6e5187dce4bfc9a5b49f0fd4
MD5 0f9d6e8baaaa5f213bcaa6949ef695a1
SHA1 4fc7da9c05d77d400d57e4e560cdf9e81a0fae80
SHA512 37393064e022bec843991434b9cd3b334188c9c644974b68425ac3e0aea3e72fa34f87f4d718994b3e1134a7bd7c3f2d9727bd283d5343b38c50e5dfae82e579
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEUo:A3kMjKs
TLSH
T16A15AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 877KB
SHA256 eaa5758ba159156c8b998c4fa887c427a88ce629a79a5a32c10971bf6eca0378
MD5 c8d07a6e5b4a4283a05d3b46c24d28e2
SHA1 4c02d30c3e637d4e0b403e0f4626e8b05f05690e
SHA512 cb8e805dfbaf8f74ee4176aa0be4f1f37b11224c51512e50e0f0f0dda7466d9452c7e4e353b58fee8736c576d4fa261c926ce715ab9744abcbaf8ff6bde0765e
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaE3+:A3kMjKB
TLSH
T17115AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 877KB
SHA256 2b87752791bc15e9c907798227be1f5b405d387b8ad91b58e5348f3de779c479
MD5 1f5368fbfa7c372676352c93a3d09560
SHA1 50c756cb511697c76f9440a206ae03b9fa40c0cc
SHA512 9bf49bad81cca4e9ad4de6eb62156c97279e90c4b7e323b2b0a6068449daa146357a3ff89c0934a34370cd49b02788c5c370ce871ddb17c88ee087adf0af09f1
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaENQ:A3kMjKB
TLSH
T12C15AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 877KB
SHA256 479e645ed7b4d31565e6c6192c10fdc40165e6e4d9949306340ae12ac07436f2
MD5 baa5562b7dafdb6fe950084d8bf55670
SHA1 136746d8762cc99733fc6816f37efd4d6399b28c
SHA512 230c04298c7238a8fed06a9eddc63ff6381b9e9e5c9819bcb2d77dd838bf3eabaab9b4afa2791ec0c110221713e4373ebd9c6b67e1f7a6517d5ef79a3196e929
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaECX:A3kMjKt
TLSH
T15215AF03DBA404E5E51A8630A9E54613EB75BD522B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 877KB
SHA256 5866a42943c11a5fd38cda64e99dc4c4da42805d82fc4401f0f0984ee4929e49
MD5 83cb2bf8ccb732010d6e14a23c036ed4
SHA1 3d4d0e147aa098f9c2009065f52d17a8005e7f48
SHA512 a1abb2b98d14b0bfaec7a47ca56908c100d4b4854be4727bf39b8df1d35d2f7ea766472d9e8b9253bbc0590e7aa0a3878ebd84d1b727dac9a9246282ff90ab36
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEkL:A3kMjKv
TLSH
T15515AF03DBA404E5E51A8630A9E54613EB75BD532B60C6DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 877KB
SHA256 784a132cc33024815af08423b76936632b8167a92fa6860cca44d27ac659a1fa
MD5 d6ff792016a912284d018618072b01f7
SHA1 0cd7e11cff597e2429c5b47429f050906100f544
SHA512 a52d8860206ecd25d0a4f3dc4e84b4b5868a9bdf2479965ac6a390093d80785300fb39d7544bbc2c1a59dac9282a680adcd8374fd83ced0d472c7f00308b10a2
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEAM:A3kMjKa
TLSH
T1DE15AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 877KB
SHA256 71499f7d4e37a08f662305a3c81d148c2988242679f13aa26839ada4f1a0492a
MD5 9f970a634d7107e470a4f674a6137aa9
SHA1 50df05a1030b7c7d8c0c9199da615a13cea75424
SHA512 07b098f32d43961d2c6a1b247fe2a234b54b426d6fcb65fbee730048a26bb2217427c8da4ba7f97b954d802a626b23b550a0c8e1a18a489f78e67a3c983b31d6
SSDEEP 24576:A3mnXoZjzyaEFyKUJqogiYiKjEsK5TaEhh:A3kMjKU
TLSH
T15215AF03DBA404E5E51A8630A9E54612EB75BD532B60C7DF2368C2152F727C0BF3A7B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1108-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4116-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4116-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads