ab31ac635f84df0256a6ed2d9bb53a1afca0fd475dd70e7d528b304c3ba54530

Analysis

max time kernel
99s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Size 855KB
Sample260714-2emvqaey9j
SHA256 ab31ac635f84df0256a6ed2d9bb53a1afca0fd475dd70e7d528b304c3ba54530
MD5 38f288839da9ddb5b6fa7bc265e70ce6
SHA1 f8c148d5503c2ea9042bf689dfc86460b810d631
SHA512 fec218114aed05a0974d80d9d0a5159654c56036ca8b149e4979486c82234e41ab983da6077d76bf8598a2f11a448d0a56dbedc3c5b155feadd4c5ef49bda1b0
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEoc:J/sCv7QExqatgl8beJTTx0yFybaBCEoc
TLSH
T149155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/924-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c58f-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c86-58.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-258.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-409.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-476.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-507.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-598.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-702.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-841.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-863.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-882.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-889.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-921.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1002.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1076.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1125.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1144.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1207.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1316.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1348.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/924-1998-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3364-2011-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
3364	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4F64B9FE-D791-490C-9F74-D185F13EE27D}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4F64B9FE-D791-490C-9F74-D185F13EE27D}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
924	2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
3364	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_38f288839da9ddb5b6fa7bc265e70ce6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:924

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 855KB
SHA256 ab31ac635f84df0256a6ed2d9bb53a1afca0fd475dd70e7d528b304c3ba54530
MD5 38f288839da9ddb5b6fa7bc265e70ce6
SHA1 f8c148d5503c2ea9042bf689dfc86460b810d631
SHA512 fec218114aed05a0974d80d9d0a5159654c56036ca8b149e4979486c82234e41ab983da6077d76bf8598a2f11a448d0a56dbedc3c5b155feadd4c5ef49bda1b0
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBCEoc:J/sCv7QExqatgl8beJTTx0yFybaBCEoc
TLSH
T149155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 d270b004b0bc3a5213ce0ead8cbfac27452d1cec405db607e73bd908b70da09e
MD5 d33cc319d16178668df66d39e49da5e7
SHA1 822fc00827d55891cd8016cfdee4e138ed9901f9
SHA512 44c37229ab15f9a6288eb3dbcb19b3189fdeb5bce22b43af04da633d99c1b0bc4728e4d4364cb3e0c828460812fafe63544f5383dd65fea0b8cfe25cefedd889
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEok0Le5ji0hmxNrM:NDqatgl9TK6Pji0Aj
TLSH
T111655A53FA648672D0228171C4E7568AEA31B4461B3086CB13ADD77C2F33BF1A63A775
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 870KB
SHA256 055acbf30f626c1d890671d6a9ec79753268082a7204b45e875cffe2065e82ab
MD5 9c11fb68a18f04f03bff0702a5cb5e45
SHA1 d5098a1a52311706481e6c75c104f016a7649b08
SHA512 5b6d3266356096239adeed2ae174a33390dc354d1f1c366736240dd3420604715b99bedb1b3007d5b49029c99d5affd3c50815daaf5e3e5b5568bc38ea1ce053
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoOa:NDqatgl9TK
TLSH
T13B155B53BA4485A2D416023054EB4653EB71FC1A1F11968F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 903KB
SHA256 3e17fc54c1df0deb862d9f7c51d71791140ff2aadb576e759b88d47e7d413e1a
MD5 34145b4b136e3b129624ddbda0ef55cd
SHA1 c20f3040b8be5d2ee4e54e6295d99c68dbc475f0
SHA512 0ff14bc830b475ecab95171c252ba59eb720ae1e125728711de7cfe5c4f6540353ec455165d735ac84614fea2c722d658ec43dd1d9c59814b973342ee82e32e4
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoNb:NDqatgl9TK/b
TLSH
T1C4155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 879KB
SHA256 349b9b1b2af86d6d01adcc923ce441ec4e8bbbbff0060d61673324c3474a6cdc
MD5 c6e719e2ee4c4734956c20a449b343bf
SHA1 374babe5d67be197da9664dd95569dd383b2dcc7
SHA512 9010575d3ba7aea1d98413f6940903df7205088d68c19f5865b1f67606d7f8308c009dc1ac6dea7ba8235bb14f574bbe7cc508a670e0b6a04be6305681f3beb9
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEov6:NDqatgl9TKE
TLSH
T16A155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 879KB
SHA256 68f02c775717fbf636ebb3bfa7fa992d975778c85a8d121ddeb5ecc3936db115
MD5 6f9710b19d3f6f251c743e2bbf9fe98e
SHA1 a92932ca5d873c15d3d59bde1670540716e3d01e
SHA512 d7f30bd5d967ed11638b25763e9208c7005beaf25b355cd76305b23505017830d24b0c1e4c8d8d2700f7a5cf7dc0f2e53ab58a3a4ff4c3f15dc59af983195301
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoxN:NDqatgl9TKZ
TLSH
T176155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 879KB
SHA256 c57f69c9df386fbbd8290f79fd225b5f3ec5921aabab1e8466b8cad26875b38d
MD5 68fb5b6da4f5ae8a709a687729ffeae1
SHA1 a94e49c2228b3759ddbf5262e9132a23a52f16f4
SHA512 8cc80d8f7f2b850aad1ad74d84499619709bfa67ea1a58b1ccd4d788231ba61b13072c4c1df17a3d085a9892130b7fa745b642ba7cbb55b1a8001fb7e23611d7
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEonf:NDqatgl9TK5
TLSH
T159155B53BA4485A2D416023054EB4653EB71F81A1F11978F237CAB6D1F32BF0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 879KB
SHA256 0665f5a34963917a26c9b35883ede01dd688e69817da7cf0e0612d05f3080e59
MD5 9f9e3c66cf52788da950183ceb9b9851
SHA1 f60275cccf3e279d7f15e50209d105dbd3f2d08f
SHA512 0ae71f9aab50424a6963b797ebed3cde034584f220f90f78e8c5e65332a3e2a9f02d461c2cdbf9d928f1004a22277d5925e7e0f404012730c7bba27828922157
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEopo:NDqatgl9TKs
TLSH
T1C8155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 879KB
SHA256 85513383e0ec7ac28e2057109d25c6e411f487d6d226ed0ccae88e4859254f3b
MD5 857b0d24a7e65adf6f94dd687a684f8b
SHA1 2520f7a7079847f63509f7765f142ea5a1b1fd2a
SHA512 8afffa3c699cbdff928b0d73954f2af986c4bb2f8c98fc5487309de57a2fd33ae29dfa127ec8b7e4c31ab0ed6571491250f54980d9c9b5cb8c340545032e9999
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoZu:NDqatgl9TKO
TLSH
T153155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 879KB
SHA256 7b71a1cd20f3807d86b74b5085ce9aed980857051aee2b5b687d11eb72ab50fc
MD5 69ae669770b7eb0a04b2a083885dbc30
SHA1 8266cbbbd3db6c4d044ffe9b0950ba1af3335ccc
SHA512 8288598dc5df1666664f980e6b11d58fa797e115f6d1d2bdfa45e3ab8024691936d169ae00a085b5feb59410badefc096d601a59d8a31db68d0132ea3fac8fee
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEo/9:NDqatgl9TKv
TLSH
T15D155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 879KB
SHA256 6edf58f9c39d84a3b0b251d676751007cf6ae79409da62d26884c3744602e989
MD5 4d70c09722ea33579e04606f4f7a3294
SHA1 16e2895161b6b37c68f9cbbc4d231aef9bf9eb95
SHA512 b9232dfa516f8dc637065819d44a8ea43e86adef0f9fdc2b1e50d0aad39dfdfd6bb27bee7e45d6995f195ab2eef3790d20a90be1b69f56fd8c9cb7da0108f307
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEobc:NDqatgl9TKu
TLSH
T1EA155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 879KB
SHA256 49fc6bc2b8c897c275a1e51b5991c51f078a90888b68a61e5a135964694d6c15
MD5 2ddaf14dc83554279498534115a9e7f2
SHA1 2306678813353ac94b05c4a61845447795fd1824
SHA512 bb37d753efdb593ed2acd8b8ff15556033611eec88937122e45eeee9ef8cf2a5fd195bb5a44923e93b5ef6dc81bef80fbf50795973181c2df9f0f887700c0d30
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoEp:NDqatgl9TKc
TLSH
T105155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 879KB
SHA256 90664e3a52813a87044227b7066a985279a58a3112a1ad49b4f896f1f1401285
MD5 cde450e9b8de552504b421fd85312824
SHA1 1be85241581fde84f78ea9e648e6ead8b4cd7700
SHA512 a17a725e79084871ebc27988b26c4495e59a9af2702546b66a30078bc80b6762cadf663a15883d3cc00b56353710b3c29db45313d5120d92063665aa96533465
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoLN:NDqatgl9TK7
TLSH
T1DF155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 879KB
SHA256 4f7a0a935cab737b5fd2b4399aac1505e9304a34c498ab68a22c7eb579dbe510
MD5 48df65c64243373fae216ddca3dbd4be
SHA1 63016d204a80852db15e477d238149298ab597ac
SHA512 fc1e50c6b8b5c2d72b8228e15c7e77c989d5a44602421cede7f7e3d6e440b97664243411bf9ae1bfe85e71637343cad8e1cd0ca664f8c8f42c6a0653b43ed054
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoZF:NDqatgl9TKt
TLSH
T116155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 879KB
SHA256 6f22aa91a89fa23b8575189419fefe01759efd5a47e856f02d8a51b64887de7e
MD5 5da5d841321af9df404e0fa6cf7ce9dd
SHA1 847a2563d68481fbed84e8c5a154de7d220b9839
SHA512 08cc0904937ab2160f2a0bc6fcb7ff0ad4a60260267da599604c05a004c5e4d52a1d286ba6a5b9501d94566dd8d869e91567294d3e924ed1860a6e81b2d499f3
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoyC:NDqatgl9TKR
TLSH
T175155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 879KB
SHA256 d6cda8ed141e3c3d43692b6f4576ba1681dc3ba8a376d0f2e020392c850e3d96
MD5 7f64bceb934eb3c3122da75305846d49
SHA1 b84492983914a2fa0d8430730bd228b4e0ac4622
SHA512 bf23ed672e6c230c51821346c77332dc4b1e92fcde63cefb7a2b8e4677a89bf309927480d9d39083a835316b57e32652a3a1bce8347fe8f582860319850ff2df
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEotw:NDqatgl9TKc
TLSH
T104155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 879KB
SHA256 1ec7a9e862885e673685ef7b7b74b5a780ae642dbe59486980d8341ebee2f463
MD5 debc2a4d763c8d59c81ebeee46eec861
SHA1 8cedb908f71f269e9e2c27a20158fc5f62b46861
SHA512 0612bf5c50b730bafb3ec184c80711eefd3973ef9f719c256e6e0d3303b6ba03954125fe7eb7252fb777eb221e3f38accce864917810fcd86e29411dabb8bac1
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEocT:NDqatgl9TKE
TLSH
T145155B53BA4485A2D416023054EB4653EB71F81A1F11978F237CAB6D1F32BF0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 879KB
SHA256 4b3f6d87796850de7e091464b4ff461441a0da4520da800603cd56f543b6fc4a
MD5 5d896e0dbce68cef7ca55de3bf94feb4
SHA1 21b702404d20d40d0b9ad4ea253857ae7036bfc0
SHA512 48f13bcbe99a8e2154f01c32b1431dffd844663461b3e874c935dc537f3ee7bbaa889421b9235dd366b23c892b6122efabfe323619717a6c2ed01e349373b2bb
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEowu:NDqatgl9TKz
TLSH
T119155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 879KB
SHA256 2d2785fcc3150c082378a59239a1997167c106d70551e27bc7dbac8b38c2f37a
MD5 bf3b6f416a5c129a681cff0279fbc8a6
SHA1 5bbcf5c7e3fb418536df38c8a3a7e060704d7a9f
SHA512 f6c0d8f20cdaadce5621b11bcc431f62183c98d71a78f7d068d9a43737baaff9d9164c54f0daadb09e51ccacf5e8f0c29c917fc4e03ad409566bdc35bfeef510
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoOb:NDqatgl9TK6
TLSH
T151155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 879KB
SHA256 33bbe7c17b21a47f8eae317f3891d5e0e032a751766a4a19b1914708fa247397
MD5 57e8f659171133b0097853751ad88d5b
SHA1 11a0e8404dffdd267e63afbf7f8b52f0015efb00
SHA512 0b71c8767430f370a09663831c1695febfa435185f049fb0b87682f71ba2be36ba6d4b13512a44cf2089bb7ca829a9bcff8710259ee50d058d0b5091dfda5a48
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEo4f:NDqatgl9TKK
TLSH
T12C155B53BA4485A2D416023054EB4653EB71F81A1F11978F237CAB6D1F32BF0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 879KB
SHA256 830441fcc171dbce41e602df8c54bd445aed9d80f9cd6237195e27480b6c2dc3
MD5 3de49b50a00b162bd226b7cb5a41787e
SHA1 12d9f68b52cdb5b8259f8d1ccd0908405934ca1d
SHA512 715d339db78eab269cccee73651c356e684b4ad08d334e13b5177d535118c3229ac025692adb495e8886614d46f8b192c177751f0aabc6be9629bc33cc3586f3
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEo1K:NDqatgl9TKK
TLSH
T184155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 879KB
SHA256 975a480a626cdbac54d2b41b685d66479576f16ca14e5fd617f37b2031d47a84
MD5 d1d117f6f713c5dcef032664d566d0c7
SHA1 b245a364dff7c375a343fafbc8e461704b1974d1
SHA512 e2d3405a19b99ee0927d402d846bef2c846fc78151e8d59e1f3f39c6b5315eec96dd51c6109ccbd1c9f567545520972caf27ec86dc837cf688e9b2a65df7f1a9
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEo2k:NDqatgl9TKv
TLSH
T1BA155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 879KB
SHA256 4a43beb3ba12fa456d6cfa65723d766cc52d18dd992045d726934ea534ba187e
MD5 d754842a616e2cc7d30424b1c392f9f8
SHA1 355b50dfe5fde67a16ba56b5de89bcd5e9b4aaa4
SHA512 01837d29d4ef68fa1ef162348897df0e4a461cb510f8b0e736d473b84648f6274466a01551b8307fe7362d3b1078de2f5a66962555b0200da0ad87a68d2e2dd7
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoT0:NDqatgl9TKe
TLSH
T180155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 879KB
SHA256 ebffba98e3d77ddf45dc4a65d59e82c6e6d8bc089766a718986587803751bfaa
MD5 bbaed1e4fcf455b09d14dee870e57474
SHA1 dffbde4f42635b4b44bd5a3c24bb4069c3259048
SHA512 fa15d368ddf87495086fc67e14ea2975333d0ac75a57b34c86227c2ab23149bd53aa3baa5ed5413bdd179b89ae3db771d027417dad15b225b98e025781306420
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoig:NDqatgl9TKH
TLSH
T1D1155B53BA4485A2D416023054EB4653EB71F81A1F11978F237CAB6D1F32BF0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 879KB
SHA256 c56202cc4b1fc57cf6f1f7eac4d3dd2e0a98b81a1d4ade807c95034dc5581726
MD5 6af1ec46f54eb3bcf1c50dabd84b11f8
SHA1 9e62f9837afbfa31b5a27ad79b7fef9c196dd26a
SHA512 71661f9cd2fa6a2c72205326b90e782e8b9c9ee6428e7c223faad16d7771abc3df187cf169453cb80e9ef54f60ef621d172e4b52235eebb3f1696a6bfca101ff
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoDr:NDqatgl9TKh
TLSH
T1BD155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 879KB
SHA256 9c668b4d2d526833642075636064b03b3a97a6d4a53f68331093272aa1b4de74
MD5 17907458bde809ceb4eebb257b8039dc
SHA1 29dc84e3336e7ccffe76191a509eed09d67cd4c2
SHA512 970514c34dd53f396330145dead242b9fb3038fb58cde4b4385e67ef8905b503704551acef74f5b0121a30b7c40a11dff39fb94eeffad2d371f1606bac72a745
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoln:NDqatgl9TKL
TLSH
T1ED155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 879KB
SHA256 4ddb3f60e3c6932b17b12d16f8c1e4c265a664d7f146f8016579a785c9e035fb
MD5 7ebd4f87a87b49fc44c416fda1230d07
SHA1 0bff4c20c7a50ed73c78af34b42495ca675fb683
SHA512 0811d76ae79c0726946e39b243fd3813774d9c186c2cb419939ba845b7b3d99713de96079a6ce355882b897d58357df91f8463d901532287010e6d4abc3a86ed
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoRx:NDqatgl9TKZ
TLSH
T123155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 879KB
SHA256 2c4a5ad8ff3e94e9e9a9ff9a3a6d9d3fedb6679fdc527e73f2b970aa9b82e62c
MD5 23f9c363d416917d4ccdfe940d54bfa3
SHA1 8eeb90eadd15c6c9e17a331832a6c1f282f02487
SHA512 6fa1b3ea7a81282aa80ef21e1bcd9543bc9b258fdbc8312ffd406f1cff97ab7d5d602d7bdb2446246374f938b3ffd6d63b1a2c68900751af8d48aac52d809622
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEo/A:NDqatgl9TKm
TLSH
T1FF155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 879KB
SHA256 83e7a65619cedc16efbe1808caf866f0548922107986e60d157cb47f9008a125
MD5 8fb0f672e1c7dac83d1853dae45ca234
SHA1 cf1c02acbd0f3c7ab60f8e109a5198df8c37fcc4
SHA512 3360ca38074a6acc040db8d0cd5bcdab6d12b0953a733e28af339ccdaebf7420020c8a222de0efb3f566949fdb53bf775ff65f59f23434fb0fdcc5b191cdb4d4
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoQ9Q:NDqatgl9TK7
TLSH
T127155B53BA4485A2D416023054EB4653EB71F81A1F11978F237CAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 879KB
SHA256 08f2ed8d2e3d3d84f9aba4e3cea8b62703355ad120cc1568be3cfe29fa329772
MD5 ac20876a4b23d0cbc9c5bf002ef14fec
SHA1 d8cb7d46f180864e3a54fae23330280daeb0e574
SHA512 15bebfd39c721e408d22e3fc50e63d1676a5a13b482e454880faee9779d105a52e3fe0e612af20e2c063d148dbee0c02929a98e42251295d403bcff156b90be9
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEox4:NDqatgl9TKs
TLSH
T184155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 879KB
SHA256 a9232dd9f0c32abfc5c7a42bdf86760c23ceb08f4b635a864263d42858b5b67c
MD5 a9c87dba494953c1f94fcb54b9e9925d
SHA1 aebf3f5062fe39b1f5a52014a8c5d5749b6212e2
SHA512 8bad9139c59c36f5c1bb856c9055505f5c67b5e85d163b1fe578c292593312417a0eef5ea356124f7bd5b4ce80ef39867b1e029cbf258b12131c115fb7657d4c
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEo0u:NDqatgl9TKt
TLSH
T177155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 879KB
SHA256 959a4d45585c95136b3e487b8f05429addb3d8ad7d871130a8203848cf4a87ba
MD5 a64fa94622d5224303ea06381907defe
SHA1 42be456d27f95ccd09f88aa69a75e8296052ea0c
SHA512 a3fe96c12076e25cdb84d1ce8425e81f1860b79b17c61c197a02e8f26b93d075f57bea7e010c9af3d6563a465579fea626eeba61bfcf0d2cee2ff4d0dd44e7a1
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoFj:NDqatgl9TKP
TLSH
T11C155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 879KB
SHA256 a78ed02fe440d2296d4dd8b716a3533bd411ce948e0a708bfa97dbc76ee18582
MD5 6914d7adf283893a2e09fc44a39c968d
SHA1 72fbe5cced24a37022b84540c5a5f2eb37269a64
SHA512 55e7bb71b0186969d7d98d1f559d05062de5f935334ab466745d86dd74c8635f5f7e03c96f5e631385eca5120ac15e6d65f163765e5185547c70d7a02a9e76ce
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoMg:NDqatgl9TKH
TLSH
T1E5155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 879KB
SHA256 229b47c7341251c3dc515daf601414eec11a44896482bc0667db9322b3937e0f
MD5 77c6d17bd2562893722bcd8b2fbf679c
SHA1 ace0b0d6764163d5267fdaa1a4cadc567e7e93cd
SHA512 4f4eed31f1346e93b47840a1cccc9899e9ed1de2fbbe19414c6c85377e91e2093175add564dd26ace3364870e5052d14b2437f6fb4dc053f28c8d1ed2a10f6a0
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoTI:NDqatgl9TKm
TLSH
T153155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 879KB
SHA256 84139685e246449c13ea60274ddd2b3c7ab03c7a30078b430535a8c85d2cfda2
MD5 8959c2985aba649065b1ccf0fefc6f65
SHA1 e26392ce9cce65387f65658a66e0f9c19488bfec
SHA512 9eda03228f041a9524cf975360f6a4711b83a8e2fc4ec55400bf2e6e6c27b88addb95cdbdcfd5d7e9c88dab0502a8bb69a3c700011da739623e164bccffaf6ca
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEopo:NDqatgl9TK0
TLSH
T15B155B53BA4485A2D416023054EB4653EB71F81A1F11978F237CAB6D1F32BF0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 879KB
SHA256 c3820c3d2debc923dcd3ea252ca51d1ebbd94459d619e0af9c4e8d4bd0024e14
MD5 bd0691834bdbd99a1a3d6b52bc8d6815
SHA1 7e500e4ad12f0dd98d634fd037bf26b1076d3f6a
SHA512 545cb1affadc5a37351d4e88cee2874e88054f0b440fc94192c71898a7d62e6eea6eefa2f05514000a845dc7d390003bfea35988b48186224d5803512f8283af
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoa+:NDqatgl9TKp
TLSH
T1BA155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 879KB
SHA256 24299d5aebd9ef0de1e8f8a5d518611155160a7972f387c49f9b7f1528289e43
MD5 7be82a1a77809dc3d9e530638183da26
SHA1 ba7a706bb173271b25a74c37e6bfed29bb6b4e01
SHA512 8776012f0233a96f9311aec795631ed95a761d09499406f9063909293ec2e695137642d9cfaac4462403881461588616dd5951adb14dc0419ae6172d69b03fa8
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoaQ:NDqatgl9TK5
TLSH
T1DF155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 879KB
SHA256 68793d9f14e05fcbab3e12dfb65d358ddae0f4cf2e625d4ecc158e37aa94fb66
MD5 9c88b2681f795c2b640447663ba372d8
SHA1 d5c2f9090d8308008a9296a96d07044090cf7d7a
SHA512 352ce5d358b247b00e70fd16ad193dab055bb9123c0fe34998beaee2aa689c063e3c2f4788e485f322bcecdcd1ffad977141fe5c84d709dbdb014fd663a45475
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEorX:NDqatgl9TKl
TLSH
T1E6155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 879KB
SHA256 0313e5c0c1d6b4f7b7cbde6ce1d770d0eeefa8b738c417da20c622268aba9eb1
MD5 9c05e94d14c69cc2b51f24d8fedc186e
SHA1 824e860f1bc18cfe6faf7820f8f323a16b73ac93
SHA512 0bccfe1ed64fc0f55d73e55cd40ee4454e5a2ddeb3faab0ff15b19a17bbc867c9de84b08e9b75549ea4b54e5123f1778008ed8b8d1ad5d522facc33ce6142ddc
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEo5L:NDqatgl9TKX
TLSH
T195155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 879KB
SHA256 78c9b55dddd4e66389c9009730511050a8ba10792fe82007376495690cc0265b
MD5 6a27843828082281c69778d38410e995
SHA1 c8b758145c48a0e7e62b77cc5235dd71bf439285
SHA512 0cb9ab9a2d352c47b57e7a9b27c2f26562d2a175eb52eef1d36734d29cccec0aed21556000902d7ce478f16cdc02d92113e7a826aa79d532fe8fb9c18a5c1662
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEonM:NDqatgl9TKy
TLSH
T114155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 879KB
SHA256 fc2640a1e28f33fb9d39e17c676245830c89e1ac533780c4902333e464da386f
MD5 5e2607fc74fe05ed50837d9eb6bc3f33
SHA1 0ccab8738967d34c85762898b99c7244039d772a
SHA512 bc20ceb26f3a77c106ccce80e0d05169e7579f21204a7174ffd255e31e8c6aeef79cf7195769716d54f2ca44de7ac7f9b7b8b924c7348e98f58910fb39b64661
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaBCEoQh:NDqatgl9TKs
TLSH
T1BC155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF07B3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/924-1998-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3364-2011-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads