99ef64565fd0fb42be86668131ce28657cfd9934c57120a4be4318411bf42784

Analysis

max time kernel
96s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Size 761KB
Sample260821-12nj4adj21
SHA256 99ef64565fd0fb42be86668131ce28657cfd9934c57120a4be4318411bf42784
MD5 f3bc49789359f88f17ad648ac137545e
SHA1 0dd3b74862ba762a7e837720d495a4c69ad466cd
SHA512 dc5ec73f698c8db6db4f163dbf2cfc8984e6e051baac37535acdcb1b607fb77ef7a7a3ce21f6596c6b40eda2801eae05529a282f16d04fb378540d47a12d26d9
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEO:qCewdx5tul2Mf0nkxqatgl8bCaiEO
TLSH
T11AF47C52BB8180B3D15703318CA767A76BB9B8621F22934B2398536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/3412-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c53a-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000000432-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3412-166-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2996-167-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-434.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-593.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-709.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-748.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-841.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-925.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-958.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1082.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1125.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1244.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c53a-5.dat	aspack_v212_v242
behavioral2/files/0x0003000000000432-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-240.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-434.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-593.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-709.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-748.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-798.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-841.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-925.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-958.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1082.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1125.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1138.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1169.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1244.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1329.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1342.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1367.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2996	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3412	2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
2996	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_f3bc49789359f88f17ad648ac137545e_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3412

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 761KB
SHA256 99ef64565fd0fb42be86668131ce28657cfd9934c57120a4be4318411bf42784
MD5 f3bc49789359f88f17ad648ac137545e
SHA1 0dd3b74862ba762a7e837720d495a4c69ad466cd
SHA512 dc5ec73f698c8db6db4f163dbf2cfc8984e6e051baac37535acdcb1b607fb77ef7a7a3ce21f6596c6b40eda2801eae05529a282f16d04fb378540d47a12d26d9
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEO:qCewdx5tul2Mf0nkxqatgl8bCaiEO
TLSH
T11AF47C52BB8180B3D15703318CA767A76BB9B8621F22934B2398536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 72f2ebc07f24146dcfebdc2c2895fb3bf729c22fbb01d1acc811404cdeb45f14
MD5 b533c64b789be64d11e389e4bc5fa3bd
SHA1 7c9df53ff82bfb480120a2a933db878681ab139e
SHA512 1a709483db159691e90bd877c09c0bd6c70dff5b5986554ad7b36a8e54381acc3df3982993c803b3c93306391bb033d7c860719407f5219122da0c1d2403c04b
SSDEEP 24576:qCewdx5tul2Mf0nkxqatgl8bCaiEB0Le5ji0hmxNrM:QgE2Mf3qatglSPji0Aj
TLSH
T1F0556B56FAA48272D0738175C8E3A79AEEB174421B3186CB1398937C2F737D19636732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 775KB
SHA256 25e14c9d6a1dab1baf09b0ca021fa191644c25ed7b7b9c9666d83c1e62650ba3
MD5 13eaf4390c19718fe4e62544ba18b929
SHA1 67690f2f7926333af68a0c9707179f3bd88ee31c
SHA512 f38dbf2d218e6537fe68582c73074f182b986d8ce22bfd3e3457b8bd78d2da14bab8793c5855da51172b4d46ff4cf2b44f797cd32edaa184030265e9b1ecf29d
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEDa:qCewdx5tul2Mf0nkxqatgl8bCaiEDa
TLSH
T1D9F47C52BB8080B3D55702318CA767A76BB9F8621F21934B2398536D5F733C0BB36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 785KB
SHA256 3b7d34c9d9c05271229dc576f5b33ddfed8f6c4b0de004994a4bde4dedacfc60
MD5 9928d039503fd66f2bc2e7f2b3f20aec
SHA1 c27c7780c8777912e92011befc1f855708b63751
SHA512 13462e0e596c60a01b9d71106be8d2c3f59d38632c3973d242f7df105ba5efe6e988fb6a566f5b3e63e5e2dbad4558854249a66cef4b1e86a2aa9efc936743e7
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEi6:qCewdx5tul2Mf0nkxqatgl8bCaiEi6
TLSH
T19D057D52BB8084B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 785KB
SHA256 09889ba84affde28ffba55db74d406f40e85e189d54839910107c997db36494f
MD5 ede59549a1b7af194cdd2bc02a8247b2
SHA1 360db34592da77d21442d087fbc267d6f9158ea4
SHA512 59c45001147ffd8c9aeba96a55c0311dcf01bcf565d510318f68baf6d21fd34d113aad06d0547c66ecf252a7fbe5ad060671feb1a51fffae1a433237fedd3351
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE6N:qCewdx5tul2Mf0nkxqatgl8bCaiE6N
TLSH
T13A057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 785KB
SHA256 04a4cf1df643c0229729adde1f070b7928924053c4f4e26c1722387d8ef7dae8
MD5 28adfb3d3e220886574eae44194ffcd4
SHA1 a1f6242671e136aa74215e99f7a52411fd24e5a9
SHA512 a398e6f2c86470a90d616d79c6830de4285da931cf254c149f42a07e11cdc02ef4c2fb37397b0d2815c05ec9c0fdafe0e68b7c70ce1da493a023f022bf66bb38
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEgf:qCewdx5tul2Mf0nkxqatgl8bCaiEgf
TLSH
T152057D52BB8080B3D55702318CA767A76BB9B8621F22934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 923KB
SHA256 bcf013f2131ac3a240662f0241274d3d80f7474f4c2e551f23b5908c224eeed5
MD5 8546d9e659bf590b9796a18813fd8709
SHA1 c4141818c3db731b06a3802579882d57ea3f257e
SHA512 7dcb973ff1951f3be866613f7f25f9a7b7909334168ae62141ccfb3851be28d8454267ecbb6fa11b80a9ea3d611376ca49d01d2e134e8f6a458d6e4ec84a145e
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE+yPz5L87:qCewdx5tul2Mf0nkxqatgl8bCaiEjzy7
TLSH
T1AB157C52BB8180F2D16702318CA767A6ABB5B8621F21934F2398536D5F733C0BF36765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 785KB
SHA256 5aad97e9e0fb627791238705c13d9741f6c49e15f0e214f027db9bf2f1f094ee
MD5 92f5c9135e1a822b5598386807e4e3b3
SHA1 e213d9b8d4c922e884206d534286ab05daef34cd
SHA512 e1c7d5849baf233e27d5a0d5857a4f894cbc994261a112f452108c871809bb467e41cd294c32e96a698410ef3114714b59b97d6f6559d09614c5e36fac836d34
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE6o:qCewdx5tul2Mf0nkxqatgl8bCaiE6o
TLSH
T13F057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 785KB
SHA256 1e77074fefe916bae739cc102fd1e5657ccb44578fce96899aeb26d3f4308684
MD5 ab2d28206ac9198df18b5f2aa1657ab9
SHA1 b1f75ba7338526814759178db5abe8ffdffbfd64
SHA512 be3d4c6cfc41ef10da064d321a02cabca61413ae7d387a20a0ac27b5dcc75e1ef6d31add80cb373e736e2cf86bce7a9000f14cae38910685173305fd9976ef09
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEOu:qCewdx5tul2Mf0nkxqatgl8bCaiEOu
TLSH
T1D9057D52BB8084B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 923KB
SHA256 1c23f7c00760f89de28c2062ec18c9e001f2095e008023dcd2d3faa3da3b9ca0
MD5 2a0d6bc86af42e5958f0be37a715032d
SHA1 69b84a5f8dfb29c104474f56352c63c777ba524b
SHA512 bbd5e1529d7a187da9bcc2bf5c2dfc053e8f784215d61fd2ed7740d0840e01e528ca1deafbda1c47d386b00b89254f67fcc5a674e914f8b54d20b68e4db21bd0
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE7yPz5L88:qCewdx5tul2Mf0nkxqatgl8bCaiE2zy8
TLSH
T1F7157C52BB8180F2D16702318CA767A6ABB5B8621F21934F2398536D5F733C0BF36765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 785KB
SHA256 ba32d4740d1969d56dd3e4a4ab2916a4c20d67baef410811dfd694ed05017214
MD5 4529eb84a9c5569bef33d3c51ae81376
SHA1 29052833218e8ad64b4c9582c27b071c10cca1a3
SHA512 dabfb00976eaa0dadcb11d11328d699674ff1029d1df64e0ad46733bf3ddde49478741826873513e230a58f7118a71d9332b8953ef602fe866ed0bf91124dc5d
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEC9:qCewdx5tul2Mf0nkxqatgl8bCaiEC9
TLSH
T1A2057D52BB8180B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 785KB
SHA256 54f711bb318afb91407c5b1d0f9bf7ceeb4150891421f618be140bde934a2290
MD5 763d33d6c57e24d7a92b7f02fd193cee
SHA1 fc74a2df4c68d7c0663c8a9b59bd9e572085326f
SHA512 ee733aa0da5126e08c24f75edec5539a479bbfdfbf5455ad592372a9d99fecce2bb3ab2e162789614053ee49ac7ef230db654d78efb1fe11d3b38adeccf37be3
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiECc:qCewdx5tul2Mf0nkxqatgl8bCaiECc
TLSH
T195057D52BB8080B3D55702318CA767A76BB9B8621F21934B239C536D5F733C0BB36766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 785KB
SHA256 bc1956070a7578e7d750654e504c29229ebc625c70a7557129eac76dc9d97c88
MD5 c35abedb29e1b4e2662f5fbcbefc71a4
SHA1 c37af10df892693a3fa2806f3e484f339032e56b
SHA512 57a4b04625f7ad0ba8df0b363b2528e0cd8e2b836d89d16ba22ddddc3c8b2aa69f57e20b9f35d015032d1ad38e16350419955b58305d60d1e95c08059ac72806
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiELp:qCewdx5tul2Mf0nkxqatgl8bCaiELp
TLSH
T1D8057D52BB8084B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 785KB
SHA256 990c8454690a25b7804eb30401b01ffe1484d34e6f05af7eae375406e95fd720
MD5 363401b96bfbcd99112c17fb3f252cf3
SHA1 1ffb22dce7562da1e8edaa6f21ed298417c9fa7b
SHA512 4c8685fa47279dcd2f67b580aaa6ea84893855c52c50208cb576be641d8688ebe2b3ea3ab5038b5161e3b7fa200e83341503adb5f36d890c1f217f28a109cda9
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEc0a:qCewdx5tul2Mf0nkxqatgl8bCaiEcN
TLSH
T1A9057D52BB8084B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 785KB
SHA256 3732eb3e5eb53fe870f875a96d4165dfcd9361e4fbc71d3d12801990fa4ece05
MD5 2df38c0bfc10751fd8f3cfdeb3163a56
SHA1 44aa587747aa8909383d0ccbae0ea2f92e98ca1a
SHA512 876542b24d349841f605d47909c22057d9f11cde6d22600949e719655105978e5688263469d88d4afdccf58970387154d5f7b0e686916f3ef6e329c161d72af0
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEEF:qCewdx5tul2Mf0nkxqatgl8bCaiEEF
TLSH
T1CD057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 785KB
SHA256 d3de12e6beb43c2cc0c73d5de3ccad0d44e98b328ae5fb08a638641328c2ea2a
MD5 b037ea22cb86c5c9308bede5b0b6cc09
SHA1 f70de07a114d831e8f28b1c02c4cc0c4fac072d6
SHA512 29b1e491105091abbc70c396c1f167b66887792f77863827ee2fcfeccbef97dd1957c282334e9e40e1ce18fde977917a4e9733354fb363b8f843dd6d9eaf1a8d
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEhC:qCewdx5tul2Mf0nkxqatgl8bCaiEhC
TLSH
T13D057D52BB8080B3D55702318CA767A76BB9B8621F22934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 785KB
SHA256 09075e833163f6bc3f3029a79864de962e3a43a6c6b76ba52542a9ae38c82a4d
MD5 5347b2447b3c6c12cf168e024f0f59ca
SHA1 9a0ba8884c1ec6ecde73b2814a4ee263aa11dbb5
SHA512 c4a87ec5fd2fdfd0cc1c164b2442d0bf7c5cd5e9d125828d104d2fc075d79f9d11f6ce2e21a7abdf540c5d0b072564f5fe6b3c022c2201c6ba00ea8496bd3381
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEiw:qCewdx5tul2Mf0nkxqatgl8bCaiEiw
TLSH
T1DA057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 785KB
SHA256 8adde070038bcd7220dd33a80c9fceb25aa55d939534f5be3780c69a9d7ac369
MD5 716c773fa114ad5fdc516b7c5538595b
SHA1 8ee37c111d6ccbbf5865d4f114cc69a691d15cb2
SHA512 d2e926f57525b2f59acc78c52d5ee527e250852d9fb3ec75755dc0f386c256c165c132ddaa1ffb4477275ed91d0c9e4802a91de3323eb105c40efa79febff81c
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEpT:qCewdx5tul2Mf0nkxqatgl8bCaiEpT
TLSH
T1B2057D52BB8084B3D55702318CA767A76BB9B8621F22934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 785KB
SHA256 51f2bb90754a24004ad33d94f763ba310ff2ce8f5cf17a9af88eb808028c13c6
MD5 411711cb610539a6a1f0662126f4b6a2
SHA1 3095762970baa98676454b2103d76a4d4d3e78d2
SHA512 50be33d2b2c3f045ac4e5a3a194387c557efcf91ec3da35c5df22c25bf03c49af75c78e2369c82d3414a91281cf73c2037680e6c67ba7ddd7abff1f09a72953b
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEHu:qCewdx5tul2Mf0nkxqatgl8bCaiEHu
TLSH
T167057D52BB8180B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 785KB
SHA256 ab6cf1372d50cc2792888c03401aa00f8c5d017d4ab0fe3b00d5318a8a0b964b
MD5 07e3dda505f2f530d91ac1f0e23de85a
SHA1 eda96b479cd507ba5bbe0a28fcfe4afb04247bf2
SHA512 de7397474b512855ebf0d7afa99d605db07e3d027e2779b1a8b54d0116e6968dfe84726f8dfb8a9d4b8ff4b35d64e2a1d49a75dd8b179163b3f5c82ff216bad0
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEbb:qCewdx5tul2Mf0nkxqatgl8bCaiEbb
TLSH
T131057D52BB8180B3D15702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 785KB
SHA256 5fa0c4cd68594502fd937a815747055398baee5776087e94e53fec9c06cd131a
MD5 1d4560255836f8dddcdf06e8007bd26c
SHA1 1a14a6767aa9d689175202456d86aebb0f3c2aae
SHA512 d120e3627e5865fcc4d863e7606d789798bb996a4d08995e6f7794c5046e14dfa1924fc27430c59f266ef3ec8ed5df2801461e67388e08055d7212f972abca59
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEvf:qCewdx5tul2Mf0nkxqatgl8bCaiEvf
TLSH
T18D057D52BB8084B3D15702318CA767A76BB9B8621F22934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 785KB
SHA256 da3b0cd11579287f4a50bc8314c6b55e2f31b7cba07ff6563318a6a12a2aac7c
MD5 c8d2b34ba99b02a8248195576bcf612a
SHA1 f17ed99dded0bff6ca716c50c10c28109865e97e
SHA512 1c39d667d787be1ca41cf59fddcf52517b58af68cbfda6c01546745e3b7346cd981e95fdc60a4de78f27312c2edd10b88ab2ee917288da99085f287f587489a9
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE4K:qCewdx5tul2Mf0nkxqatgl8bCaiE4K
TLSH
T134057D52BB8084B3D55702318CA767A76BB9B8621F22934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 785KB
SHA256 d998bc3449625a2f0ae3906d469e7fe6a49578acad3bb6e88c02017104f546de
MD5 dce5915b978c8df938f587cbb040293f
SHA1 ed638997464bb2f1237dfbe29251635eb54d29c6
SHA512 39ecf00441103f8b9f9a6cbec193a905cab00a165730829d3a1db3e4255fd834966908d65bac418cbce11014f6016d6ed0656ee75de05c7a0f7103c9f5e512b8
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiElk:qCewdx5tul2Mf0nkxqatgl8bCaiElk
TLSH
T1AC057D52BB8180B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 785KB
SHA256 b3d72d65946b57a3a71433aa171ea63a6e81359f4d405a50bd23709347da5de0
MD5 25e6a1012fc37902ced8e4051442f592
SHA1 a21a1327099022fa6d487f94c816c67a2e8cb544
SHA512 3b90db6104c166760ae20d9b634a19b73f6bc6265cacf093304eebdd98f28c0ae95f967a7b7212917f9bed5ef6bd3fb74192a8c4808be345311a8b720969ad65
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiE60:qCewdx5tul2Mf0nkxqatgl8bCaiE60
TLSH
T1CB057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 785KB
SHA256 9ba259497a238033dd07ce0787c4891e99ce23ccf92d0bec2b968df0493ea23b
MD5 0bf4552cd0dd99f3ef7fc4ad39497240
SHA1 d478fce83fad23d7ab9dea7889ac14434880480f
SHA512 277f0125a3f6b8f562c1e34800ce4cc6ae3cfdfc9ead1d1966be243c277d16bfa3d1183efdbb18aff15c43ffdb946bb293aeaff9f1b7f57a6db8ab65afdbbd57
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEp70:qCewdx5tul2Mf0nkxqatgl8bCaiEpg
TLSH
T199057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 785KB
SHA256 865872a1dbcac6629d15728a1cd81ee246fe2f0bcb9686ca08216b42523a7a72
MD5 46310ab8c7b4e74dcbee227b5e2c44db
SHA1 4a5c56aafbcea3bb834d83e5ae8f5181069a6355
SHA512 8737c8c95ed968cb4a574762f659b948d249f0640a0b3b51a85dbaeb1b7db073251e5a183f5bacf98867e221a6b4619d077d30384ca64a2fd8072ed6e62defe3
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEQr:qCewdx5tul2Mf0nkxqatgl8bCaiEQr
TLSH
T1EC057D52BB8180B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 785KB
SHA256 d14cbb115b943e844ddda099a80e4972a608746fa94540ea938615112044882e
MD5 9ddc83fe9fc24d9f3b5dcf14565f808e
SHA1 2b022abbb4e1ba44355ad02105937de040f32432
SHA512 7780cf15461a2c9d9e040d798d5d17fbe0d7e6c9ae75609bbe98430355c795d1e59978be71d7b6d0c215fab7ee399884b64e2553cc3dd2847cf8f53b7d6456fe
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEOn:qCewdx5tul2Mf0nkxqatgl8bCaiEOn
TLSH
T158057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 785KB
SHA256 5bcecef7d91dc94abdc59953d85634fd069f8499d8fa7b1a808660050952bf85
MD5 31077cd877d22ca71a21b0cdbac5fb83
SHA1 1e65e051712e71df57398ab8febd50014474e005
SHA512 64d417ef0bbc718e2f841ae2234cdfd15a70058d8409213dc3aa9b2307d772bf75c7d6a46572d8f8b1d0c1fec089c7c1dcf90380d11a5b0ea08e8b270a0dab4c
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEEx:qCewdx5tul2Mf0nkxqatgl8bCaiEEx
TLSH
T1F1057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 785KB
SHA256 a647464cdd60173c06d1bb4446c7d0160e0f0ae7b14c3c0a074ea42761b7c49a
MD5 808144a273bc7df0b737eba744f8c10a
SHA1 41e39ba395a63c771637e4e44cf0274c3ac22fdb
SHA512 b2fc3a5add786f14feaeb0b4742533cced5eeccdddb611506fe26298b13945b0b41d7c5eb82f9bc006765ff40a924b257b143f1349efe91158817f676a0044c0
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEOA:qCewdx5tul2Mf0nkxqatgl8bCaiEOA
TLSH
T147057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 785KB
SHA256 e719833df98c9bcd981b31ba682d445863b53e150e006f3a11ca93ff3456fd58
MD5 eac16461ada60167b42b39d12c3a6ab4
SHA1 1ebb69f885297942b597b138a83f96f3eff517ab
SHA512 8b8cce64fcdac26f56435fe78491faeb8620704f8db8bdb724624554079e4efa965c9f331201351dd5b7bf9fad1e90f62240a922896b2638af02e3867d480b80
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEH9Q:qCewdx5tul2Mf0nkxqatgl8bCaiEH9Q
TLSH
T1B7057D52BB8084B3D55702318CA767A76BB9B8621F22934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 785KB
SHA256 597739934eb40c2697a0f65514a801e2a613fd9ab29386a8deb12d188005c9fc
MD5 4341145387688088041382490c1b8a7d
SHA1 c2b8d9eb7ebac33f3e41fda950875b75c7501c2c
SHA512 f67cf9298662cfa3e69f46ef46b59e61feb077899a5e67413025df5a774b04c4c250a12aeed7e0516d4cd4137c0f4989b264b20bf5587a96d620a9f87603b591
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEO4:qCewdx5tul2Mf0nkxqatgl8bCaiEO4
TLSH
T131057D52BB8080B3D55702318CA767A76BB9B8621F22934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 785KB
SHA256 a051b6bc65024510eb6596fa59dd2798761bf27ab09b7a98775d9f180817c314
MD5 573f57aefa3257a5854a46ffde30dff0
SHA1 dd0da5ec37087d2eb31c6f7a3b7e725773701e23
SHA512 58c5183e1acc7d9044599f257f0660d7da394fd642bccf71920a428432da983bbc31d271c9e07e18e459e532db46572c566b968f50a70cb0f1935b8ada07a4fb
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEtu:qCewdx5tul2Mf0nkxqatgl8bCaiEtu
TLSH
T1AE057D52BB8084B3D15702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 785KB
SHA256 a0a8b52d295f4989ef71a77098723ca7603bfd5a6feba4a3b9b9545ebfa7d059
MD5 1509b9b000334455115c17da1d89ff9e
SHA1 58b32d651de6db8d7832619e3ec3e6a2f175a056
SHA512 3c31dfc6a8cbd2a986ed213fbbe55bb4de6659276a4a7183855b58c114dfa2bc55cfe77389b37557fd0d74e92e138fd18b7c628404d1afc30101a91ddf1044f9
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEgj:qCewdx5tul2Mf0nkxqatgl8bCaiEgj
TLSH
T1EA057D52BB8080B3D55702318CA767A76BB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 785KB
SHA256 ef991f7c4a10d056d194fedc9f7f9782feb22d35c6d5b0bb77d6513fdff1592b
MD5 dfaf0e3b6b3a1ac33fc3d911fdeb5379
SHA1 f40519bb0c5855964b365b37e6d6f916c16648b0
SHA512 a3b753a0b114ada12e7185235c5c6747f302bd6d8d843c67127c7a10ff896b5fe4a58bff18a3955a4eb5555c095e7ec9f43f92863a8bc82ce88c50a8dbe27cb3
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiERg:qCewdx5tul2Mf0nkxqatgl8bCaiERg
TLSH
T1A1057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 785KB
SHA256 87e5d65d03589abb951a6db5f41490f9b55847a61880e32a9ad588b70a904cc1
MD5 44a0505dc69bc06356be6504361b3a58
SHA1 9a853b987a7ecb5f5e7862a42fe50fe8cd8d5e1b
SHA512 1e568f2c15fe293ba063f967965dffa380c1e697882f157e0a838dd71ffd17ad67949319671a7ac316bfa0ee65c5b9c1a98c3b8f3080b99e5018b208ff0cb252
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEII:qCewdx5tul2Mf0nkxqatgl8bCaiEII
TLSH
T155057C52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 785KB
SHA256 a283af5bd10ceb4c79fea9e2d5576ac18754a4ca3c32abbace7fee795f945828
MD5 6f820731b39d27d2d1746adfa7b1126e
SHA1 35c696b1b06a3aeceac3e92fc808539cf7bb94cf
SHA512 7f889b05029be5c6cfb598cec29466a8707e79ee8c2ffb6cf11fe06c264047059d01483358f2db6ad30df3d12de66b14513fe4c8f9dc377264045a6c16ebb88a
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEqo:qCewdx5tul2Mf0nkxqatgl8bCaiEqo
TLSH
T19B057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 785KB
SHA256 e4cb599ed157392a4694cbc92fd6635a239bbba686d194f5df3f8a1cd073f085
MD5 e66d2783e944d883701ad640f4c8f991
SHA1 5199016b1b8e2f0e5f9704a05a4fe3185f4e548f
SHA512 5179a388fac12d4127c39b206a8b96e702efb464a364e8cfed087a5bf7e561612058b724bdfd417183b1752e454676228066bfcc612f9b051bf3148938ac8983
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEB+:qCewdx5tul2Mf0nkxqatgl8bCaiEB+
TLSH
T1CE057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 785KB
SHA256 f3a5e062027fc22467241613dc9f80c25ca9c759ca43fbe90a6f61984bd561d6
MD5 e28794d1d48c601469da5e92ed4f540d
SHA1 50cc87f6c55c4c3e8099c980aaab9f01ef88c06d
SHA512 1defb036aadd4a374e4aa393cc99b2bd6cf5f7e3ad68189145ee40264a6faf1d655b9dd5adf7110a1530a118efdb0673775bce7260384cfdb9e0c5c640861f50
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEPQ:qCewdx5tul2Mf0nkxqatgl8bCaiEPQ
TLSH
T104057D52BB8084B3D15702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 785KB
SHA256 aedf57a2af7c82571dc4c90e83971c9ad53a4b63458d3eb90a773fcf6f882513
MD5 8d3e8b2a9fd857540c0dca4e4e5cc40a
SHA1 3f7116ff108fa13acdf2da77a84d6f66d74420f6
SHA512 1b0a6758f337f4bc75ce76453e8964de244ff8b2dfb0911136e2d376e2c1089b826eb61a0f849dbc324bebe1f4a1d639a5ee0b44c14558f1e1453bc62fa0cbb4
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEUX:qCewdx5tul2Mf0nkxqatgl8bCaiEUX
TLSH
T147057D52BB8084B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 785KB
SHA256 b71c48d1f14e6c19c417f6d1faa94b2e0f4812adf3d7d1d8f336dda93ad3c0e7
MD5 99a757ec66701d80b76fbdc095b6d8f2
SHA1 9d825b550d38d07ba82f6659fce77622c60a81b8
SHA512 d4449fb29086a8c67c0abf7237acbf5d08d08126475f1119fb381a9474d3b6b96894422af11b07bd7a76591a2ead9e54af48d3562eb14080d4405d1bfae1d350
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEyL:qCewdx5tul2Mf0nkxqatgl8bCaiEyL
TLSH
T17D057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 785KB
SHA256 9d636f94750cf274c14854dd36b609ecc29eb170c3ae581d06e5f4ce25c6d62a
MD5 14aad8f48ac116c0224304f6eaa56e93
SHA1 31f27a5a7f106539c82bb4db27021a13b19636bd
SHA512 488bfad17788b62ac282d70522cb3e6d0084a58a24c716b902e460a575c92dd267fb0c8b1af21c487438c0c9033ab4092ebd2367fa1a7fe87b31c80277793699
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEWFC:qCewdx5tul2Mf0nkxqatgl8bCaiEWM
TLSH
T168057D52BB8080B3D55702318CA767A7ABB9B8621F21934B239C536D5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 785KB
SHA256 8ab45b36c4cd1a86b03e590cc4558fe3881fd9379052b5862fc2d4e755e0fbae
MD5 7d91301baf203fde1228d4b3302c6e37
SHA1 4c03fbf8106a96136ad8967e6edd18eed4091148
SHA512 7e761fa2801aa990de05f47a09debf363fee8b1e1d7c38667ba64098eb8d3a3aa68d74d04fd0dbd0baf11f14af07c80c0c32078abcf98e5625caf3d57e33d4ed
SSDEEP 12288:qCsFNnoDPdMWuatuPtXmMf0n+ZeDuUlEqatglsLbCaiEfh:qCewdx5tul2Mf0nkxqatgl8bCaiEfh
TLSH
T11D057D52BB8180B3D55702318CA767A7ABB9B8621F21934B239C536C5F733C0B736766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2996-167-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3412-166-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3412-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads