7b0c564f4cd3696fef164bafea98810e097e102f7c2217bf8a9c1993ae8fa60e

Analysis

max time kernel
97s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Size 755KB
Sample260802-dpgvfscl6v
SHA256 7b0c564f4cd3696fef164bafea98810e097e102f7c2217bf8a9c1993ae8fa60e
MD5 507a0b7c9c5f26431e9c81f4493ea291
SHA1 536a6568d0e30680c5da20141a38c75be82a8af4
SHA512 d157e2137a3c2d4365d636d09abd0f85ecb27bb79cda69c7b7b0c5304e6d59a3376fbdb1c0be0ee46f49296b667f7fc03d71ac844acb0a245f4f7894d2a72f97
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yog9:J/sCv7QExqatgl8beJTTx0yog9
TLSH
T1A4F44B53BA4485A2D416023144EB4753EB71F81A1F11938F27BCAB6D2E32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/6056-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c586-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-474.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-585.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-701.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-757.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-837.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-850.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-921.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1002.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1076.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1119.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1163.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bacb-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198f1-1214.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1317.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1361.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6056-2054-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3912-2091-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
3912	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7zG.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6056	2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
3912	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_507a0b7c9c5f26431e9c81f4493ea291_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6056

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 755KB
SHA256 7b0c564f4cd3696fef164bafea98810e097e102f7c2217bf8a9c1993ae8fa60e
MD5 507a0b7c9c5f26431e9c81f4493ea291
SHA1 536a6568d0e30680c5da20141a38c75be82a8af4
SHA512 d157e2137a3c2d4365d636d09abd0f85ecb27bb79cda69c7b7b0c5304e6d59a3376fbdb1c0be0ee46f49296b667f7fc03d71ac844acb0a245f4f7894d2a72f97
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yog9:J/sCv7QExqatgl8beJTTx0yog9
TLSH
T1A4F44B53BA4485A2D416023144EB4753EB71F81A1F11938F27BCAB6D2E32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 537589c46bbaa53d7bfb23cc6867c457cf1b64928b7a0a2ca1de3a6318812888
MD5 44776eab954b4002c3e5b202583c9320
SHA1 52b3c8e2520535ea4677b3f94fa75595112576ed
SHA512 9ab6202d5d95498548b08d3f347def2ff1b46e4ef4a2d73906391ad218c4606191f203642b99e21e9928486b3dda64bbf39825f073e78c04f85f99736bdf3a4f
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yogJ0Le5ji0hmxNrM:NDqatgl9TKsPji0Aj
TLSH
T17D555A53F6648672D0228175C4E79686EA31B4461B3086CB13ADDB7C2F33BF1A63A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 770KB
SHA256 f85125f2524ef96bef9221e4db8864b86175b8539e6c3408534965c9eea354f0
MD5 30e524305ea4a6ad490277e6a354a489
SHA1 49acb1b035428b928dc21ca102082958da49f315
SHA512 4bdf9b6d26b5e4f2a962da3caad5797d9f2f48fadd8db3846adcda7921d74d840cb6efb06d1042f495ad5eeec610958e7654515cd1bd7be1702df3a7b1cf1070
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogba:J/sCv7QExqatgl8beJTTx0yogba
TLSH
T17DF45B53BA4485A2D416023144EB4753EB71F81A1F11978F23BCAB6D2E32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 779KB
SHA256 bfb95c5fc84e6d1416723d777725a2e28bed583083f835c29b8e93e8ca76f511
MD5 a1d313f27787543f697f201353175f76
SHA1 03c2a6e15a7377ac3d7debd2db7262cbe4a4fd1b
SHA512 eed107c48282ff4b93587ea8ab0b1904a5ec8896aaf006809c04151cb08a06e8e95675e9e9eb3c01c850d6b891af6a23801a45ee03865fdcf043953a3890ea34
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yog66:J/sCv7QExqatgl8beJTTx0yog66
TLSH
T1BC054B53BA4485A2D416023144EB4653EB71F81A1F11938F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 779KB
SHA256 e411b164eafaed19abd6f36aac378bf71a4c28dffee58d21255d3b4acaad84d0
MD5 813c25610cbfb352213b546e5a072475
SHA1 7bf256d2c9a23d2c634625efccfac596a0339159
SHA512 2470ec36517c1682f30a2f39449ac0cc0cd4c1050e6b4e22caae5668cc622fbac12306369dd7430ec618be159a4d76e0973ac1d2dd42afcdbd6313bee2ccd0ca
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogyN:J/sCv7QExqatgl8beJTTx0yogyN
TLSH
T146054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 779KB
SHA256 60cfb15dcedcce3bfbd7be0d3bbae28f0df4390587e4e264497f88065fb942e1
MD5 afbcc785e03c7caa44d6709b5d325761
SHA1 930f0a5a4507b7d309fc4923cd10ffc135a870bc
SHA512 5ff74fd564c95bb17b4b1319848ddcf1ac5377e33c91846c5db56fe682879eba87464f46e8954775b9f47ea332432c9dc31058124a5cf8625230b00979ab9fa4
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogof:J/sCv7QExqatgl8beJTTx0yogof
TLSH
T142054B53BA4485A2D416023144EB4653EB71F81A1F11938F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 917KB
SHA256 3d665101025629d3d7632726f02c8cf9cad6c39a932d16408b9337239a9027ab
MD5 2e7144aa524a33b7518f38116fba7f0e
SHA1 d2e69b32c0c59760a24c9a5ffdf41f9eb8e56a07
SHA512 d7d7a39db2efcc48f8553ee1c6e4f01ec1ff8d733af3c1d2c219eaa0ca099cdb5ba84b451af73cfe293e874de6ca25859d9ed5694da530c0dc2397ca9e332226
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogWyPz5L87:J/sCv7QExqatgl8beJTTx0yogrzy7
TLSH
T1DE155B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 779KB
SHA256 2afcc316c0cee65e67014ade9a825da2d765a7ce6e0f75d1dd7b076922071350
MD5 ba12a42a34e0f59b73a7b42a8ec73e91
SHA1 05e5d35f48d809e03d561659ca97940c956d7c07
SHA512 74b459b2cf43d6937f64ef0e09230065cb1ad567e093f8e817d7bb4e93968417c401d62c12905da53ccca847d774b9c82069ae3a53005f3bd82412f07cf82561
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogCo:J/sCv7QExqatgl8beJTTx0yogCo
TLSH
T111054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 779KB
SHA256 d274fea07c8c64b49c046be75532abb306a17533631da4ae06dac9fa64260fd6
MD5 a2a37a25c1a227e2078fa39c8418d494
SHA1 d4bc82be92c990ce5aa0a2647d998062eb57c9e2
SHA512 2ab780cf60044fdfbb356d45f14f134faddd5fc0c1248461764557e9658e3d733a5fa1edb3d971f321b1563533142b59f45739180c5fadbf1e70efa00caabf42
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yog2u:J/sCv7QExqatgl8beJTTx0yog2u
TLSH
T16F054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 917KB
SHA256 f5736fe0d012f1b1930eec8ca0f80072452d89bb3460fe204998aa4b93a01a56
MD5 076d9cbc7ff706b078edeaaf369c8b36
SHA1 3fc81e04a8241f5cb951f33821c5800d320e4a0d
SHA512 c1cb46858ac728e0380310a2eed911983ea03288b4859bce42e7add6ae3de32eb69141333baab971b0975283926b059a8a595cd1f62deb23b1b2c2c28c3423a2
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogzyPz5L88:J/sCv7QExqatgl8beJTTx0yog+zy8
TLSH
T10F155B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 779KB
SHA256 36a9f3cf35a5b7b09cd6a147ce2f1e6916c125398e076761758099cff33197d0
MD5 27c68b0a43b53225ce94b3a4b5e7259a
SHA1 5d513934b47551f75895d16e8cf2611279dc99a2
SHA512 10a3ce9d98b2dcdcfa6373f3b39a9458fb73a87ae70c87cab005eb2b1e4e6f0dcdba66a4915057c40c724e4afe8f565bb300e9b29609546f778b455b3b88c18b
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogq9:J/sCv7QExqatgl8beJTTx0yogq9
TLSH
T109054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 779KB
SHA256 b6508f364018629a91767d02076505a4e6ed8e597cc3b90aa9155de174400a20
MD5 18ff07ad12d968e907fa4108fad213a5
SHA1 1ad52948de7bfdba4a3ec8a0c6ea51274e964c18
SHA512 d2dbc6af995e3cd16d075d653bdca775c09057558373f77e0c6111da559a7ba6bfe8ab7844b1ebca843417a6ebe7f9864587495d21d335385d3995bd3d894fc8
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogqc:J/sCv7QExqatgl8beJTTx0yogqc
TLSH
T176054B53BA4485A2D416023144EB4753EB71F81A1F11968F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 779KB
SHA256 0579ce492373bf71ac029f514b87cfd3d0e4c81a97b57a63ea0194a65a260ba7
MD5 cb053d018cff2b50c8377c66213e666a
SHA1 f4754434d864e8f3a35fd4516727cbfbc6966d5f
SHA512 0b3d2975da9045d6fc88aeb5acf484a2233c2dbc416c8688b019ef120ac9f3cd652c44fe494d313e707d8c9a1b83b6cd8a0531a61389600157c49b59645431b6
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogjp:J/sCv7QExqatgl8beJTTx0yogjp
TLSH
T130054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 779KB
SHA256 93fe9cb9fbfeafa1fe882f7675a38396bb2ecea2a48d93db9227559a1f695532
MD5 68735a68fbe82cedcaf13f11d5473ad9
SHA1 a4557d38110dfc3ebcd080dec65c0d01c5b817bb
SHA512 828cdece764b4e1d373a92b011079881f888fe2583f9085b883b244832d712b8ab1765ede4d4522c823481b5de1747909376f0cf4d29b1f0dc929f681ab9de68
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogE0a:J/sCv7QExqatgl8beJTTx0yogEN
TLSH
T1CD054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 779KB
SHA256 498a570bb3ff2c469fca10706027af426b152352dbb76fb0083992facbfade82
MD5 78491217d1201c44ac7a597027f222eb
SHA1 34f2633f6b0dd00a0aaf7724336b1b85f2c241d5
SHA512 17e6784623303ebd0e8ffc8ee3c44c68f48b7cd8f94fec641924096da06b61999f4363ec4b346a32bb50c54c548631fca66bded1091d72a337578c50450e424b
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogsF:J/sCv7QExqatgl8beJTTx0yogsF
TLSH
T13B054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 779KB
SHA256 298bbcee6ee85e679e9fd53d304ee6341a1668f292fc03659b6a290de7e83e22
MD5 db6163024ebdcd46b3a055ffc8377931
SHA1 120b5358129e9a7dc6d8fd78cecbd22c31ba4c3f
SHA512 afb9226e6e1749cea9835f450cea48d96e7a73f2714576deda4c1b6d8b624f8c95d62c9e8b8bf9c60c1618c6b767b30fe93fe6cceb30aab7fd05a2a09e9cb1df
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogZC:J/sCv7QExqatgl8beJTTx0yogZC
TLSH
T100054B53BA4485A2D416023144EB4653EB71F81A1F11938F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 779KB
SHA256 be8f7d0e48bc7d1039449730b041a37c998d55089d791d77840b4ac80e9782b0
MD5 9eac3d628aee518b140cc1c81328b57b
SHA1 5cfbda91f005741ddcd831f203e7b59fa7f5f100
SHA512 6c53b07fb7d407e6b276f62f29ca9021e1c51b711a3df491396e30e5ee0e9697031ffab2ba4d50bba7525d883dffdfa2066c372e6156bad51184f747eb81834a
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogaw:J/sCv7QExqatgl8beJTTx0yogaw
TLSH
T133054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 779KB
SHA256 78487cd1d97002f8effcc3cf073b3d228cc060fde8617e6a6f777a4390a9e389
MD5 a600b9776d81f59ebc451b7114991568
SHA1 e239513c03bc0797e13b4a2582807bffeb787d73
SHA512 217a3e55987e2a7e30853cb8571f8c94a1de6d3543520fc25051d9ecb1d663273c655aad177fdb1672b9c87f1a605db319ce89ab7680f2a3c669364b32a5c85f
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoghT:J/sCv7QExqatgl8beJTTx0yoghT
TLSH
T141054B53BA4485A2D416023144EB4653EB71F81A1F11938F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 779KB
SHA256 04eadd58871a9ccae03e65336a8e9525ee08b51e3e3aed0b42fa327406adf68f
MD5 003d5fbc41d0d1d44541ed3eb25af2b3
SHA1 ddd2e8adb2eb8a734ce6de80a65e21597fde6b01
SHA512 3b84ba143fa2d375bf2e1ecb76831718de91dbc027b5c8381e7c77d2265a5335cd9ffffac6d947e499410be4e0a7ae6f047d9a3bb6dc817d557219d93eaed08d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogPu:J/sCv7QExqatgl8beJTTx0yogPu
TLSH
T17B054B53BA4485A2D416023144EB4753EB71F81A1F11968F23BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 779KB
SHA256 2cd56326287c749a2266397194d340a598164e7667f3040327eba4a1743a83db
MD5 863be0c37de007017ced5f04e56fbc2d
SHA1 0517a0ff2b7d7925ff26e38503c818dacf61e423
SHA512 a8916a8e5b2c7394685e5656cf18fb5b189072fafc7a61f96aa77ed73e8008b55484a16962f6fd57a50df46557b0a464b01ca6bb9b8db1390f071e83efb24341
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogzb:J/sCv7QExqatgl8beJTTx0yogzb
TLSH
T1DE054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 779KB
SHA256 22a4d2fe6b9d840dd76c477452a5e566569ea01e2d799b9c850edcebc21d8522
MD5 f0f7009987fc07006c6642295c747b67
SHA1 3110dbbd6b388c919d788f3162c788df8627396b
SHA512 9f7b7071076ffe45fc5178bb1d612c97a96dee4b17c7b70d09fd098b2de34ee606a409fc8f1ab64bfe5688dedf5eaa832068e88b172b8b698bd516fe71a238bd
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogHf:J/sCv7QExqatgl8beJTTx0yogHf
TLSH
T10E054B53BA4485A2D416023144EB4653EB71F81A1F11938F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 779KB
SHA256 244c2c44c7888bc4128ab028f92f75a3326e2d3c0f22ecda270d6cb4861ab9b9
MD5 eb38e9ce005a4503fcc6e685e09b9400
SHA1 549c46cb22e88e81553e69805ff8ed4e0c70154a
SHA512 875d95b6896a9829e838bbae4b39f6916ee8bb4ee39dcafbeb315b076d8d0e34183f1e53f7a2c67220418617f10766170ea29b92043e445e004696117c012531
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogwK:J/sCv7QExqatgl8beJTTx0yogwK
TLSH
T187054B53BA4485A2D416023144EB4653EB71F81A1F11938F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 779KB
SHA256 330168535aae8797f77e52d8eee2bf19a600f037fdaf74a53a80adf66a4a751a
MD5 af6e8a6455c3287b85c474681057dabc
SHA1 46ebfd0fd41732f1c86e07537d73177cf0274949
SHA512 9ef2a541b1464574bf395d2826fe9b27bf5720809986a011c553f5da1f1ab6cd964f85eff3b29d16b249292e26e1ae5cd285262dd5be799ece2650edc2372812
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogtk:J/sCv7QExqatgl8beJTTx0yogtk
TLSH
T1F9054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 779KB
SHA256 c7173fb0465480082aa55157788acb8c6c51bc74d1e9c80e15a9e8c3c1f3ed4e
MD5 71584f1e55348d37080de8a5fa993b17
SHA1 a0a360077085c945bd90148f1c3b30de4aa20c77
SHA512 507fd06c11708611fccdea936184dfa94abe4b16e77c1c9768bffd3f847fedf9fe6941b0b0300c1b2a3d1149dd3eced5f57449d6235dc023c386c105f0c75641
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogy0:J/sCv7QExqatgl8beJTTx0yogy0
TLSH
T1FD054B53BA4485A2D416023144EB4653EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 779KB
SHA256 746641d0dd8731b566ef9766edd31a48c88098557de3ea51d56bf81fd9e4d046
MD5 bed9e022d89c403342c93dcdca0b5d07
SHA1 cb5cb6345025c013c11d4a7874dd2f30a0ead8ca
SHA512 92ac9636fc038a396b4b882de1192ef1aca88b930c9eabe643f03b351903afecd8337350117af66312ad2cb13e23d75adfd489788032186097c472e101441e54
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogB70:J/sCv7QExqatgl8beJTTx0yogBg
TLSH
T1DB054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 779KB
SHA256 02d3bbefdb293ee5053751c1304429e1674f4d52eedfcd72afcebb135f743bbf
MD5 f194b10b07ddb17e27afc8e81032abcb
SHA1 c93f796c10402e2455ad2fdeded7a6788e0591c8
SHA512 d936d59b6c6a0c487a8a4b5dfbeb1d026a04fb456a10cf38d464fe292e6e8154f8394a771405c1471c6c3d8772c00b09dae2cba6d2329d51f6e88f82cb60db63
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogor:J/sCv7QExqatgl8beJTTx0yogor
TLSH
T134054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 779KB
SHA256 818c12846bbaddc74eb8f5bd0e33c66129e69e9050f73fe8f9a60b918f665b61
MD5 ae1d8474dd204f34ed5cd552068c30e7
SHA1 2878cdb8ecc13308c290deb32d926c4735fd169a
SHA512 50ab92d28fb7b68def1f32832f10fb3a7f2e1fe30bc12d4152502d52651e43bdf463f8150b8d0e684afc78c8c6d4d25218894df779ba61684547281ded87ffda
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogGn:J/sCv7QExqatgl8beJTTx0yogGn
TLSH
T10E054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 779KB
SHA256 8cd15bf8469d60c67a54ff3e596b78abe7b7bcfd26ef81c817e77b6e46caf98c
MD5 c5272ed9665a1c08fe284d6fcc97ef4c
SHA1 89b37a40f5914087f587d026f5c5bb03ba701a12
SHA512 6f6b8c916604004905e03d8be0f3fbe900b05e9a1bc0700d9c0819407178882444f69970c3eb8be5997da8ee7089743e2a692ac909756f238cac44b9b6da8bd4
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogMx:J/sCv7QExqatgl8beJTTx0yogMx
TLSH
T10B054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 779KB
SHA256 dc2eec1758902a872bf99aaae95b0e4490d0249e85e84175b1476d023e9997b7
MD5 2f6917109e5bdedcc9e951da429bf52f
SHA1 caec21475e780e38fc80b940f59f2c12f2c9d8d3
SHA512 1b9828dd907348f20248d73f78b251ecba96cf8f81950a9ef223c8615db28e5fb33467f5634d84246511f633386fad9e5672e805d0cc01230fcd8f9fc7d5f264
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogGA:J/sCv7QExqatgl8beJTTx0yogGA
TLSH
T17A054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 779KB
SHA256 4f629dfc6c610064314a7eb8926e6f00ab7a89de8c0f2b7c907b6eb8f6423e1f
MD5 1b03bf8a8f7ff1b99f17d3de77cc6891
SHA1 6e041e3adbcaad9d1e28cf8e85829ae81fc3408a
SHA512 e695f82f6e945e054f7b9841802437ae486cfe02af5e0870db1f10ada1d2596d36f00543b7fe1b502443c4f97b148f90cdc42b293c10eccc0e2eaff7a7f5050d
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogf9Q:J/sCv7QExqatgl8beJTTx0yogf9Q
TLSH
T11C054B53BA4485A2D416023144EB4653EB71F81A1F11938F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 779KB
SHA256 caa2a4b5b9df100f554c0bc6d1bd18882e7bae05a5677fe5ea50e83ade36a933
MD5 d049c0e3a69dfd6b169da3dcdaa2d8b0
SHA1 8500c5ac9aa7c81d9a949485ba98d0ee69460838
SHA512 5e8c7c7bc037dfc74ec96e38fc75ef3ba791939ec4c0a8c40953215cac240e79e096c4eed6e52f0bdbb8ef9c8d9ede1151788d767e1b10961950e4d115e5288f
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogW4:J/sCv7QExqatgl8beJTTx0yogW4
TLSH
T16A054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 779KB
SHA256 10cbcc26e516c33be4efb526ea0eb17b5b98040f0b79abeae23199960ef2e7ee
MD5 e6cefe9136bdf6dba209e11a2e540647
SHA1 3301c199fd9d51a8d9b6dfa86f61317f8a807c48
SHA512 332e7d7f04c60eb152b99e562b91832fc04b15d34b2a7cf6fe0e5fd65d595d173a4af35ff6f593c930c808175f82b70a6584bc6be2514096bf38a7c9654e2e77
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogFu:J/sCv7QExqatgl8beJTTx0yogFu
TLSH
T1D5054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 779KB
SHA256 8a0b4ac4288127af63547565e3dd9f120132698e6bda8a64af5494ef198b2e16
MD5 27a54130306577d0acf4f059d3719012
SHA1 de30f39dff3e08f5e0d8150a28d80dddc7d84b9a
SHA512 f01a194d3f9de5df554992e23d8084f38d5ec116eeff19fe519e70e15f3f0f7a229cd22a8db9f96bd547a1dce36bc8eaabba44c77d679865867affc93359155a
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogYj:J/sCv7QExqatgl8beJTTx0yogYj
TLSH
T142054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 779KB
SHA256 6a708796ce4fcd1b3282f28c950bb4de0a18d3ff3d276a199a34435a6f1ef4ea
MD5 5ccbccd828d35b8446d8c8d24f1a15cc
SHA1 9f0f9d86d841a0f0cc3f346e5dbe5957d2b7fa59
SHA512 314a1ce3c169f4f0cd4e22e6fc2554564c5ebcaf8b7c2462ebcff5f3240a116d4136a1c4efa3f8ea1db5faeb9ab38f38c02460055c935039013c791c993ad3f2
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogpg:J/sCv7QExqatgl8beJTTx0yogpg
TLSH
T118054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 779KB
SHA256 ca5c0cfd140cae77b227bfa014f7eb36e41e611f31cfe6e29c1f526b8974e120
MD5 4443053f4e0c47f535f4fef1d5cb15b0
SHA1 583033bd3ca88d8a893af090da5ceb6762756418
SHA512 4a0a3084f1c9daa868b8fbaa11f37ff2810fe078fbe76294617f3debb1fd7826e06498e2fd535e9027f96cca4c65fe45abf2c773c9a21e09595d2300faabb884
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogwI:J/sCv7QExqatgl8beJTTx0yogwI
TLSH
T16F054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 779KB
SHA256 9c779941d7ce02d0bacf5e6634a2b51dfe8916237bc6d568472771c17f287775
MD5 0b3acaed596e4248670d21dd242499ad
SHA1 bbb233186d557437384d190366192f7c5f889dc6
SHA512 8ccc0307a7e30c1b5021c82bb026cc13152f396f45e6009b9b323f14001572233d282b84c0363abfade4493b1bb1acc3fd2f2d7ead2e88dce63c991ac3d8507f
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogyo:J/sCv7QExqatgl8beJTTx0yogyo
TLSH
T190054B53BA4485A2D416023144EB4653EB71F81A1F11938F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 779KB
SHA256 fa6852c8370c53c714a3064d445d121e76f1d13f14ad0725f3517e3b92d4a098
MD5 ed597d7f98206af7fa17b084f97d9b11
SHA1 688f314ba42e78b0fc503b7db26116fca2440919
SHA512 9bab4572848e1988d471ab7850207528a5970e7b9213c767a423ad62ca946e43043c05fd0e6078bea35f9437cb26188fa0e10a26fad375d2890f661e281b66c6
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogp+:J/sCv7QExqatgl8beJTTx0yogp+
TLSH
T1E1054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 779KB
SHA256 6ffca3d531d1c7447456bff4aea34589a378a6b447e8c1cac3cf9034c736d7e2
MD5 40b256a75298e81e60e439c0d1c6c867
SHA1 abcd3f133914626870b4e4db12061c2830bf0bcd
SHA512 40dcba33b42177d46aba3cccee3e2e5a381eeaa71dbfa6ac6631842d7b916755bac7d6334b6443c91a9fe52fe4c3db609337084a279cd78fe716acd872251bbd
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogXQ:J/sCv7QExqatgl8beJTTx0yogXQ
TLSH
T1FF054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 779KB
SHA256 efe2b3fd26572f1e47184e95bb0d8d24d62dd6167f28a0f6f4acfd66e9ade337
MD5 f1ecb03ffb0ed917b8fd987ef0314135
SHA1 8e4121885473fd1fb814d22957bc90da756a0f07
SHA512 92bf6bd392fa75d6e956bb17cbd2ba5c775f23cd1aa6e9239472d14e248c15d9c14ed75a33644fd9a9dfe703fc560c5683281572f13dfb9a4384cf92cb1fa52c
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogsX:J/sCv7QExqatgl8beJTTx0yogsX
TLSH
T1D6054B53BA4485A2D416023144EB4653EB71F81A1F11938F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 975KB
SHA256 63f43eeb81d5b8f7c215269e4fddfce2435e64f470c0b0fd9e960fb9be91c86d
MD5 ab4387d55850e83589ada98fe78cf1cb
SHA1 34cde0490ad943ac2bf78f396ded94aec68022c5
SHA512 519326ae47f037fdd37d638af71d8579d66ccb77f7bfc5d75735537574182620a1a7df9042670b50b487b3798f9b882a9c114311b6ef229f24ba3dbcd9349f34
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yog7jCXF7IwZ:NDqatgl9TKgC17IwZ
TLSH
T1DD254B53BA4445A2D456023148EB4752EB71F81A1B1192CF23BC9B6D2F33BF07B397A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 779KB
SHA256 7512b3e963986e0000006df622a46b2ed955a5b339f0db5f3ed130f00b2c809a
MD5 0eae363225799342bb4f8ab4e22e7fe4
SHA1 5a01efdb956e2b45bfe7c2549881a0f9cbf17451
SHA512 2c66d8f7b00b8d4e5a329f4987275a54d0375947e7b965ad3b4a1a7f1d4f7d642cc7e6194bf6ffd6b61f26c0f0ee2aa840e29c2424bef5731682f894716b757b
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yogKL:J/sCv7QExqatgl8beJTTx0yogKL
TLSH
T177054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 779KB
SHA256 498a84a2cecfdc18999438a6a70d055d9e8ce3020208360a29e649c80db24bea
MD5 0ca1079d3f623b6a186f08f6147161d8
SHA1 2279be9d1ccc5a85bd8d75dd2f9f5c5f72cab36c
SHA512 ed655629d983a5f5462e6302ffe45c3a6e63390dd8df299231d1e826464c231a122f56cba829afd15d81a559bc4d0c7e82d358eaacda7d23e31835a85e07d573
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yoguFC:J/sCv7QExqatgl8beJTTx0yoguM
TLSH
T1F3054B53BA4485A2D416023144EB4653EB71F81A1F11938F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 779KB
SHA256 d8c1a81f736c3fefa4ac8adff7a4c6dc6f08a08265c44ff880a73a75f1050a80
MD5 65bd49a0b4e07f869ca77c35c72bd5f7
SHA1 c24ec49574cac1d0030515683a5a17fa7323da6c
SHA512 a1d153129215117675c004613528a16b192267d0ab5c1407e384104cdc181bb71ba57fe83df79f35b4e16548b5801a1f79fb4728847f56454461b0335dbc846a
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yog3h:J/sCv7QExqatgl8beJTTx0yog3h
TLSH
T14C054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3912-2091-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6056-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/6056-2054-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads