20f77befdf46c2512f0dab7025c9f7e0848ab97e1e6d5a841eab5e93535efe90

Analysis

max time kernel
110s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 07:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 893KB
Sample260824-jrh37avanf
SHA256 20f77befdf46c2512f0dab7025c9f7e0848ab97e1e6d5a841eab5e93535efe90
MD5 7d908659f1740535fd1bf5098a21f52b
SHA1 f426de0dba72c4c6f713d9f7c7095bc3bb4495b7
SHA512 2b57809a9d4bb624072f34c488328fd39b12e1e322225195d5040da6370965e14e35a2e687e7f9242270745cf85650ddaa2c4886fd26440de9a1de6fcbf2800b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HN:A3k03kHRJARJY
TLSH
T159159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 49 IoCs

resource	yara_rule
behavioral2/memory/1300-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4fe-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000000431-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1300-40-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4624-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c86-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018979-203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a53-246.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-265.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-410.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-502.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-581.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-606.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-631.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-711.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-768.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-793.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-806.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-849.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-874.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-900.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-939.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-958.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-996.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1059.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1090.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1103.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1159.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1191.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1301.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000800000001890e-1492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018914-1535.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018923-1573.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 46 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4fe-5.dat	aspack_v212_v242
behavioral2/files/0x0004000000000431-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-39.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c86-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000018979-203.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a53-246.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-265.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-410.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-477.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-502.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-581.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-606.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-631.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-711.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-768.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-793.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-806.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-849.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-874.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-900.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-913.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-926.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-939.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-958.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-996.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1045.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1059.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1090.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1103.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1140.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1159.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1191.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1301.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1351.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1386.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1393.dat	aspack_v212_v242
behavioral2/files/0x000800000001890e-1492.dat	aspack_v212_v242
behavioral2/files/0x0008000000018914-1535.dat	aspack_v212_v242
behavioral2/files/0x0008000000018923-1573.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4624	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1300	2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4624	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_7d908659f1740535fd1bf5098a21f52b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1300

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 893KB
SHA256 20f77befdf46c2512f0dab7025c9f7e0848ab97e1e6d5a841eab5e93535efe90
MD5 7d908659f1740535fd1bf5098a21f52b
SHA1 f426de0dba72c4c6f713d9f7c7095bc3bb4495b7
SHA512 2b57809a9d4bb624072f34c488328fd39b12e1e322225195d5040da6370965e14e35a2e687e7f9242270745cf85650ddaa2c4886fd26440de9a1de6fcbf2800b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HN:A3k03kHRJARJY
TLSH
T159159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 922KB
SHA256 fdd306822222c7c2092c15b55d8459dc21eab7c13ed1759675fad131d74bfa56
MD5 16e58009e1f44827c410168837078a01
SHA1 952ca53da0f8b4960a63245d8b13002e0706a94d
SHA512 6c5c9663bfcbfbe9f6cc03dde3671eaf12f3990bfdbc7610e1dbccc735099f0526e934771e171bb6d2c7253bdc6670186d42198dbb040d9c8e297f1a4cf6f88e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HbP:A3k03kHRJARJc
TLSH
T14B159C03F79900E8D14AC1789AA69A22FB767C561730A7DF1354C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroTextExtractor.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
Size 939KB
SHA256 8d8e558d0349392cf838310a8c564dd6b5ccfdf8720edbea9b8fc1fc5a2e65cd
MD5 de00fc62a16261c7c2274a3baef0a29c
SHA1 72c827f4c5f694af855b35c8e73d5ec8c9cae394
SHA512 399177bda8c00b20e3feebec7cdd750c3e88e1aac65544cc67327d320ada0b73d9daea13f0efacb0f631527da93828cf39b5e602ee27f7a6bb4996cb60fb8041
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HA0:A3k03kHRJARJl0
TLSH
T15B259D13F79900E8D15AC2789AA69A22EB767C520730A7DF1354C6162F73BD0AF3E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

reader_sl.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
Size 945KB
SHA256 c20a5126dbf4d4b3448cd3132e09dfb4a268343b5312a43250cc69e6c4689f0f
MD5 cbf00f18cd44abbf8634aea217dda96b
SHA1 d1f4ff836a6db81abed75633273df39e375b86c3
SHA512 957e2a66bdf8a88d6965f0b3ef94d7de4986316ad3b60ed8d8ac64a808c263535186af5d2f84f437d95f7997718d75c070ce255f7568cb2f3923abb70009bf93
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Hsfj:A3k03kHRJARJbj
TLSH
T14C259C03F79900E8D15AC1789AA69A22FB75BC521730A7DF135486162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 686949b0cad361e7634b647579a22aff49b0bf1a64a16adefb61ec27b4e0a3cc
MD5 c897a4b30b9860459c3085e14c6a1374
SHA1 bf89d51858536522c25392f3adb8daf2850a9260
SHA512 baf65d631c052576e1974857de5ad53587e14d6bcac3fe9715ef68423040b0c5b2a579cde420b6ebd1938a3fdc60c84b500b6516fbca172e827956dea793b316
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HZ0Le5ji0hmxNrM:A3k03kHRJARJgPji0Aj
TLSH
T15D657C17F6A802B5D067C1B9C5D29A5AFA723842073097CF1394C7292F67BE19F3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 907KB
SHA256 c38d5f49aa79473d175c59085a776159bf6adbd0673faac466928daa843862d2
MD5 dafbf3dab6a30d80ba8c71f2fde9cc40
SHA1 907ee64bc2145ac91fb968621d0fa8a30a0153e7
SHA512 bdd2daee209e700f7883cc4284eddd61bfcdf846b5b050972261f9a4d5ece2eea821f7415a561bdecdbfc6428759ecd50e8bccf45a87e54765d183c7e31b7171
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HLa:A3k03kHRJARJ
TLSH
T176158C03F79900E8D15AC1789AA69A22FB767C560730A7DF135486162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 940KB
SHA256 61c748caaf163213e710538691e0eaa92b544f7916dd0c19aaaa3fdf741b26a6
MD5 6ec67ce84a22bcc1b82776329b260d40
SHA1 275f750fef3d80bdcdb664f342cf80a79a31fde5
SHA512 fefcc244e710bf7671bd20505e2ab37c859d30db97fc693d73e1ebf337d2d858ffdf80a5f0259f8bd709ab5da80096e3561bd4fcea465e22b2877480112db15b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HIb:A3k03kHRJARJJb
TLSH
T10C259D03F79800E8D15AC2789AA68A22FB757C561730A7DF1358D6162F63BD0AF3E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 916KB
SHA256 41bb8f4c351b335ffcb3d5f0959b9c7d36cd9c424d6614b063f3bbd58ca93ee2
MD5 78ee733b56f1f959fdedb61996176ca0
SHA1 f10c3f15d7d8e62926f4b15a4ad8e42e786756fe
SHA512 0e78d88b0efb3c72688b9237c9bbf9dd06ae66cdf9335a0e95efa9ae2744bf843ac857bf3e23b1fbeb3831920db136443cdb3cc76bedde1a765fe19eca8a0f94
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HzZ:A3k03kHRJARJ2
TLSH
T13F159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 916KB
SHA256 68c9d72e0597f1b7915508e18a5d2ff7159eb250f50147400e82ffb26bb1eb47
MD5 bd7d2cd5b0a3a7b4c461a1bd55ff4d02
SHA1 487072be5a4fec8d9dd7f113de0bf8665aeb530a
SHA512 ec91f0725b70215bf4d517446b2a6e58c39e2523bab50fef30dec04b633832bcb87bf167a4ff8697b46be2d3eeb0312b35153c33ff6c943ec3d0cddee7bd629e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Ho1:A3k03kHRJARJR
TLSH
T137159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 916KB
SHA256 e2640c45e1fbb05e6e07fb77a6de48eaaa38fb0160446eac6f1ae110e0829526
MD5 9bba2025e79aab2213f66d123cbed2f8
SHA1 bca8eb1dc34245e44861f81d9f05fabe54f313a1
SHA512 76fa216a7761c7535801db6f503884afd83446bd3db9883487f4d410c7290e2f3b17e2cb98ae5be1110e59ddc863849780d211c2c2448bfffb06dc0a9a621fbf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HK6:A3k03kHRJARJu
TLSH
T1B7159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 916KB
SHA256 4bdbb24bd88a1d005ced67428c0c380b718c13549af692e9dc74b42f2f41edbb
MD5 1c6a8d45ddd3890649fc733ce9bdc758
SHA1 e34e9f2fea1d9f795b6494d3781f34b8856161b7
SHA512 f732f738f4f81732d9265e125fcfba04177c708d8db8c712fe45dc052b3988489003d1077d4ebb6273eb054a3fdc9d10eb83f74ab5448f561a510e81680388e5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HiN:A3k03kHRJARJv
TLSH
T1A3159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 916KB
SHA256 d9bf104b6708f03b3c67961cba4625c5992b170f8eec882573d4a380baf117f4
MD5 fff8b6a60aac903f46ceaf1fee9aaa60
SHA1 4c458807c9f65ca679b08c09d4d773ac8b1ae155
SHA512 b35b32d05c3aa5a95ddeda8e3301c2964d671df01ba4b5106ec7f0f8e4ef4e12ab018808308e07db801b2bd644c613c53b74d4f3f46a999ad79ba98030b885f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HYf:A3k03kHRJARJr
TLSH
T1B3159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 916KB
SHA256 8afd5682572556db39a0eb1f9e2c3f30d59346e1185eacc76440182b621dbc31
MD5 695f65945e666a5bf95aaf6eb2125ec9
SHA1 ad05490287dc094b64793a8189a8b61356cbbede
SHA512 77865af1f653f7f157b551cbf5b61aa2a7fcdd6e745cabb992b4170c6ccada07f7abcc5a1902ee0a604928814f9a26aa1cd69d1ca7ffd35d05025c86af584385
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Hyo:A3k03kHRJARJ6
TLSH
T170159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 916KB
SHA256 03368da7a6f651db8badfdf4f4c03088c319fe4979fab484fb977d6bd8e79d2f
MD5 0c7c0cc737c859ea1387a29ac8f06951
SHA1 faa927b7b8980d1e1d7ab02439f5a12c136adcf0
SHA512 7c8439160b88d004e7c62d7ff93a941a7268c8a2db093566eb15203476dc0427faf086e0cf70ad7e6757df8b952e61f898d8130269c18c75713e2866596c3b2f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Hmu:A3k03kHRJARJU
TLSH
T15F159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 916KB
SHA256 12333534cb8a3cb74ea274628dbea4282fd6af70ea52c93c99117debe684ba5d
MD5 7f99ec3c14c0f31068110f1622708b04
SHA1 04f94736500949747a7f0d9db9bbbff71edd16d6
SHA512 3568f8a140bfd8c620053d41a0e1b07fd75375d5bead4e06345ba6b43a26007c69a8f5f887ed8ce31c876b39b711ceda36ac57a6abc19c228bad177441b3f762
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Ha9:A3k03kHRJARJ5
TLSH
T124159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 916KB
SHA256 03592b28e37c4702fcefa87a643d799ac8bfb2a183fdf9f4df9e06b539b1e925
MD5 3ecac6b66ab850c98d61db891b06e6a9
SHA1 9170a8d4527a5c9ba8d1e303092986084716ce17
SHA512 0c5e98826591562596fc264a06dbedef2dd3ec33d5477b3a3e6d96244b572365447125ab3065cf8825ec2e64d56a6f33be26dd16594b1e4fe78ba68a911d1fb6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Hac:A3k03kHRJARJ8
TLSH
T1DD159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 916KB
SHA256 f11699d795c86504ce5ef61dcbc70e839b13301a9f35ec143caa954f909c4fc6
MD5 ba442c9ceef9f2d53da70fd2dc7eb818
SHA1 50a420d16af30b34faf54ad95d97953ae9af22eb
SHA512 6c2d2c58147373b2d75ea44f78dfcfc4a52ecb342b01cf33a1b24a66aa71f43360560d430b6f81e6066ab614cb157f13c050a73d97b61e9f895c94af52906306
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HTp:A3k03kHRJARJK
TLSH
T1AD159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 916KB
SHA256 0d5f725d9266801b64d781ec0e489c38531833d91e086baca521e10c276fa76d
MD5 1f58a4d09ae7ab16ef53d40cca7be1c0
SHA1 28fe2529c14228217889b6924c4666ace566270f
SHA512 792f8da03673588478c9bf3b2497330e7696cecd30bc52c1d93b21a53d1152fd27d20f2fadcb294727fb511658760a355d7db30c6b7e1997eed7513df957b0ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6H0N:A3k03kHRJARJ9
TLSH
T1C7159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 916KB
SHA256 2b5c728151da450260afe6ffe3ca7dee633f8311391c183bb8e8b555a1d6ebc2
MD5 d6016b861a927e2af6a4c56d67534604
SHA1 a1ca2b4de1daafb5dcc0b2ebb24e4730afb1f510
SHA512 3eeeef5e15bceca970db7eaef18df1615181d8d19c0d14b173c8523dca557f2d2edd793b295414dcf9dbf78bda76000872d9552a88696115ac85429d082800f2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HcF:A3k03kHRJARJn
TLSH
T162159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 916KB
SHA256 8014c8e9a6ce0e3751ef5375afe9a0c77189d94b7ce1dceeb539d60f8e0f3067
MD5 bbff517f5ef68db01c9d89ec8bae836d
SHA1 01a406e7bdec31eb8ffa6d50b24c7c418c97db14
SHA512 54311f36c5519adc58120c6dfa57249e981af15e4cae594bee620273aec8754ae7734edd809a121b0e12ca78715ede9dbec0186b929656e4ca21fed645b87944
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HJC:A3k03kHRJARJb
TLSH
T16F159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 916KB
SHA256 3df07ca4949ee232d75c548b69369362b337c6c4a4c78e3da5cf96bdd7eb92db
MD5 b26f86f380e37870fb221443bfdc8416
SHA1 23e609fb801ed0268c6ab4bc409ccf3653b81cac
SHA512 3d421d325d966832d963a08f8a13eb3561837a43eb8e8411798de68b5309993a1cf809c063c90984c4892d08b447d29c67ca84aeac9eea0ccc7f5cef3c63f002
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Hqw:A3k03kHRJARJe
TLSH
T142159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 916KB
SHA256 81480b19b51a332b40e6134e2aebfb9274e72f882a087f254258f04adf055d37
MD5 dfc816a56618a62ada7b8d1b3868a367
SHA1 3924eebe741914152e4818511d6867d55bb68604
SHA512 d2daddda6db72ba3aca73bc266ae7454a70b7cf1e8a202d79e30fa385de7d405b68e14c746ff7cd1e8efc533b8876e8f38030ee5e239a970dea175de9f9d7938
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HxT:A3k03kHRJARJ+
TLSH
T1A7159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 916KB
SHA256 1fe4731ad57d823023335a4ad38c2c2a88e2c4876b52e6489e3ae8043c8c56ea
MD5 24514af9590afc0e0672a541ae2b7dd4
SHA1 a560313bb2679e7258a149bf164a16dbdea27f03
SHA512 8159f524e934d3b9ec49913a57ecd6781fd81e260e1564305f4a0e0665c9ab8d66dfe7780f840a55ed6109cdf6fca1d7a5731d285f44f43bb270683cce80f8f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Hfu:A3k03kHRJARJp
TLSH
T15C159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 916KB
SHA256 87e7ac4ed1b6b3b7b79b8c0dfef9720d8af62cafc84fe55d0a25bff516ad82a3
MD5 8f3439696b94c8e65304156b441b69f2
SHA1 dc48ac57231cbac8f69c1c8968ec1ad27b9ffada
SHA512 1f643a914ada17dc89e0b36e86bbc9feb270a884f1b63eac058142eea6cd4242e5de7c5c0490953547ef62b5283626c367bf0da89e276a58c78ac6a263c1230f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HDb:A3k03kHRJARJY
TLSH
T15F159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 916KB
SHA256 ef78bb3dd4328d70d55514bd32a3994a797989d511592a52ad6d8cf6c677d822
MD5 848527ccc5e4481f757404df969ad882
SHA1 1c5879b4d7cf87cadafc8244b2a39c7ee7c93b4b
SHA512 2d27b89517944de7960962558c58a5958586c37a4bf1207769e17c732a5495850695fe5e36dca8c0468639d84b4df494dc95d170bae1c0bf6eaa1b4b4ebce7cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HXf:A3k03kHRJARJY
TLSH
T169159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 916KB
SHA256 959e9a7ad26dd5591120cd07fe57c11f3e3b6337bfa1bfb1bb97b6252d5b896a
MD5 98a9e17ccfecb80fab74b48e490b232b
SHA1 ba58498159797204b2782a2e453121a289673f5a
SHA512 bfd8e5388fa6504d16797488e983eb68066b6f22d76eabb9d20a02740c0fa183fc47f12682f574b6653c5ac25a9deef2cb3e851ec3a344abbfa6274b7fa17d6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HgK:A3k03kHRJARJY
TLSH
T111159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 916KB
SHA256 fe090f326cb0cc840ae3f171e6aa5bb8a1ef4d0ae1f6d62151ae7958a44cfea1
MD5 84b190592cbb54298e037a22c56e4f9c
SHA1 c3d9cb11227bd96836b1d17f9b478d7c1ae4cdcf
SHA512 d4f6fa58ed9bfd9e3aa9b190fec0b264f1df072496e391cc8867a2df1c596ef0fe66dd0883bcf99e80df5e5e07f8162137eafc92b9cf488534eb8947ba4a7bca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Hdk:A3k03kHRJARJx
TLSH
T1A8159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 916KB
SHA256 6a32c1b38de9f002ffe477a1b6a63ed8dae965424918649fe7fec5c50142f327
MD5 ec0e0e7a427eab5c514f089586c10acb
SHA1 7bc716b4c44c9180af00db5f758cff6fccc08405
SHA512 7cc57be1a6451a4efb52042cd63f28426083fdff48f3d8067a93f54f3420ce96aff99ba409d9600d954902bb84d0a8e13c418bb2564d753b8cfad5f84cafb260
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HC0:A3k03kHRJARJ0
TLSH
T1E7159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 916KB
SHA256 23962f6975271fbc03d9ca417c590233891a35d068450c1e3d31f4a139cf0689
MD5 ace843ef3f983b45f82554f6a1ceec2c
SHA1 92b0be6dbe9a843cfe6c57722331158a5d598c48
SHA512 9d984c770da766ea96527c66fd6cb4f5fbd36f28867531849565a1a39163e12e85f8c0a4ff103341b6f60f0d63404c91d27ab2640e0b672d37408c47cf588dcd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HRg:A3k03kHRJARJJ
TLSH
T1F1159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 916KB
SHA256 8775c3ad65d49524718715014730d7113ec4bebc4f85120a15dd804af16e0bc8
MD5 22ce4d0883282321c586726d5ff95695
SHA1 6b44a8ef20f9502e60c73764099b06b2fec08b58
SHA512 57a26e9d085dc51bf08916a131054ff59bc1adef0d2b721ead88b743d8002d44e5545cdc34d7500936bd37bccd1809fcd27c2479cf07ab71c487eaeb664e3de6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6H4r:A3k03kHRJARJz
TLSH
T133159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 916KB
SHA256 cf53837857a13cc10466c05754cd2ad6c5cbfc727b6bd0f8f3b8968446683e78
MD5 94add0145f07d5cffce9782058ef537f
SHA1 14f97955d4b00f7c292753755cd3aad384008d94
SHA512 96b8f3e780ef4f82deae5d0658d2d065b2761aa392b145ffa87324c138015ba8da40726122693603473a66fec2f48e8c3149d64c40196d7dde09547299c7712a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HWn:A3k03kHRJARJ1
TLSH
T1AD159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 916KB
SHA256 f4fecfa0d38f221572ede574918119771a317c0583a29c05c61b15c43aec9cdf
MD5 46d3cd8b18fb51ac96f9aea95df373f6
SHA1 829cb58e543d5265fe975f00a1498b437cb2b22e
SHA512 805f929723010f26e0d1e05ef68710a81190c8a31ade04be3cd8ee19581463f8ca51bc96e0b16c0fcd9989b5f893dc20d15e6e2ba1749ee3448ff05578b73a63
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6H8x:A3k03kHRJARJL
TLSH
T1A9159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 916KB
SHA256 943c4c51d0419925ae162fefc5217e834aa0257f0e428b093f25469432fe04d2
MD5 6fc117ef4f8d9dc4ef0ac4145c2477c0
SHA1 1919a62c2e28b81ade9e004cd89894fd994223d4
SHA512 f46e1ee069dbbbddd1c0cbc84cc8409212ed31ca1af88041bcba74fc344ebb5f95b62c986fafa34241cdbd342338503cb6dbcbab2af026e49728c8fd353bd36d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6H2A:A3k03kHRJARJk
TLSH
T17C159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 916KB
SHA256 75f1d4eb9976b8104c5e6262922188584c8658d720fa7fb0c751a32b1cf2f39a
MD5 f2322c62da9eec274e970c24e3d1eedf
SHA1 ab573ec8d4b0d9a019fd671e5fe998310e3b25fc
SHA512 f068712449d3ddf3a49f0c9751456552207cdbdb9f76401924b7196ac98543f58ef9c7037d7f88f93b0697f72aa4330c09ff59d8de452e7209fd9fe4c70d2c15
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Hv9Q:A3k03kHRJARJV
TLSH
T1D5159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 916KB
SHA256 cfd955c33b6e77c1e437524c2a1b1f2296b7e4a12ad7f7527952fa3a55dc0745
MD5 51916eb6c716ba1d6bb07eace11671d5
SHA1 e087f459475647ff2bfe6662e82fcbad7c200684
SHA512 35b43863af6c87df9f279a1030e0cc0d8c44621a37b997f5351d5c6baf6a29f8024bb85265b5d9e2b0dce09bfe60a35116da5cf9ded7c1777fbcde773ee91d6b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HG4:A3k03kHRJARJq
TLSH
T1D6159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 916KB
SHA256 b7767c60bcbbe2eedf3deff70ba5e528f4a6e1b80ed753b222ee70a664b5af20
MD5 e46a78f3b35fbefb101eeed43eeed185
SHA1 7a663cd0f741fa5fcc65df4aa72a0d8f26bebcfd
SHA512 a8e38e3d3157b61e5dc907193fe864914a128ac39ebe0e4d419e1413b5c89ef5491d6d26f4e3efae5502765206079b95f4a1aeb17ff03b6eccde408b24d475d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HVu:A3k03kHRJARJr
TLSH
T11E159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 916KB
SHA256 ff4201d99362c4e22a4db17764cce9cb055a5f0935c2caf1be32c55d15900939
MD5 99442e5ec2cd0953b270703bf34c740b
SHA1 413c8b3ea1603283b37d4cc9ddba66f045e39703
SHA512 84f7b31a2c70a28f1cf91f0fcf08f3449102bab97504c70b2d9836d67bad7e1f26cba18292a2beeddcd34a87394a63bb3b02e62452802187162b45d1ef0787f0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HIj:A3k03kHRJARJ1
TLSH
T16E159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 916KB
SHA256 2c1868f413a7a71dbe60bb172874ba09ced25a1da094683b7c555947d4f0570b
MD5 68fb568a91d72ab1f5ca9e1231ab2b1f
SHA1 a29e1b3ff92beed3c560ddc90af166b421971901
SHA512 fd4b2b465bf03aeb5d99ec3adae3d5e9ddf9ef93c68f90e3f8cfbcfcd3c6a5016bbd01efcab3455bfeae8fdb6d65c3b912fe5eda303bc6ca5d5fc691bb9d448c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6H5g:A3k03kHRJARJp
TLSH
T120159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 916KB
SHA256 a56734028cb60a7f594511df18cc52fc2186aa410d7673857c9d3030ebdd74e9
MD5 81675ca5da5391dec8e389d4c05abcef
SHA1 a6f0bc2a2984935f5c3f187c391f9f5f50840e1b
SHA512 53d95b6c1bb7f50d65d4a6b0293dbd8f5eeb79d7ea5a79672f1d46fdd9bb0156890652c91978e854bf8a5c730ad38afa63c7ef57807e1a249d74302f8ee6eb30
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HgI:A3k03kHRJARJI
TLSH
T100159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 916KB
SHA256 b6c822fce3631a3bd55194730bc16e100d7ff770f42c5df655d6ee6e6859f8da
MD5 19341935ff7a93b2cd39a7b43d7cfe62
SHA1 70aa718e08d8088b590bc35e76bab13db21845e7
SHA512 9b18720c9d15c5470407a21707b9d4bafae33c6f72b86d6d4ad886aed104244c55742d917b9ab75bf5550814ad4adb47291707bfddb24c79e80b90ccdb5fa01f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Hio:A3k03kHRJARJ6
TLSH
T1FF159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 916KB
SHA256 5303d04d50c900e9b1722cc21ae970176c7222312085ec2a30da67c2ce743a0a
MD5 0528209eec1683c1f7d095c640c0fab0
SHA1 a2b8d8309812503eb45f46579147ec7479b789da
SHA512 f3906b21d62b2fb2eaddda7d9e0d3b8e9b73fc0cb29eebc36a312bfbaabe44f32abf1c7b18cd0e60f769d9a4b4613ffa0158916fa1d974cee6698e90c4d289cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HZ+:A3k03kHRJARJf
TLSH
T140159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 916KB
SHA256 6b2abbfc0fc7a7b9a257c2b726dd03e3f27555c0d1b6c5bd91cb3553ee0a5c0d
MD5 279d6d90a69f2c4a363fdf9f44203cc4
SHA1 3cc5b81a7698a6482b2bac2b66c8a408d13888de
SHA512 85ac8c929b3a1c06144d47ed38cd1dc0e84546d48d5325ff7cc14e2679c0d6e3570212d46a934464ea8f251cfa1b8edeb13123f6fa35773564e5993825b40279
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HHQ:A3k03kHRJARJ7
TLSH
T1D1159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 916KB
SHA256 586ca321a8a2f9a596530b6e4dd34881d23266fe1b8e0cf41b8d0f38f32a5a6c
MD5 1822d5ad77d337a071c13242a0e0b849
SHA1 15f579b4f2c646a1fda23e9524c6e3afdb913edb
SHA512 83fe78198fd3821235d09f30bc2505b84a78f70fe02a1f6771f4542d25e2fa65d0c3015b96e78b4587231b580ec66d1dc7467317e43b11b6214a42bb55117b17
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HcX:A3k03kHRJARJP
TLSH
T1A9159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 916KB
SHA256 5e2443c127219d570aa96e7b19a4b53a2d3cccf653f85df5591dc3faa602b311
MD5 2d47ee148f358403157405a02d63b2a5
SHA1 600b77f3bae87636f5bea4a8cec174d5a3028e13
SHA512 576d35c6ece7756ea4a48f1ff2af41f0505546a506bfe8179f36620e4b1027c8f595b674c2ffac8332c12788ef574cf8ad6d45adf866144c1d1cc5ffec1fae26
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6HaL:A3k03kHRJARJh
TLSH
T1A3159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 916KB
SHA256 2841133f911b70cf1f3fb7277bbf825b96b9d1a79c8f10604afdca55834765f9
MD5 fd4ad31a1359ac4b03971e5cbc22c7a2
SHA1 c6b169091ad6da13562d8d2f17e2068d33a29895
SHA512 52f8dff94df581bd7718ccbd95ae8a64ac85758de1897fea231b2efc63ddbda5f10d14a205aa5532a15d9dc77899083a1ec8fa1e89ca244b46571ceeb84c8ca0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6H+M:A3k03kHRJARJ4
TLSH
T158159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 916KB
SHA256 dd5441d11e360c720db6a8c027456e0683fb3b8d5f5708f6e0cd34336491bc41
MD5 c55d49c7102ee1f607884825f140af3e
SHA1 98fbdf4ecd082022c524bdefa04c4628210ad30f
SHA512 3c95d99da24d313a3ee6c9285a2c48d8b023f34997280fce7b945e5dd6bc4e571e39cd54af1893525dd73fe3e85a75cab1c33a06f069ea2d85470cd95263e2d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ6Hnh:A3k03kHRJARJq
TLSH
T1E8159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1300-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1300-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4624-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads