d508320f082948e60b2b2be31f8abc8072dae54f9acd9b22c86607cbda845ff3

Analysis

max time kernel
95s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260712-tm4jfacz2k
SHA256 d508320f082948e60b2b2be31f8abc8072dae54f9acd9b22c86607cbda845ff3
MD5 bfb8dc95694b1003071b24328acde79f
SHA1 f26156712a97ffd4ff3b689a2db77d86ffaafe68
SHA512 7ac5303ef01cb9ae81e4c6d977e4820aaa180a10ec253642308cade1dbf46fd4111659d176b2fbaaa24cd6e84e8ef1a6730d059ff02408a3f28d6ed40e5fa831
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhF:A3k03kHRJ
TLSH
T1B925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4372-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00060000000187dc-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000a000000019cc9-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4372-76-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1496-161-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-666.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1091.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1165.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1399.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00060000000187dc-5.dat	aspack_v212_v242
behavioral2/files/0x000a000000019cc9-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-39.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-666.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-728.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1004.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1048.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1091.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1134.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1165.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1203.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1318.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1337.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1363.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1371.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1378.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1399.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1496	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4372	2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1496	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_bfb8dc95694b1003071b24328acde79f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4372

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 d508320f082948e60b2b2be31f8abc8072dae54f9acd9b22c86607cbda845ff3
MD5 bfb8dc95694b1003071b24328acde79f
SHA1 f26156712a97ffd4ff3b689a2db77d86ffaafe68
SHA512 7ac5303ef01cb9ae81e4c6d977e4820aaa180a10ec253642308cade1dbf46fd4111659d176b2fbaaa24cd6e84e8ef1a6730d059ff02408a3f28d6ed40e5fa831
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhF:A3k03kHRJ
TLSH
T1B925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 bb54b0a2d3faa068be75edb13ccbbb6b7b4d05e58b4dd152cc3fff9bfd012e45
MD5 02993801a75a74feae4ddab0788aa2b4
SHA1 54c311f7c30f167ebb90ab384998a642362b0888
SHA512 dccfc3b744911724c425e5a2568743e7690975016bf71dda410923de2897b10e739082266128045be15d92518837bf78534fc44054491595113523556c20192a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFP0Le5ji0hmxNrM:A3k03kHRJzPji0Aj
TLSH
T13D658C17F6A402B5D027C1B9C5D69A6AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 963KB
SHA256 41c05a9012417a8021c75bc08992333bcee42607cb1d9b606f60f7086cfbddf1
MD5 aa3bf43440f34026e3a0adde15b4d32b
SHA1 46e484217522345b0b2db5592ff8d51fb495c483
SHA512 3d06b4f442a560a271c4ae8a71ba048438dbd1077fc04089f5806ebbbd8c886268120b041b3ebea15cc5203d8e2047a0e8961b6f565ddd89b49be1970f6ac8c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFRa:A3k03kHRJ
TLSH
T1E925AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 972KB
SHA256 bd3c76359333bce5b3b3ee76fd54fc31ee925b6fcfbca0663f27b73663e3a374
MD5 1a9ae882e071255285e3c8b230285db0
SHA1 afae86f4a1893d50e922f2073372e9e7555384de
SHA512 256e410fdd095c07e0b1e2ce4c4a9cba9238093039710db78cf7f5778b49197749d64f7ebebf2ccf0785c692e1fa2bd5500ce09e96154feb19cd95bf9f74ae94
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFo6:A3k03kHRJb
TLSH
T12025AE13EB9504E9D10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 972KB
SHA256 05176a8e98137a13f5a89e4b2785386cf811f7b6b33041f3a1cddb22f27f61db
MD5 724a5ae5a9073964fa22a9ea7c91ee53
SHA1 35415a20c6b20975bfc7f2c5a15c4522140e76c4
SHA512 cfa519770f9b708d390f5508fce0206d6617574bd344e89834a54c1cac0337fd2317b27a991fcaa40d946cfc55a783de867f2e51cec96a0c892574c727906df7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFsN:A3k03kHRJG
TLSH
T18C25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 972KB
SHA256 0f093c8de4b55a05f06e8d16f28995a87dd946d3eb9d5882d289e6cffb000b90
MD5 adc0337bd3601ce4aef9f8812ab0af58
SHA1 e00e4ff09f978fda018f838dd3cf3dee7d568cdb
SHA512 d0f94a11ea94be9f1d05097d849c394076d44db65c1e1a82f5127e89d37ba1cee4c82282b3c4596b91bbc1ad6ed51a90312d4df528afed87ab23f87219d5e9c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFif:A3k03kHRJ6
TLSH
T1AF25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 972KB
SHA256 23ee3b142af1f2e5961a13f0bcc74f7c9fb75df53f7bf9f24682a6851bc23041
MD5 89d8f154859a25e52b3d0b0fa52ec63c
SHA1 3cf8d5225cee2234265d4922015642343efc5e71
SHA512 f7f121d206908e699e34e0fe8c907c6e481f61354916d654453d4a2c0ab761dcdc14622a06b07795a561699912e68a908ab3136105f2d0ba48e535c7a1044e4d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhF8o:A3k03kHRJD
TLSH
T13225AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 972KB
SHA256 fa9212ebb93926d51d8317ca119e23009623de081ad7cea8389ad1c5a842e727
MD5 4147b470f2ed4a897cf0e221b42e8129
SHA1 47538a836a56fae378db75e6c37412bfc54996ad
SHA512 8b30d034515cd13efa031c68143c616eef1b22acc4dec3f0099a66299fc977b4ac1c85930eb100cd0b8bc4a59adb65f0309d93c03fe342d9b0994b7c63039018
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFcu:A3k03kHRJV
TLSH
T1EC25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 972KB
SHA256 eb138c16937197908385796057b2a08f0f822f5a38873eff31b27a53b6a472a7
MD5 c334e3ef7d173ec32f415e799e0b6060
SHA1 731cfa31531dcce0c97d69701370fb6335bfe87f
SHA512 9ec1277582dece4d314771bbc5dbd4e5b530fac51b8ba5351dfdf5f481d0e3da21116506e399d87cc883f392c2b00bf76486ccace3de7dfd2622888474de196f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFg9:A3k03kHRJg
TLSH
T17625AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 972KB
SHA256 1f9204f564c5347fdbf684a564cdbe1f2d4d797dd0ab13bd7cd773b977b8312a
MD5 5c87d7161e9d02759024ac394cf014fd
SHA1 eae4b596715d3929761c3033edfe250d5068825c
SHA512 e2a2f45bfa093941f8692066bc43a6e6ab1f6461f9ed33cc83142ef7dbc3c926a486272fd983fc2a089abd63c2e32e832d6690288849b3d30c4f1de10351cd80
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFoc:A3k03kHRJR
TLSH
T1E125AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 972KB
SHA256 f912ec9bfe1349ef63aa5fc4292604336305aa437b9f961cb2ae3bc61a6af117
MD5 979dd40d950484a260dd1372bfeea03f
SHA1 587c63ce4dae88a8305af30929d50737296a0969
SHA512 a1c54d5713e36534dbc92223919f1b4a47cd90bd2440c86c6e4b93ed90c7964242e9622331b8375dc8c3a7b91164eae556a8570cc2adedcefb8c802a4669c852
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFBp:A3k03kHRJv
TLSH
T1FD25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 972KB
SHA256 9edc3c488a220a769bdddb3cf79fcd58cdb6236de5f18447028b424286a6cf79
MD5 ca868aa61299d98f131f3d0ddcb6dc9e
SHA1 5a89c15f9979201c970d8ea16403300ee4af0b26
SHA512 13ce4300b6157caa1a6f4d3279c705cbd938bc0e4eeef2475281ded6da3d72dd13ee73ff1e7b57534ce9d4211416aeb06576acf292440170be12663cd4619a06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFWN:A3k03kHRJk
TLSH
T14A25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 972KB
SHA256 9f44ac78d73ece9c81f45c2f8e177c3ce164fb01ee419b710ef01fbe85b9aae8
MD5 c791d64b5fc0683b0e071c496c5d7c50
SHA1 de422e9877749ce61d7d93729a1ae2fcd1bcf6bb
SHA512 d794a6427721bf07b485d3e1e614f962123b5bcca4a65bab6312b3ed5498e69a3cd6fb84513bdb8c53fdf6c4492f64992b2907439eee64f124ad0a828606b4ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFaF:A3k03kHRJS
TLSH
T10325AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 972KB
SHA256 a511d85c3b2966ea4665358eb8559b2780c5ef71414387e8d65c69c7d39450b6
MD5 ead611e015b9cedee32c970c4f99ba30
SHA1 25e0e964df3280a118794d07fb4c9e4eb52c894a
SHA512 9279ec763c753f99a2a521b6fd3a56e86d65cd2222d41b2bf694d315ce409a3a1f9aa186fbf6d5d3ee40e2dc8b1b0754c3a279d1bbc51befcf46aa7e334e41d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFvC:A3k03kHRJm
TLSH
T1D625AE13EB9504E9D10AC174AAD68A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 972KB
SHA256 81d16a146fd5c38862d609d443f01f29bfa22a0b1cf7e88fdf7ee8b3c55aa1b3
MD5 61583dfc691f94d0ac1416a1b007aaa0
SHA1 aa473e03967d822fd9bf483e822b260191c224c7
SHA512 9355f5d0ba6d148ece9508bf280c51e23ba4928e3c3272f1d9c82555982e63e7e14923b7b672197f20f5cc72c24e197b90a9c7eeea0a1ac3f099da358a37ddfd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFQw:A3k03kHRJT
TLSH
T1E225AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 972KB
SHA256 b0c90d2cfbe62858f33709e3e5f8d345e256a8b65bdeea9329af8332c2faa891
MD5 deaf775ba19e1dfb1f8778a40624b4f5
SHA1 23be2488ef1bee6a9a532c8419a382af9afca01b
SHA512 53f7176e0cd9d1cf507e78003675bf8016b2025c6b1b000fda909815b3c70abee1ea1d68a7809be199e9c5d8e44f162112dc1c031ec448fe5896a8094d693e9f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFvT:A3k03kHRJf
TLSH
T1A425AE13EB9504E9D10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 972KB
SHA256 7513fde7bbb6491f565d3cb2db4f1fae5e43b4ecdb446d902763cdc5fead72ec
MD5 63c76e556e44abab36f95b6a9aee12d7
SHA1 f7c101d772193c6050e6d9ccd215b65df6780f95
SHA512 6d64a509eba40622a142bbe31a55a49118c1cfd2c47f01cf47d33e95412e8a14273022293cf72b72e24f4508f536ca94534f6dd2b161874f96b5effc56d52436
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFpu:A3k03kHRJw
TLSH
T18B25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 972KB
SHA256 17feaf7c4c95fcc9157d5d6cdd374f2e105d49baed74c218bae45ccd7ec7f5b1
MD5 5858026e3cae39754fbb6df0fd7b38cc
SHA1 f646b5b143580ddda38c1f1e34070e58912f6536
SHA512 b4cd7389b81cc4c2d188fd2f9e59b9c49705a9580a052eecd58b9fdb11bed9d64725f724501248f23048bca1d08dbae471c3c68f3e3476efb7837ee979ce408e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFhb:A3k03kHRJp
TLSH
T1E525AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 972KB
SHA256 bfe7c6dd4a57cb2182136d231ea36dec9b84980334e986590a7732795c9e8359
MD5 9be5bbb44beb4ceb0789477c38d17450
SHA1 ca8bce1df10b9e924d9795b7812f9247b4ce2773
SHA512 ce740a00b21dc7f4528ec0d0b118bf49127a7c4c03c8dd11437eb76303f0e793780fe71648fcd0958a46e90587222905356967f35f5db69703ab50d4d300a759
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFpf:A3k03kHRJ5
TLSH
T17A25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 972KB
SHA256 f6c2e12035953d54a1cda23481427b1b18b7da15112ea52dce7c3b556e05946d
MD5 dedf5931d5d914f94ccd7897defe4058
SHA1 1967272a219e3e44fdfb30595b58a31289a5ba4a
SHA512 7aac6e50f4ca6c85497939a040115a71f50fc5653393cda1086f633a672ffbf1ce389004ced253ed7707713b99c49db86deb120a6ded4b1706f6e194efab8a9c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFSK:A3k03kHRJR
TLSH
T18225AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 972KB
SHA256 45cfa6756ead42b614ee43e0e13ebddc9cdb13095e362854ae407d3b5dfdee36
MD5 6ae26172623c808ddab9f7c898ae64f5
SHA1 fb3f04ac27ba177e0df9b87949c2a1977c8f49d8
SHA512 db314e4bcb87a72cdd4559fcba23fb6aa9581535447ab3301df27f376c368ed6fdfc6827210ced0b129b72cbc6b2050a24aba1238756472b1ec370831fdf8895
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhF3k:A3k03kHRJ4
TLSH
T14D25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 972KB
SHA256 d0eb0f16ca82d96050174cab5c7cdb963a82425d4e9f380e65569c06e1c4c72b
MD5 29f50a06dc7574468637adb8f05674e1
SHA1 f44041f24f02c4373e955a814ed4d2efc1897966
SHA512 d426e5a4daf6a08399a384a41c1bdfb386242bff408a17a5ac7c246aee872dd43816444b102210570997508b359628dced70451a54e03194538b9a9afdff48d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFA0:A3k03kHRJx
TLSH
T1DD25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 972KB
SHA256 3e03a0efbda1de5e6d47a084c4f7298558fc919c150aa47754d4e21c316e3cab
MD5 024ce2adca055a5798eaa860675557fe
SHA1 d513fa4762c7af22f6f23a26e61cba2c1a72fe71
SHA512 2212000e66095a181be095ec2613bfa1b10f7bd2097e2a760bd95b1d731fb028becd88462841312bbed3afd062640dbde80cba1f7a9829dec1a312cd55f2f475
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFbg:A3k03kHRJQ
TLSH
T14C25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 972KB
SHA256 2b8a973bc490dd8af0c1a61e01591b702590ccefbc2bdda8b8b41274f17671f2
MD5 24d458868829dc10bade4769c96aa5d2
SHA1 6a02b92a5a1ffb1d1bcfcabf28b5074b0afdef1d
SHA512 aa0cfce401c33c368e243de7ecef53f0892663dfd00cbf9523e5bd1daa05381bfb31ed72d042bb777bb989204744e2dac3728db16ac88a0e01861ffccb60e38e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFWr:A3k03kHRJa
TLSH
T1EF25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 972KB
SHA256 ae7ee9d0977245a365d497d0e4b1545fc624741620e545f5eb6799116b547cd1
MD5 bdc3f8dbc200d787f56dd7f3c1e35c13
SHA1 724c64aad5df5bd7c93aa251de3b59a5819f27da
SHA512 24c1af060fe1e2d05f8a43f46b81687c8222999a6d4ee221d61fc91a33f21258e835c435390c5e28dd421c5665e580ed3bbc5cb0c20569ad80b374fd19a908bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhF8n:A3k03kHRJ8
TLSH
T1BC25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 972KB
SHA256 45a4d2181e371a95577d426fd4b052e34513e3e761d4b55a47251ff73c25e822
MD5 17858268e4f950c6bf2742ff0faab50b
SHA1 97366b58d4797599e2dad4322f5ab4c956bd9df6
SHA512 0f04a1b6e8140ee2c720aee6cc1adf3216b95a575d340b2b27aac0d57129c1c5c39ffab45ea2e015646bcb5950ab86517817193ee23c8dca0ecc7e74574d92da
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhF6x:A3k03kHRJq
TLSH
T18925AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 972KB
SHA256 4fbfce84cb0c3e26a79eeba2e2ce4e9b5658481dc0cd747685169535ebe10f69
MD5 5d6119dc92f7ef271db3bc532b07a8c6
SHA1 723f1a01fd77cd2078f54a2a81899111668278f5
SHA512 462908acd47370691da54be9e499adc8e59a1cbd605efb69176e73dd789276c8d77757b99da61d2314b6ddbfe8da809f4f790842a3bbfdad0325c00ea4b0962f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhF8A:A3k03kHRJp
TLSH
T17525AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 972KB
SHA256 1ea3b9e2851cc8bb739614758c576ed20f5235c4dd6624333c38dc3a9ff8fbef
MD5 1304c4ec0058c8aad04c8323fc52d901
SHA1 231271769bdca05d58b637ec143ba0c369849155
SHA512 e040b31427e0badfb7071cc02bc131582fa1fe871fc7ae7440ea104bcd29529d44d0c945aab86bd1e192050db46cea8b67eddb74c4e9911186cb44054da90234
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFl9Q:A3k03kHRJw
TLSH
T17125AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 972KB
SHA256 06e9c299d83feea7ec49825f14969617b1fd1140279ac25ecbd2bf1b777052f8
MD5 c3f7c21b0f84758db043ef4484939797
SHA1 3f8fb8a354b3dc75f7489e3382ac4acafb7d81e2
SHA512 04d44b4121fac472de6baa32be544e086adf5411b62cc07bb2728ef8c3644415fca4ef5da9d8a2e0b39d5a8fa1cd00bb538f03d13199e5af2b0bb85e036bb8a1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFQ4:A3k03kHRJr
TLSH
T11C25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 972KB
SHA256 e0db5cd5c0f99d1fb8a9ae7129f42fc1c972ccbbbb6d7d84bf2377942f563827
MD5 18ae4d84ff64f6a8d0d2d538225580e1
SHA1 17f3fe3555e132c6da2592b7945ee8b006851eb6
SHA512 23fd046d3fd01b45214d814732e8bce6cc270689b75455ebc99e0b5b0a0a05b1091147fbccc85f8c2ec1cd61dedf144588af9d711e16974657cc893eb55c358d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFTu:A3k03kHRJe
TLSH
T1A525AF13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 972KB
SHA256 c43f0a6f7b080b1f38a03d2978ec018997b585231b72e9ac32a12807e12fa113
MD5 6018e7665c16d71d846b2fe0ee38df06
SHA1 61d7780e7b8285ebaed9aeede8aa5d358310130c
SHA512 3a7be38b925bfedfd6849cc777c9902ae4e88ca395758d0581df16fd24937f115b8275c8d73822cc7ad052e59a80dc403d57abf42972f0f38d80ef8fdf32f07a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFOj:A3k03kHRJQ
TLSH
T13925AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 972KB
SHA256 cbe648baa5a606ea9e9c2006e73dbd841680861acdd99d0f0c96caeda16abe7d
MD5 2141480dd15cc1768742ebbd6f14d626
SHA1 84981786e63ae2017019c343ea08a6d36c6df8e2
SHA512 9e3fb569968fabd2505dac42ed7eeb9b02831a38b918e8775516d3ba628b9e5b5c1721bb56675a2d061ec0a7ad8904a9b62694bf66597314d3fd33c1d9fd83c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhF7g:A3k03kHRJo
TLSH
T12E25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 972KB
SHA256 cb23de8dbf86915a61d0edf40c1bf3a7efe533e7c8c023426bfb44a988868974
MD5 156924850d668a0165009e8f0e392b10
SHA1 9d6ea0da1b79fb67aa7d3b9a76ed6f28bb32e68e
SHA512 b1abfc27d61cd8a5b2583e9a529f330ab5916b59c096158f5c3011ac034d7f655d464d490c2acedf7915f003f01769a5256d7e744c3e1acffb8a86376c669a81
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFmI:A3k03kHRJZ
TLSH
T1BA25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 972KB
SHA256 1f77d83b95c0312c2e4f0cc81d21a829ffd45c41d3085c03785bda818d9ed231
MD5 948530483d8196e8a290f43b41e96c65
SHA1 0900f3d6c6875409b1818a17c0bb663c5ac525f1
SHA512 fea74308220d63f32d4ae396ab995e764dc1ac0424709b1fb974522214c0491dbc74de772261edf6aa55a59fc789a86e48c7986a8d79277499ef8ef7edb5e8c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFUo:A3k03kHRJH
TLSH
T1BC25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 972KB
SHA256 8bc7960f7cd5296957371a55c3708d9bd280dc721d391e1b2088be002409ed21
MD5 0ab2ebc4a721fd98c5cae1857a1233de
SHA1 701ce4c9c37c58a9dd0b93cfe24ad06084eda3bd
SHA512 08c50829bdecb23b170ce0f8ba4d514e6eba754c44634a15930e487b914bd8fe83bfbf033e204b6fbc2fcc9a7fd7a29f3aebbab8ce3456233e66f7a1addd13ea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhF3+:A3k03kHRJy
TLSH
T1F225AF13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 972KB
SHA256 cccac03d833de5cdbf62fb0082732a991c3dc29bd2e6926ad7592dd7fd472228
MD5 df9532b3bf99a3bff2848e1416c76208
SHA1 e2d820ace683e974ab06091e48d45ccd7af839e1
SHA512 463f8371dff81bf182ca9a7b79f4e2432665428206b4e0a14eb6b485602dec255b4acefb35dc413f82c931b083d114f90e040ffbb48c3c414d83e81a807242ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFNQ:A3k03kHRJm
TLSH
T16A25AF13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 972KB
SHA256 cdf0ab6ded0e3bce73825ec448c3c8d768c3fd40fd62ab46a6bf395cf01277be
MD5 761dbf5d129dde43b330e21c7e860880
SHA1 99f6a2d9bf0a6adc86b2628dc9b898edd668c369
SHA512 1e734299f4f49a2f41037de695b36adc866d129a67d136dfe52ac97ec095fce51295a32974a1343f2d7ac228a83af881be6f0fb0b49946dc330590b9c6ec4e74
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFCX:A3k03kHRJG
TLSH
T1AF25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 972KB
SHA256 11188af3a8490161743a9625404733b72c3dc99c9095b4c41f44dc863690f1a3
MD5 4a8353476ed915a09fa9c8087360bc8e
SHA1 afda6de3615974db5677ff145c3af75fd886a3a1
SHA512 af470a5755b58271b023bd2f1de101a0be3be0b243df06f0f877d9ecfe24e0b171e89046bacf7ef09b789ab155d43f702e65ea0dbd5a0a76e7c1fd581d4bf6a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFkL:A3k03kHRJI
TLSH
T1A025AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 972KB
SHA256 b8c1f833fce6cf220f55dd1ceed0c78f6f6752b9e4ee0abb1eb649823cc8564d
MD5 89916deacaf259d8343170d9048af50f
SHA1 7f516337e5ddea206e67713ee20f540a869e0d70
SHA512 bb6ccd803ad00bb71e80699d4f549da4e7c7d720db11a379dab834a2f2f9dbf8b021d9155ebd8addbf4fb7716063ffbb239bbf5121e1bff754f4a134a40c2ef3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFAM:A3k03kHRJJ
TLSH
T19325AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 972KB
SHA256 b0eb3386b76ae908a75c9acd56cbc78d9f52ece669435a667c31d893f83c2bc2
MD5 2b9bb15165d87c6e7eaab434bea12ed0
SHA1 be3ac4f00de98a92e18b10459f44d9c3d854b641
SHA512 dc166d9b3f706f5440a102fa07a509e3d5ae1cb96cfc8ab2a4ef038dcd6c0a7a1fca57010a66af822ef6fab8d258b1e605e692f8cb1198c22140846bc3909d55
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEhdEKhFhh:A3k03kHRJ7
TLSH
T13A25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1496-161-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4372-76-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4372-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads