045b6c91379a6d3181cc8800046df6eb65e66cd238b4fea8f86c1a0659b9756b

Analysis

max time kernel
92s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 22:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Size 741KB
Sample260823-162bra1ckc
SHA256 045b6c91379a6d3181cc8800046df6eb65e66cd238b4fea8f86c1a0659b9756b
MD5 c30eaf5cef5ea572c8baece14f29f0e0
SHA1 82ee313d64f72239e50c880dcd28439097f3265f
SHA512 a9642ab2c80ca84990dbc3174aaf9209db37c54789fe2dd9e7dcecaee53e4ae9e3d28511ca83ff6c230d2671ba220d2b8bca7ca2c02880a8ba46e763b30a03d5
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5f:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5f
TLSH
T1C4F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/4632-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c589-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4632-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2564-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c9e-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-474.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-590.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-640.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-725.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-787.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-800.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-881.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1010.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1053.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1066.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1109.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1353.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c589-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c9e-59.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-223.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-260.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-474.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-499.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-590.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-640.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-725.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-744.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-787.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-800.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-843.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-868.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-881.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-954.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-955.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1010.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1053.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1066.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1109.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1140.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1165.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1185.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1223.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1327.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1340.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1353.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1375.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1386.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2564	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4632	2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
2564	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_c30eaf5cef5ea572c8baece14f29f0e0_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4632

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 741KB
SHA256 045b6c91379a6d3181cc8800046df6eb65e66cd238b4fea8f86c1a0659b9756b
MD5 c30eaf5cef5ea572c8baece14f29f0e0
SHA1 82ee313d64f72239e50c880dcd28439097f3265f
SHA512 a9642ab2c80ca84990dbc3174aaf9209db37c54789fe2dd9e7dcecaee53e4ae9e3d28511ca83ff6c230d2671ba220d2b8bca7ca2c02880a8ba46e763b30a03d5
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5f:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5f
TLSH
T1C4F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 c5092e0f909ecbe7bab513bfa73be48d856f5574eb4d35342f64ef1c594588e0
MD5 d6155a41e3f93804a303325ee0c08c85
SHA1 c8160ca10b5af98b17b89e18282d02a622b385a3
SHA512 ecbd66be77e9603741f574f88ed6d82fc17ef96719190eee9896d5335c88bdd2b543680e50d21528f622d99446bd3b84f81fa743bcef56ca998f830287fe9f6d
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5L0Le5ji0hmxNrM:A3IqJtb2IePji0Aj
TLSH
T142551A25F6748731D073C0B9C5D2A69AEE7234825B308ACB1286D76C2F677E6C53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 789KB
SHA256 3169636b7f041637219c7f9badf33aef4fbc44ae9021bc47bcce7bfbd59af123
MD5 bd0f5d73dc668ca18e2f9d4b14ae4a5b
SHA1 31980ca4b5aad19b7824cede7fc61fe204db4b7f
SHA512 fe17c40dd08adac7c9bf8d2fc7f13920fe6970f71d4b066d58f4395b863bf81a86237b17026f37e9f6a78915caaa2caf41de750748e032d5a681d70cda7d1080
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5ub:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5ub
TLSH
T163052A25F6748721D073C0B9C5D2A69AEE3234825B30CACB128AD76C2F677D6D536732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 764KB
SHA256 a1f5e1f7a57ffaf3cff3c14a052ce07c7cb7c063d2184d597c23181d12e9f78b
MD5 d412a6d94280721c0a282c7aa14dba54
SHA1 a0f6abcdf09f3148d3210c48645681d32b7a1658
SHA512 9e100c0348530ba782df9d1c9c1b9ae4737bd87e39fe509f380845ee6f9a1f6164b3eeb0ee46584a32b0e37ccac349d3488ccb3a1a37dacab0ed8985030eef46
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5E6:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5E6
TLSH
T1CFF42925F6748721D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F677D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 764KB
SHA256 0e1c5818f07b78466c6c46313cdccda01a3ba6c71d3d98258a5d1b6f441a288d
MD5 49a43a8d03ccf712707c0e712537dec5
SHA1 02826a23a4d9e39fa1cf43e2561491ff478a9bdc
SHA512 34056f5f318e143cec608f2adfe386945e11f269f888ebc1daadda4595438d53aeaea52b03a352cd9bcaf89441194714babedadc2d5713537feb28f31571b9ad
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5gN:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5gN
TLSH
T103F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 764KB
SHA256 2dc45db83bbee9e8402edafe6561ebfde67b08c58441bf96f6e8d44d91ff07f7
MD5 247917091872bf424d783af1f7c04af3
SHA1 fb398a187067c50067f457d73ecbe89950a6e4a3
SHA512 fc9c074370495279110a1e23c4db58a23770b9371a42ee925fd40eb87cfacbedabbad4ada49cf37f437e51dcb3e0e497a3649d63c80bd98866d06d1ca24807f2
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5Of:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5Of
TLSH
T154F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 902KB
SHA256 88499b8d9030014990533464360bda7ea320d7548f58134b1b51e050a2f35a4c
MD5 420d3685c2e6483fe1bf228dd154d24c
SHA1 0d5d53d3868acfa5d34e4024e7319e8b6afc4adf
SHA512 793136d4734e74f5955d6894d32999e77738e53dbf1e13fed7cbed2b7eb8b9acd3bc8ec7d4d439fe4d74b3a0d953b2ad9580e2bc17b4f42e9d44a6c389e638bc
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCz51zy7:A3IqJtb2I4s
TLSH
T13F152A26F6748375D073C079C5D2AA9AFA3234425B308ACB1289D76C2F277D6D93A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 764KB
SHA256 24e0d4b1cc87eca25e188748453d3a3ad98260e1a17f7b0020f5c67dd76e8b58
MD5 b3f61d354d29f0e6876b343879bb11d7
SHA1 ec27ad4e1d8388a1e7a340719c7edd73c67bf914
SHA512 59a36295e15a349731adbee1c625f185f313b978ccc9b15bad9d8b4bb47b801d2a8f6215cf3e652635ed8f7850bd2e7850256003245de7d3a3649d04c8f4bc82
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz54o:A3mMYTqMi8CtBd2QHCHmTBW5ETCz54o
TLSH
T10FF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 764KB
SHA256 56f02fc4df6b2766773510f6df2f6f2b923f282f66d9ff866826e1836fa7e8fb
MD5 f4571f4223a9508a4515822171d0fdb3
SHA1 c9b1fe55152df0b436f31469ae921224d94e5995
SHA512 ac6df19b09691b3444c8050906993d5f4cecbd2d9ed25af4d4307cd257c3056c35884555418ceba435abdb8103f677998f05b9010337bba40c2c64d16faac42e
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5Iu:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5Iu
TLSH
T1A9F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 902KB
SHA256 32336ba90c113f06f6a194e124b11d492cdb0c6f6257b961f9b66cd888e5a043
MD5 c48834c96f52f705e593a446a83f12ec
SHA1 c7baa2464120c7248a2ce321ede4b07111849d0b
SHA512 ccd525d7ecc38f909a7b30886e080c485e0e61d0adac3e0f134191de818c639c4f14035defa423da42c962113bc8568cdf3109637125fa1f216100199a0f1128
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5Ezy8:A3IqJtb2IJT
TLSH
T1DA152A26F6748375D073C079C5D2AA9AFA3234425B308ACB1289D76C2F277D6D93A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 764KB
SHA256 6a6e3753b93c8e00355db411566bd5b0e6b4f06864dee403e3d15928137bbdaf
MD5 7383e5af47b00d5f0f05e2af1a40633a
SHA1 8a08f0e4c9f118b8b99a7cdf1bc904353ba7cf49
SHA512 263aeaccae8409d8036843ed075639fdba5f91bb0349eecfab65f48fa5b88a855676737885e1cd0db6723abdb664ca7453b2ed5eec179c4bc693516eb165e7f7
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5c9:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5c9
TLSH
T123F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 764KB
SHA256 59879d22e0ca93809f4e912d08a05be48e1d701a375a85ce56129684a0f18e36
MD5 8d4d5372d7fa9d92fa177cc1a54e661c
SHA1 8962dc9bda4ea2cae1f264b940f8f031896f0a5b
SHA512 c4d6cb472e163c7ebae065d328c48b2597a5efcc5183d5afcfd149938c69fc0df8479d0a2cf38ee2b6b83f0862c26fd95ac58dff5328de9f9147bef8d62caba9
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5Ec:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5Ec
TLSH
T10FF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 764KB
SHA256 fbc71e4d282f07342774df0966c77b7a4200f8fa2506ca13fc0328493237ae6a
MD5 1b02407fefe12f56620bbda0dd4f97a6
SHA1 cb64c23a8e9af0b414ebb2ad00ce1ceeaa6482c3
SHA512 893eaa98b9e3b22ba245dd0be07e8b283e38eb32bec74f271054a30ed35007a9ff0e1fdaee9190966915889b6932f33e6abbbc859136e5d8668f6f276ecb5e66
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5dp:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5dp
TLSH
T156F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 764KB
SHA256 c4bcd4e8e012782942d6174c973f1331b6f56fb78a111654d22d6d16eab15e29
MD5 a3af67c392aaf6bc2fac77ca81d61c52
SHA1 436f956ee9a730266aedc0c69aa7daafbad625fa
SHA512 a22a0c7ae8ae9ef1047e3b827859f4ca34d0df715c26433cb1c4c81dae88304b36fa8e11156ca07e4eb7133c7977a1079cc8f698116dcce26ee5348449256377
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5i0a:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5iN
TLSH
T1A4F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 764KB
SHA256 1dc940e68b4552e8b3f1418ef12067d96e49c654ba66dd86f1513e6ce82c107d
MD5 39ca303be10ddc7ddb4613e215880107
SHA1 3b150554123b1c50426daf3870d02bb438b575f4
SHA512 3a65f844b39c916951cbd4d3e9245af2ec85592747b01511dd16e8f07a9bcb1d38a750efbb2b441a27b2fc99b683896304406a4db7756f3ae8ab0a05e0beff71
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5GF:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5GF
TLSH
T13CF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 764KB
SHA256 5edfe2a855e22df16a158f20c1d43b684eb83436ec5eafc27b8f2a0a670338b0
MD5 d3c41254039ee1b49ded15713a356c10
SHA1 756a525c78dcc494d846a4bb0cca993f82ed8249
SHA512 784478b37e075a82ce1fac6844bff43bc6377b88084355e4de49dc9138b7a4f803992e2d88d7d48fa4d3663b31e78c4685d809b3a8fffb409aa7932aeeb21206
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5TC:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5TC
TLSH
T15AF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 764KB
SHA256 0814c9fa753eea1bd7a0ad3e4b9f1b320e870f2a0b1a37643178b07deb4da267
MD5 ed3916bf6b3d66b92c5f330eb0250a8e
SHA1 7da5c4eab700cbbe844299ffeb8e73317a14f5b0
SHA512 cf18fb5af39724d0d45b97a434dd4ef80f4473cb5408f144bb1f691de0a559c0fd06a121b0b6d99fc9875dfb41b3290ea4c1b714ec330b170960089f97760930
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5cw:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5cw
TLSH
T1CBF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 764KB
SHA256 7ebec1a755ae9e4905e8eb72859389c6f9fc184551b1157a91fe8c5a1e61cc45
MD5 c919d09517c17acd2e043745fdccf98b
SHA1 6a31b43386d7d4341fa152b084a01f0e92141d85
SHA512 75d83250301166b3abca5e20000f3116f7c4733f23b7635ebaa11ed1f17d2594a0c93ecb8aaa98610d41cce1b737499a7102f806ab5752af24b22c041c4cb095
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5TT:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5TT
TLSH
T1A3F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 764KB
SHA256 9fde9e1ed13e1c40726745039165f747d86906ffaf0e0317d84a63adffa354cf
MD5 4e016a6e76edbf8aaa4f3ef73b43259c
SHA1 b8c69fb52cdc78ada630946bf9b87461132e9ffb
SHA512 00f527c9259bff58a143bac20e23ad821710d7d53194db19cedadac6e943ad3ced0bf00ab4656b5835241360bc732163c981c541e1d4c6e9dff80cfe60bbc714
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5lu:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5lu
TLSH
T115F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 764KB
SHA256 586422f3a73f434cf51400f8cc08b9498530a48fd4915d0791fed7617f29b00a
MD5 e83789e6b737b2ca0374e4fd4ee8d1bb
SHA1 1af5ef26c455651da299c3251254a2a791b1577c
SHA512 4f0299fe0acacc61ac2c8c70cd0054651d0d1a7a0a5c14b22cf78394e2acd50f60ea627bcf68f1d57a37c33ef4bd974ce79cd2c92c4bf9c3cfbca5bc731c5da8
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5tb:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5tb
TLSH
T1DDF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 764KB
SHA256 1d417ab7f51bab13e61c5402ba35e801b1d68e6bd13df38b0754f2a19ebc109e
MD5 01627ddb3aef1a4d72bb5cd86bab2d1b
SHA1 87bf6147238ae25638e65f457251595273b286e3
SHA512 d2632f948d675b17c94f9b1fbddc17e11399f2fe31a8e994da28d5cf66ee5dbfd8a1c97d9faa7d07729b382e7c90de8ec06f3aec6d03ad3681c8eaa86a475812
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5df:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5df
TLSH
T133F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 764KB
SHA256 1c2ea90635b27caf1eeb0bed16508f297cd4e09e893fd137b740041021f2b47c
MD5 93573008ae86dfd3ea2bd3dfd8e5c65f
SHA1 8b1530a4f609bfed023f221e1ec0cf6708f1397d
SHA512 6a64bb3fb85b2e7c0a87306e77ea330c7ea47a05257f315d75484a84320374a5886c8406ef9334a20ff4a4a15f4e3e20c1a0d58cc2ef6f58b33eb873078fc57e
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5GK:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5GK
TLSH
T12EF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 764KB
SHA256 a3732afb7cea1658dd8e3892bbd28365aa22da4221a11e0c30eda579eecf7621
MD5 792e088c00619023f8fc341ff96ac2b6
SHA1 42d6b89fd92ea1bde9c05080cbb005ac4d3c121b
SHA512 014c85f7026673a38579769bc17381bf653cb2076af87d17df4ed7f840ec25aebd1e11bf5da17982960ab62c10f265f1010e1c704bad5e64281d92a1b7e256d1
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5zk:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5zk
TLSH
T1BDF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 764KB
SHA256 6e7bf96b6dfa8d42b5898cf5f0305b206fe598d486aa2756774c32761c524fd0
MD5 ab2a41de027cc540756514a8ba722f81
SHA1 3abbcd301110ad8efb0853189c139bcfe5d4208a
SHA512 4b2a039ed323fc4ff0a294a3df3784334f17bf31beecf741ee361ffe54b5e17e5d70cd008dcfd5bb0c0e8f5f97e2f31d5cae1e2f8b09ad1f2befb83f3e4f595c
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5E0:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5E0
TLSH
T1A2F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 764KB
SHA256 b96f6962de5b916d49e9a11d82638558e95ce55be4a146ba9a5a89880cbdd0f2
MD5 de7b9b3ad6111753f88fd949bd76e12f
SHA1 49142114125938c9a1e9637adb0f47ef6c64f9ea
SHA512 7d9a8ccb1481c3600569b78f3b291f647a87c8c3ce8a477c72e22cc781de540e2790e7cdd935b7e9cf60154365d47af0efa605faf2496089aac274bed306ef72
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5/70:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5/g
TLSH
T189F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 764KB
SHA256 92cd3cd2eca34e9394a115576660f9de1a5c4390351527217de33055ef6638b8
MD5 9d37f59459239f6853dc0483c946e9b0
SHA1 6d62c6cc0f3d6e62eec1dd403fbfe6635f27a679
SHA512 d8a81b48970c75d998d47483cedcb11f01efdf4d364bc769017856e7d6ba537b5b42732c4a84e62de792bf5f45e0a056a342c035fec51eda9a725d2ef1f9208a
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5Sr:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5Sr
TLSH
T1CAF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 764KB
SHA256 4f0e328c69b19a1d103899122afb30c3f952d12a9a4ad4a3d83ceb3a9dfdfba7
MD5 ea3611d5f6d0f3bf51b851e721b35b23
SHA1 11dee237b3cd1e45307c8510b2cdd15fd72333e1
SHA512 aab902bd8ab24de7d57334f8513a1028a059a62de6c9e5618e870b156a851ae54d89c97dcc348e28fe92399bc19be7e4f4bfc960d87e74d9903afce522aa9ee9
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5wn:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5wn
TLSH
T1B0F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 764KB
SHA256 f4df6952965991d88fd0fcd2622dc68a22f5d488cbb7d0d00c6c5ae124a83385
MD5 00c70e9b7735dc3ae5c957b7fd002ebc
SHA1 f0f071dcc052158700d3cbb5ebfdb21149f5b593
SHA512 a1125da8fa8c41cef477543e280d89d137ea11c68375193608824fc9b664cf2086d5f6d37c637cd7bbeeeb87bdd0ff4a95186c36a80afe37557cacf29778c4c3
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5Ox:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5Ox
TLSH
T100F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 764KB
SHA256 24b167f9544e7708db3ebb8688a57e095a8159844e04e96b68cf60c3bf1053e3
MD5 3f82fc9bdf10cc091f8f00d03bd6cb49
SHA1 d7db960b5323bda8d78e356344a896212d68a661
SHA512 fe6ebf48e0594b8ca2bb58dcb2d429c3b25ba8ba6b2012faa682c0337379778b6ef721c64c61e46448bbd96df381ef1829c9c7c94b3b23ec1aaafffc9ab865c5
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5oA:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5oA
TLSH
T1B7F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 764KB
SHA256 536359a5c67d550b2287cca697ef8e80c5355b2c6553f15eaa68b325c11fd5fa
MD5 a15533b9e9fe78c7d256bf1d415c56c5
SHA1 32d80ab4671bbfd10b35e1bc5a6bd71b079d2f4f
SHA512 17295b26af963d700ce46a9d215e8ce3b10182ec477f5a442aeb5c6beca0c13f9e251ef018f49ba2f4ed12c985d2dfe7ed3d6a4e3d6b37b4ba9177a6834b8acb
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5B9Q:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5B9Q
TLSH
T1D8F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 764KB
SHA256 36d6ba2500da583754c4c0a2f1a0294c99edff9b8a86d5fd89e9a1aa15754bf9
MD5 00c0dd51d9d3e66be1c6d98ec07d7959
SHA1 21775d6405b3619664cff6c8667ed3c208109b45
SHA512 cf1b283760fd6278fad6fdc113511c906bc4560e8391621a136c5448b24aa6b5f48bb353771f4125bd74abc37b1e2a78e795b88d3ef9ea58ff5d5d698ab16a34
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz504:A3mMYTqMi8CtBd2QHCHmTBW5ETCz504
TLSH
T15AF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 764KB
SHA256 668e9e0f289cf5536d9078ecf7454ae6378a52aab6f6c49aea40d407b55b5fdd
MD5 cca83f14cf840250565589043b28b829
SHA1 affe718468f21abceb9b35b6a1d82ca13ec164e2
SHA512 207d1f8ff0222bb90b7a8db2e47879f1cb5c0d3bd22d1393b636dea3fa4db1dbe62ee1f0f9f01da625030739e86476dc6970853cbcf43c4394147c8a89011403
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5fu:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5fu
TLSH
T131F41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 764KB
SHA256 05dda66d52c0da867ef3e5a465a4cdefae023e6db2d00a991bdf106cc2f8babe
MD5 f38e08d57c0101108ed3f73670ff6abc
SHA1 8435fc69a6d2ab1d868fcacf8ed6abf3778f3a8d
SHA512 1235b376f0eae978c3268b1a734b0fa8835539412814228fc6252eb9639ba5f87ee5a8b326c9b2f7824458196c469edba5c178198695027c8d7c9747d45460c1
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz56j:A3mMYTqMi8CtBd2QHCHmTBW5ETCz56j
TLSH
T10DF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 764KB
SHA256 bc6ceb64563b06c93afd5133bff8bd741c7e3bf24ca8db753744300e8f023d79
MD5 1b3d3cdf977d5af761f2cc6061cdc2d9
SHA1 b5522591a29b24207d1f090ff02ce36c698faf12
SHA512 b60727c7271ce2761fc8d53984a39bfe87d2ea39b635590a5c173d4b8044382079d8c9abd4afdc54c723e98d8fec79ea9c9a6b2c20c7cf6a77691f19e190b5c5
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5ng:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5ng
TLSH
T117F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 764KB
SHA256 d44489b2c7602f2e77b4277317b8186eac23a982c946f97f2e86a5ed7b6fe61d
MD5 d10e2e6e5aa2de3977fc55b4d926aa56
SHA1 d8e65b23bab6678c0d7bce7d02e8c247e8863019
SHA512 700c0ae808b9b1d0e7de92ab07f1f7b1e40c8153a0b1d26cca3d2695ded648862962d9a5db95057dec447d3fc16aa0b76ef1d39dfc8a23f194bd37ec8e7e5bb7
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz56I:A3mMYTqMi8CtBd2QHCHmTBW5ETCz56I
TLSH
T127F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 764KB
SHA256 4b6603ef94befaf2edcfcfcaa87a5ef4e18a3924b2c18fe5b013c61f14426210
MD5 e0d0f83f1ecb289ccdfd5e38574ba523
SHA1 b8b8b4ee75513508b741c8312d3f722b986e39d7
SHA512 773524a6e6542af9c4df0da5bfedae46e63b815128ec81af0ffafe8045917d822a401129765bb35d95b2adf9ebaf224c98bcebfb556e6cb52167dd8a4b7df02f
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz54o:A3mMYTqMi8CtBd2QHCHmTBW5ETCz54o
TLSH
T16BF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 764KB
SHA256 ce42e1728a2bda61a6a354b132963c58f7c822aa7f852ed4203a6cce7bbab94f
MD5 158e6ce4ea70fbe4dc158082a58849d2
SHA1 86efb11a323848496205d38a6fe5e53672c2f665
SHA512 ca817878a86cb3b5e2c1faa69c5a259f1bf2b66dd6da90b289ef1b8a1fd1439fa8cf1574d289f5f88c8eb18494470473db78c1d9dee66f6a97357f802e787579
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5L+:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5L+
TLSH
T1A9F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 764KB
SHA256 177a35888007687171810bccf3c3e5271685541878fe07c36e7272feeb5029c0
MD5 56dfa3ffe6ab5b9967d2ba7a4666ae19
SHA1 406887eef039d94ba4da7fedd356882692fe9f27
SHA512 d42fdd04a3e4d8aeff02265a23d1be262bc8aa132faffce33dc900e03f6a7c0e2fb4c2ff20c7d586691cd9dbffd2869ade1ec01ed4238d7fbf9bbbae8ed6eaa8
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5BQ:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5BQ
TLSH
T1F4F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 764KB
SHA256 f98c26b72922d6c08887834d414eb25479da08af8318bd26364ace4b1057f07a
MD5 651c33b964b036f04c63dbebae2d1cf4
SHA1 78f4cd61901efd689893251b2d032308a4f29085
SHA512 79670126f212afc9527b423619276377aeaad0dc7043896a7d78b109d4931b81c8548aed2b4036b86c77c74b87665321424ac1e2eba3988cca89dd7f321c843d
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5GX:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5GX
TLSH
T1C3F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unpack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
Size 961KB
SHA256 74cb8586a4284c853108c0f9ec52a6ba04932c280dbd89b33d6311d14a9bc12e
MD5 61286e2d685a2427e9bb99f56289854f
SHA1 165a4fa64c090cb81bc8b8671a4a6b062b3f837e
SHA512 21eff852a58ee901c6df2e6229a1026c7d4ab79891458cfaf50be5fbde12d2c6c2bd63a1a95397b9f64a40906c0a83a4d372c09993747b0ad7a5cd0c14b21fb8
SSDEEP 24576:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5djCXF7IwZ:A3IqJtb2ISC17IwZ
TLSH
T1A7254A25F6748771D073C0B9C5D2AA9AEE32384257308ACB128AD36C2F277D6D53A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 764KB
SHA256 edc1810053956beb4067661202bccb2d48972680e5fef7452989163425ca6477
MD5 d98a37d3589727adcacbc408dab02f8c
SHA1 0505edc9b36fa1e982b7c470a9c12a26ca875dd7
SHA512 49a24d194bdf0fa1bdf697667f943567e83c4f211da17db5764ee462e67f904b31fec9df26a7d09dbae9eea7823af33b41108f26c46f2727ce2c6daceccf5966
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5AL:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5AL
TLSH
T1B0F42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 764KB
SHA256 6ceecdecfa4c4998e612a9b90cc38d48fd8c1d63091483974db9b0d7daa85a6b
MD5 d692571833c6bb3d36269d45c38d2765
SHA1 91b764d7a4c4739f729432902f849a8988f1b819
SHA512 b4896e06c2edf497faa9f5425855895be2c31c95460c286a8306b8bc66a64e4b85f0959d5cc775d2709e28a54741ba1500cce4938b3db1efb7f3691d52fc8b2c
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz5sFC:A3mMYTqMi8CtBd2QHCHmTBW5ETCz5sM
TLSH
T1FEF41925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 764KB
SHA256 624f26eea6ad2a80112b457f9742e6b33cc2eb800cb8b019dbfebbf3352099c1
MD5 01b38eb285e30f9565f909a4e98b6885
SHA1 1505e53b908dbc3f2a738a6e5df26e20902cf23c
SHA512 825db296b646eceb36cf9df75925427a4771c8f18b7068dafdaaf6e68bb589dca6b9363ed99c4323c1156b07e44274c570ed4cc72ce7fea082556be25a93503f
SSDEEP 12288:A3ZU1aplw9U+qMi8CtdVldusIh6BBHCHrKZXCktSzIzWpX5ETCz51h:A3mMYTqMi8CtBd2QHCHmTBW5ETCz51h
TLSH
T18EF42925F6748761D073C0B9C5D2AA9AFE3234425B308ACB128AD76C2F277D6D53A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2564-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4632-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4632-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads