03f9eb83baa1408b36a9a7dd2fe2ae78b3dc0442f60fec901a280c8195c73276

Analysis

max time kernel
95s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 951KB
Sample260712-phwktabx4y
SHA256 03f9eb83baa1408b36a9a7dd2fe2ae78b3dc0442f60fec901a280c8195c73276
MD5 90f3ac79bc684032a2a7b5cdc1613103
SHA1 eed2229f2f6e864250cbdc0060345a0a1eceba33
SHA512 99c88233f0498d444c70e364a8c34d650781afb97889776c4873dab1c3d0a85958f57b923451f6d8b8bbca66121dbbc5bfdc8bb4f164e412e4114b2fb1334fd5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEE:A3k03kB56r
TLSH
T1C0257B03E6940FE4D11F81749AA64A62EA737C121F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/352-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c5ae-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/352-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/932-203-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-684.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-972.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1015.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1059.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1121.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c5ae-6.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-684.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-783.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-972.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1015.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1059.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1121.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1146.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1215.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1324.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1337.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1368.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1390.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
932	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
352	2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
932	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_90f3ac79bc684032a2a7b5cdc1613103_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:352

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 951KB
SHA256 03f9eb83baa1408b36a9a7dd2fe2ae78b3dc0442f60fec901a280c8195c73276
MD5 90f3ac79bc684032a2a7b5cdc1613103
SHA1 eed2229f2f6e864250cbdc0060345a0a1eceba33
SHA512 99c88233f0498d444c70e364a8c34d650781afb97889776c4873dab1c3d0a85958f57b923451f6d8b8bbca66121dbbc5bfdc8bb4f164e412e4114b2fb1334fd5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEE:A3k03kB56r
TLSH
T1C0257B03E6940FE4D11F81749AA64A62EA737C121F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 cd2a5346749cdf1ad7ed155e388361de9d52c97787284f2c87b1231962ab614f
MD5 420b89c5adbe9ee1c54b5603a17086a3
SHA1 7bd9d50249c1a9738369bdd446d5e6ad5d1a18a9
SHA512 c671b0420afa8cee0874fd663c043f336805577e5bb68d6265d28770bcb0e6539f0531fd69678977a3a9258f4de8bd9a883f45b181a0c193d4991db6061bd965
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEP0Le5ji0hmxNrM:A3k03kB56raPji0Aj
TLSH
T17B654A16E6A44BA5D06BC074C5D29666EA733C421F3087CB1354EE283F77BD19A3A363
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 965KB
SHA256 fa9c6e1d7577dee64472a978b11b6eeb282de7367325bd04a556e8dfbedc98f3
MD5 f9a07f3aa2808c934fe3826deba4c128
SHA1 eb32d4e34803a6f56e9434cb753c3a7969152195
SHA512 ca643bb92a87f46d6b2feb63e662e1c6e598d89b262690fba187842deec6e5dccfe5eea6096eab73cc80d3e057f08e2599813f5088b5b2ca9ddf79224e2b815d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEERa:A3k03kB56r
TLSH
T164257B03E6940FA4D11F81749AA64A62EA737C125F6097CF1354BE153F32BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 974KB
SHA256 0e8340b72c6863ace31926c067a69bccbc21a8b2d744642e97f47fb7d8c716c2
MD5 57686aafaebda1a0b687389fe992b39d
SHA1 4476d0a5aea8afd062b2dfea87912092886b158c
SHA512 183ba18b73b36d775b4224c201c3e91ea4e9b6140ef6e60e5d6143da5d989c998d78dca32a22dc4cc7f32c206efe82a8f46e052cba926ebded29db3c669bbe3a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEo6:A3k03kB56rk
TLSH
T1A4257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 974KB
SHA256 894630e4a8b02099c56fb16ed89d2a505585c4fa870d9eece81906e6533cc955
MD5 13d1fb025408a486d5364e4ab75b08bb
SHA1 a577de99f1436ec828ba094b6d97aa99cffc9929
SHA512 f0413713c28df837bce2c02bb7f313cf40122f06e62c88d0171222138f9e7d938bce4e88c0054024cc757c3930fcb18713323faddce6133bb0251730fa69ff78
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEsN:A3k03kB56r5
TLSH
T1B5257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 974KB
SHA256 cb227b266f6612df45290e16c233d57156018ae39423f7c73115ecda332d44e8
MD5 78cc52b49b20490847ef64a6d40e30a8
SHA1 2c55c336630337e08314df3ab28353f9f2bb5b01
SHA512 bcbc3838f758022c6b9b6577ea360825e3a5f4ef52954f11d89d22ab820862813efcc74a0fe7ed6dda907f5288934115906fa5debe95faa5697e4cc0037c7b63
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEif:A3k03kB56rZ
TLSH
T173257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 974KB
SHA256 ed26086ce0505b63dd59df44635a5088ecdd8a0e31de80a2e9a0b210bfa41ee2
MD5 d2ed5d285dd865472f3f8ace8e715cf9
SHA1 9359168c3650f55a5e1265d71eabe75c0a96dbb0
SHA512 3dedf5a1cfc67c52d0c907357903dd0cb5a2992ef5d6bd8b24b6766a0504763e1e7dbbe338d75c0a7b50dc3bbd154d938c4a8ec247a2668af1f0c043aced5f00
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEE8o:A3k03kB56rM
TLSH
T109257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 974KB
SHA256 19cdf07287bf19cb85fb28ce3cd893c169ed341f36ecb05de2546e7b28a93b77
MD5 d5552f1e59409038b59f84a71f900510
SHA1 0f7df50b5b3f784ceea054ad892ef376ae76990c
SHA512 ee7377e49eb937ddf0f4e3d956f7fc436e4f111a74681bebde18ed3ffb7ac879a4e94ab59adf380f21689163cfe63f630cd46b0c0bc7f43e8fbefe8d786b79b3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEcu:A3k03kB56ru
TLSH
T121257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 974KB
SHA256 62fa575795385f052b41bdfe3b3bd53e40309875b0d5379974683f8bcb712154
MD5 04ed732006c7fad8074d5a01b0e225e6
SHA1 0c345b0eba889b2b332f4175a6014ca33d83af36
SHA512 e5fd9fbc2fdffab06d45c5b594f4e34e0bb067e5844ec4f5449a41d1e926e17b26e1608e997ee7e50d7764c94c9ac3430387bc53a597ff4867b2dff7d43f1d54
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEg9:A3k03kB56rP
TLSH
T1CC257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 974KB
SHA256 af2597b0d1f35fe3cd0ee461752e47b80b07bc9cfb8052d1491b47f7a23a0589
MD5 a1b3f133c31e88560ae00eefdb527a2d
SHA1 d9f3e69f3027537f6844729eddf9a0ad3b6c9cf0
SHA512 804679cbf22811a0cc9318b1fb21e5ab6e5414b0fdbe0615fde6baf2f15e13e7fc589186c968e798b7b1d83369b0864aaab0bb0d171816aee2e94e6fa1d9a6bd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEoc:A3k03kB56rO
TLSH
T1D8257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 974KB
SHA256 9f56849f2dd82d61c2dcdaef197c1c1d9d6d1df051e340fb1530febfc672d399
MD5 d13b78cd8d78c1a9d97203f53295834f
SHA1 3fadf58f1aa5bbbdff96907cdc25e0d6e83504b4
SHA512 ad766e004888910f3134fdf2949bbb73c131df98b335cd49d229bf74040b30bbf04174aa0aa387de39817b53d2a08dc32c96d37cdd4f7792e392f3e1091659b4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEBp:A3k03kB56r8
TLSH
T135257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 974KB
SHA256 0a040cfbda0edf6de2354c3555fd067cfabdb765e0a60d60ec19f34df746a597
MD5 de05bc14b53c71768359c65517b0181e
SHA1 9cec7fafe36df23589b79670b5c71b64cdb33623
SHA512 af40b6fddcfa3fe848f17144720d3b61a65cb3469254902382ca610fc1feac0fde3e65193330d5f91bdaa487f636260d4520e4e31ed5ac6a28004cafedca9d47
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEWN:A3k03kB56rb
TLSH
T115257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 974KB
SHA256 2d25ccf5eb870ca676451a9965fc03ba0f80896ee3d764a8e9c3f1cfaac1eaf5
MD5 5d5c89be9f15fd814e9bab88490e6067
SHA1 c260f3757ac9478ed486610c8aa49bdcbaac4635
SHA512 bd2a32cdcd28e4c3f92867a12d596beb6b81d2444662f2dd55254be21667014e4f9e3cd1a6f2cb546ce381e06307d144b1659590329a5a344570673f8d9dcb49
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEaF:A3k03kB56rN
TLSH
T100257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 974KB
SHA256 cdee2bd84439c43b214f42fd59c8bf581cee503be88ec618fb5a35d97207eaa7
MD5 39a87aed5da1f3923fcf284f3b4d7514
SHA1 b4f66e491388a94fb01794a512dc593c919c8770
SHA512 4720383d96bcf7b24735b3c67a8ef9582cbb1eabee84dc679517d0960b18b2e13bdb1ae93f2b946e4f4bed2e212abfd51fac5cc74390db8e24acb76b956b2dc7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEvC:A3k03kB56rx
TLSH
T11E257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 974KB
SHA256 69348543435866cbab4f8ad836d330565872f4c23f7aaba4695501acc16ae115
MD5 bd04d3eebcdb2c88a8cfec2ce4355165
SHA1 a88f13272534ca22d7b358afff3b692b4f9a3d58
SHA512 d2856ee13bea99bf99da4ea8d2e088aa8b67807d948bcff2e6fefce10f4b8e21e4b995295863e29af0a6e6d852b22cb0cb95e06313aa8ed1a2d5f5849709308a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEQw:A3k03kB56r8
TLSH
T192257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 974KB
SHA256 4e437006d29ddefdeb6499a6feac22a9ca3c6d09494916b3187648b78ba8dc6f
MD5 d8bc29b07239291d783a912868c479b0
SHA1 5eb1f1e01b75a63bfa30eaffd9647b266cb52d27
SHA512 8fcc3cb3a621a189df398cb6263fed31a23413cf03290c5ee882ab3b5974bfda8775f499572ffa8ecc9d1c47280ebe348024cdab356423ccafb9eb73e33e15b5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEvT:A3k03kB56rk
TLSH
T15F257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 974KB
SHA256 7c9a0b25a78e154fc7ae632d6494908c4c6fcf18e059d5238c0c304c671004ad
MD5 9733917da9052c13228aa3fb64320227
SHA1 68f87043d556abe4d88a70a0c51f069265ea3185
SHA512 be2d871ec36e1b1b032d13c170f9cf80e47c63a466f62672741e2da0a3456a1f0a48312d8eb6bf65046df6999ad2f16fca2b763ebf85f1679d6f4796b887cff1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEpu:A3k03kB56rT
TLSH
T1F1257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 974KB
SHA256 5a50e0288eff61ecede7db11b8c3df59cc8ccb9201ce619e2876847f54837f72
MD5 457b96f3cd5a3cf5a32df8bb5a917467
SHA1 51c9db822f2e1c7ffe1bb743561f904e4c060888
SHA512 8ded7849b307119a89ae069fc1a4beb9914856c3a6c2d9b8da1de0e271c116385b0516b2b99b4425acf847dd3b8b3c4026347e2b5fe11a351454eddb762f91aa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEhb:A3k03kB56ra
TLSH
T1EF258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 974KB
SHA256 0bfa9204c328fe14683e1d13db798e53289e21dafda76ef9beff5291ba434d0b
MD5 6a8200b3e1727f9a35154f0209703c87
SHA1 f844cc77df9bf082752b64a52d8ec028a547924d
SHA512 9aa52db3fb80f43cbd6f24280683c2b8f7a9f163ace6d2869f4f12682bd5ff800122c55b84eea8acee37891011d8837c26850190c5d8729e769a29983b8c7c14
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEpf:A3k03kB56rq
TLSH
T1CD257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 974KB
SHA256 1a646f217a499fe7f9ad5e8d03e474df3956d21bc6e4c9476abf0bfbd49bcd4a
MD5 e293fb4b7a08cfe43f751c30654a445a
SHA1 d3ccc3e36cf632de66a8c5c3fe41158949cf7aea
SHA512 bafc7c5198b456e3ea07844804eaa80cb7e797edf57c5ca4b77757e38ec404fd8d169e349b6ee34b4a73484e8e2750869f7b1b8fbf87ed2e99a12f3f65afb3ef
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEESK:A3k03kB56rq
TLSH
T114257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 974KB
SHA256 fb4000bdd061d27a7e0799f8032dc996ee3f1cf7c5233a31a1f32910cf056e7b
MD5 15249a791dfd94eefb6035d99694c1ec
SHA1 262c607466d404b567b3f35f8ee2c009b76305f2
SHA512 a1d2b270b897a4f46753d4d21c063db9996cc69ecb4838d4c451482709d33c4e1bca92366a642eca4cff414ffa9bfeb4848e90e7e16e323543fc7be2d1472731
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEE3k:A3k03kB56rP
TLSH
T174257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 974KB
SHA256 00941ecbf7d536d6a3bfa2028f9cad97e58c7848761c8adbee6682d431aae142
MD5 d11ab586a30596e8eecd4d302b945745
SHA1 a607149f3a0d95e631fba95db5f1a83ea5ecab88
SHA512 09b64b5e91b258267850153602951e1c740b22d01f59c3790a7b2f099f40e29c64ebfc817724f7431893a79a052e449a8c356062276860086cd119c078e754df
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEA0:A3k03kB56r+
TLSH
T145257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 974KB
SHA256 2c3ab7ba3bafb308196b31d2e5ecc7e8c55e6c4eb3fbffe6194fe84fd0b860ae
MD5 6a145cdc10e25f5ac5c3e78ae86bf8c5
SHA1 8077ba285593066bf11717bb1829f6b646529911
SHA512 04bacdf7f90abf6f7739db96a9bb57993ffd8d04a8a3d09509089bd02b8f5f15cddbcea49c3de720608818a84dcd525f824a8e84e9586efca7622112ffb3f0b6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEbg:A3k03kB56rn
TLSH
T1DA257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 974KB
SHA256 e0f534b7f608eb7c0ac83fedc336fa4426a650fd609271176aa09c4cae479bd3
MD5 a32a56c0467c203ea233ac20c6a68e40
SHA1 76598b910332740c1376944ed77ae0d0f4cce742
SHA512 18195be65c5c75de8f1b8acdbf4b5d4efae92f2a517a43f2f4dee5e22cea3a32bc7e215bbb2a84f309d5821c03763b2168f604916475f4031685040459419fac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEWr:A3k03kB56rB
TLSH
T175257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 974KB
SHA256 450e0f03fe68098b004810fa1afc45fa065e2954d447266dd70a3f33a3924bbf
MD5 afffe8b2dbb6e02d5847304e5556c709
SHA1 f001c73a9d28e9ecd5b2bf5e7374589462fab99d
SHA512 fd43862661efc42e315de4ad549395c5d744dfb98d12079c90ab7c0c6ea75ba86adad1e2fe3c0daf9310cdb5c3f7fc12a97000db557163df12c5c9e51d355b75
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEE8n:A3k03kB56rr
TLSH
T147257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 974KB
SHA256 30aa84bb748cd1766b998e4a031d8dec80c7044cae48199f36234c603dede5de
MD5 2ca5b43b9e6d7b2762ff44299ee4e95b
SHA1 953fe1ae9b5f07ade3246f39e9836fc518f415b9
SHA512 f55db0d280ec39ce8ccef529a31a51990c44b02eefe46583d071f7a6680a7d41591cba22f1342abcc12f1744d7946e774ee852fa064f314ec83f545fc1c9e5e5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEE6x:A3k03kB56r5
TLSH
T115257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 974KB
SHA256 39968e991e3cdf82b95904785237707a016826e1af0eada4a25a7bafa813165d
MD5 fa13f6cb5d04c9301c4e53e3f90dee8e
SHA1 9fa04e9a03aef426fbdd426b6223d5adb78c8df3
SHA512 6f081523e711e7faf2046c3e1aa3c7a00386bb2c3c55b71eaf2462bf4c27f979723486e557555d221549883ee751d20d9ee6fd21b55d4cf38612bfb847f5171c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEE8A:A3k03kB56rG
TLSH
T110257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 974KB
SHA256 d296d1a73806d3569718e440aed9651e81c6076b62a0f7136b0b4aa6654193bc
MD5 be80bf9ef876d87270607414920e8acc
SHA1 abaeb11926ad323f3e29f0b438b13d94d2401cf5
SHA512 92242802f11747297e06db0cb58743e74b1c778e9256c540340d4df07d7844da7f71009dc0aa646043787ae35188fa1587213e887ece88886ab6556b7c09d691
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEl9Q:A3k03kB56rb
TLSH
T191257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 974KB
SHA256 16b073b5bd4b0c5264a22dc96a5cceda50226d3b36b7500e6d65ae19fe40eb36
MD5 a319de9301cf192a6791fc98604e63b7
SHA1 53cf470cbcbd6564fadef0601947dab931ea5054
SHA512 d7a92ce4fb5afd691f746f91c5c0599bf77bfde8f12d30b4031317570cccb6a1e69ad6badfeb4515cbf7ba39bccb6a33cd42c443d30084626e5881a42f02a2f7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEQ4:A3k03kB56rM
TLSH
T17D257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 974KB
SHA256 6c417fba6ca66bf562aa55b2ac76b85138a44c8c9954f1a1ab633ef7a79798fc
MD5 a48c8454cde266f2fbd53fe60212ffd1
SHA1 30dd890895c7a7aac9ea9a9c3ed3c474ebf787c4
SHA512 09ac3266346251e35f33302aa9e01ab1882496a1a6d3751d9c7fe952b390593e28d0baeabd457c4e76f8b4b5bcf9ccfa0320b01f94891ca2dc44ad1d00770470
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEETu:A3k03kB56rN
TLSH
T179257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 974KB
SHA256 4be310ce20086aad373b25307f9fe27523ec83b5b475513f0fa40fd768d76b23
MD5 47f06c298abd32e4477154dc45425abd
SHA1 18fcf7fa35c19f0b16d0c93fcbf9556f6dca859f
SHA512 af4281fc61f0ae26021fbbb1917a0d1251e3cc26b0bb2c54b4ade1528fe7f3f02592a4045c83aede60db83cd04ff7735f1ba481c2d441af10c73a7777a54975f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEOj:A3k03kB56rv
TLSH
T1D4257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 974KB
SHA256 54722d6a20ed6e3c2b4358783a7b92a383f43b5bcfa75515d7f0196db09513d1
MD5 e21c4c4fd35d3fe4d5a24e767ef8ec4e
SHA1 c0148f2081705ca6a083930cc3b5cbc36bb40216
SHA512 bcadda4684c52b3ea68981c8f41a28ba515078ca43aa983ab337b13df9c2ca5ece346421110eafb987dfea22877e9c854cf0d222aff394391eb8a0437ef2e153
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEE7g:A3k03kB56rn
TLSH
T107257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 974KB
SHA256 ef4d9bfe417fd6c175a564ef0d61cc26f5bf7fc7656e6bae4b1c9e29318bdbfe
MD5 265c079261fe8420915685be232bc25d
SHA1 bac3530aeab1753179794b217d19a39f8af32092
SHA512 852ac30d3dbc2169f70b423ac7d8e924a7e17b2e5565384b0ef09ad3fa9d7097b188a23ee265ed19ed79753cfc3e454ffffd464886bc3f5ceb185e053febb47c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEmI:A3k03kB56rG
TLSH
T167258C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 974KB
SHA256 905bf02f2e2446cedc589f39889b493079633fd2f250ff4b6cb37fa65becc455
MD5 341199106a756ef48138d6a528c841b2
SHA1 65b2ea6e2ec2990560c94682a6792428c44be65d
SHA512 5cca2054c77c30ab2b64c9efef51fe687e6bc6d830569e2424a2b6cb33540957535c56bb8746c11c674873c3461357e1125549af10e5b8ce8fdcf531fb917956
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEUo:A3k03kB56rU
TLSH
T1CD257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 974KB
SHA256 587f5de7f233e95eb0197f6905869bbf146d52c643de60eb8bc9120e56b8af14
MD5 511bfb2bd71a7f21d7f2e3452e19fc5f
SHA1 fd9842726eb68eb04f35dfc56ebd762d848a65ad
SHA512 66cfcda97d905b127d8b86bbe85aee2c7c5f41f214f6472fb4a418436bbf33a66ef0fef8afa16bcef2990b74ffc84db69a18adf9aa9f0b7aaff5411d31c959cf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEE3+:A3k03kB56rJ
TLSH
T1F5257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 974KB
SHA256 d1cde4b4e195e77cf96e224f9a22e2e5cb9872f2e682e4ba3b243858e4e55e24
MD5 a4d799ca09a1f4857b68607d0383c327
SHA1 eccbd42596350adbb2d1a3c5c0a68dcee936cc71
SHA512 97ffda4dee2e7583282ac54ba6b7fc0ae6e78082a97aa1bd160476e256055de8221b08052d02c4ff5d7b429226a370461b2e8b1b9d779c6865e37ad23b21d0a9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEENQ:A3k03kB56rZ
TLSH
T1B0257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 974KB
SHA256 0b8d58f82419c8b71f19f7327ad92f30e42a8c370ddea97ae8a872d23961caba
MD5 98ab56f18a26b63414a5bb6b4b47f912
SHA1 6c76be5aa5973bdef391039eb6b584a140a2110c
SHA512 f8d779c6147f8cc8edf80614d05e6f63e9814fc5e09588c4d54d03411af316f2e1d2fce2f30d36867bd144c2f4f19df6c1c8e4903d68bc2024a6d26212b994d7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEECX:A3k03kB56rF
TLSH
T19D257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 974KB
SHA256 c6cedcde7bf3a01f6bb84917b6be1807eaf912df8b8a4acfd7a280b4cc6b5f52
MD5 1386e3b382773116685b0956df9ef6c2
SHA1 8890403a87fc9f004248f3b03e676677ba1f2cf9
SHA512 ed2443af376d0193ed331c6e69503ee6af211a71d06e00c22ae7edd14b52dddd1483d12df3437301fe73aeb03b0495fa567c4d130806a78c7e638902d1acc2e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEkL:A3k03kB56r3
TLSH
T117257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 974KB
SHA256 d3c134c91c905093a1a8887668dedc4013743c9c8c53c40ee31d0d178bbc4028
MD5 5a505ab788afc8a7e93ca9202666b90b
SHA1 8ac9917dce6e9c8d55076c20e017219f62333d2e
SHA512 470a35d47916d514e06e47246a720cfa8fa3d9d7a3f44a980db6230cfb84ef4fb56e983b5335c7c7b37801612520f09dce6182361abf613615b14b03213dced1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEAM:A3k03kB56rS
TLSH
T1BD257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 974KB
SHA256 2f759cab7702f4291790f4cdaae007ba5d1b1a3a3f645c003ad80fcf640e9354
MD5 7c137a8ae0e920818406ce9a0e9c82bb
SHA1 19e1f01bc2055c74d4813a1d8f19b41884b6cf2f
SHA512 5c6234bce29472098a59e69630a8e804890bb9fe419ab17f9a65e146b08c7e8eb4cebb2d6b2a733478867d081e9e20854d0608d0cc50ef62190c1c56988144d6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahJ3aEEhh:A3k03kB56rM
TLSH
T1BE257C03E6940FE4D11F81749AA64A62EA737C125F6097CF1354AE153F72BC0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/352-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/352-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/932-203-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads