b33ebae00b78cec78a379a72d3a10bb0ec4d45a28151ed57a36cdf6815488a9e

Analysis

max time kernel
103s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 911KB
Sample260718-bj274afs8z
SHA256 b33ebae00b78cec78a379a72d3a10bb0ec4d45a28151ed57a36cdf6815488a9e
MD5 2a2055f9228516adb5d587c3b08a9c3d
SHA1 2da16f342f64092a2cbc7ba895169d3b647d3d04
SHA512 a4760a6a66705fe43496927a668d9d901f09c4b775f74a2f30a0df3cd0ce1dc0c929183533fd7d56289886c4935d0209b26d3fc362b6735c33930dd36bd0a53d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAa:t/sCv7rTiw2RYwZCUsjwSTbAa
TLSH
T148152A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3452-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c519-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3452-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4444-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000018a68-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-432.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-524.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-604.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-838.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-928.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-985.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1065.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1126.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1145.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c519-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-220.dat	aspack_v212_v242
behavioral2/files/0x0006000000018a68-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-432.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-524.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-604.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-727.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-795.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-838.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-857.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-928.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-985.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1065.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1126.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1145.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1220.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1324.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1344.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1369.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1376.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1389.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4444	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe

Drops file in Windows directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3452	2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4444	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2a2055f9228516adb5d587c3b08a9c3d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3452

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 911KB
SHA256 b33ebae00b78cec78a379a72d3a10bb0ec4d45a28151ed57a36cdf6815488a9e
MD5 2a2055f9228516adb5d587c3b08a9c3d
SHA1 2da16f342f64092a2cbc7ba895169d3b647d3d04
SHA512 a4760a6a66705fe43496927a668d9d901f09c4b775f74a2f30a0df3cd0ce1dc0c929183533fd7d56289886c4935d0209b26d3fc362b6735c33930dd36bd0a53d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAa:t/sCv7rTiw2RYwZCUsjwSTbAa
TLSH
T148152A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 7210dcccc700336f8298f76464420f1ead12c7ea77b927d8fb4b492db176d6a0
MD5 72aed8a35f3adfca5bf391dcbf353e29
SHA1 464797ba9647b27fe552274d5f0439b42174c535
SHA512 9b3e28bdc417edf1c88ede7961d432829c89123cf8a92569c4337d7977b72abf8279e9f6f8534709033889eabb879d8e943309a636a12c6a6ab10deffa3ac29e
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjwSTbAaP0Le5ji0hmxNrM:x7iw2TKPji0Aj
TLSH
T18E654A17B6A84661E073D174C5E6964AEA72B4461B3087CF12A8C73C2F23BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 926KB
SHA256 5e8bf47962dc8752492ad507c4ac9b6df229a504a747d5be294d04b47c202412
MD5 a461518eb9b0b54567714478e14bb85d
SHA1 357626b2d388b57051d003e082dd47d0c99c28e5
SHA512 2d2464d23ee228258d9cf8c5079f821c4fa9cee1f4cc6b1776c623230baa3374b99e5ff785a9d460dbde9eb0cc21df11f1cbd075c5add2c933966b8e1bde4d7f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaRa:t/sCv7rTiw2RYwZCUsjwSTbAaRa
TLSH
T153152A1767EC4895E5A6613089B54606EB72F8561B30C3CF12788B2D1E73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 959KB
SHA256 4c0def0e9e629a46608a883d28d44b912fa76b45c495ad1939e595949464734c
MD5 b81d68ee627ea6e617a9d135abd3145e
SHA1 b84901ece2cc683b98affe74532a3eb9123c2d52
SHA512 d974ce39ee0a07dd318d77409c0c5802a4fa3e66a00b82c376f63e4e3b99024a67b1cf0c94e93494aa20fc1f2ee8a45be32a31df9d82e711aa53ce1b10249a37
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAayb:t/sCv7rTiw2RYwZCUsjwSTbAayb
TLSH
T154253A1767EC4895E467653089B58606EB76F8561B30C3CF12788B2D1E63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 935KB
SHA256 e5ea60b28a147238f336be0f31aa51b52cbb5314785b26b4c4d0682e5363ed8e
MD5 24490c92d03e39bb8327b9c0aa7240d2
SHA1 4ff91fa24f056d8240b03c8bc8b8fd828b93488e
SHA512 94f63f1e2ac426d67d3cdd3a3d47355840bdea5058088e09ee9fb431547d39057d102647b5ea733576b60b300d0efecf12b83890e201e1df5cb7588a5afd8aa1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAao6:t/sCv7rTiw2RYwZCUsjwSTbAao6
TLSH
T14B153A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 935KB
SHA256 17b976b5e2ec894a3b23cc722fe3786bfd8a998daf685f8f7d5cfa7b6ba88af1
MD5 04c10921c94637779fca8b1859a59610
SHA1 7f421fb9cb3e9a6b0e9ec7905e5188afea5426c1
SHA512 d2fe95ef7f909db2ec141a3619fa0c4386ffaebf2ba6cbb50189d0cfe75ec4942ed9bd3a92be616422944d0a01a69b77fdc191945d826caa8cc14127e871da7a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAasN:t/sCv7rTiw2RYwZCUsjwSTbAasN
TLSH
T1FA153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 935KB
SHA256 e8aa2e33cd6e203945e5d84140c6f964c9a344bd13494ac8673448133c506b1a
MD5 524afb5afb1b305591e50bb99912d7a6
SHA1 d4f9248d06ac7e9b6c3364c5d4954a539f3ec142
SHA512 c254b1a8e755b979cad0df0643284a13764e3e52a389c858605c4daa65d2dd591b7d68b1ef33af886b4c16681cbf768c41fcf2531074f3e0d400f47d2ebc7ce0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaif:t/sCv7rTiw2RYwZCUsjwSTbAaif
TLSH
T121153A1767EC4895E566613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 935KB
SHA256 6450af7ec2e100b94494a2366d12c2b96722f8264683b1442736e226663a78e2
MD5 14fb7efc241abdb987464e52000e3857
SHA1 bfa675c4e5d234a0290981a306ec7e7a23c58059
SHA512 a820e5b1f8dcc0d1ae6e75666650a15f76ae54af651ae2a6c494787199729353910b7cce5e6c79609b5291893df8d61cee9f1ccf7cb2eb9f84de73b3a38ffec3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAa8o:t/sCv7rTiw2RYwZCUsjwSTbAa8o
TLSH
T108153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 935KB
SHA256 1afa50d34468f894c61856125bdc0d4da6f5c828e25aafe46429a3d9c718ddb1
MD5 cda1677734787e62f61a079334e8d7ba
SHA1 49e8cfab95692e2552c371734bd124f37a35d256
SHA512 9eeaaef4869105149de266043665bf27590a034e2701d10ad5eebbc3e4adde1f2019cf1cca778336067267373e1f9bb713eb1c096ce38892267e8a0d0c3206ab
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAacu:t/sCv7rTiw2RYwZCUsjwSTbAacu
TLSH
T10D153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 935KB
SHA256 00c37aeb41f9625f79d257b114234772d5a18150fd4137b6d521763ccca7f408
MD5 5a166c9ee1732fd3c492d0ab516da60c
SHA1 0611d6a6c4d5857987c22eb2d839348a7b7433b5
SHA512 e13e2d0383aeffa02ce72c53de40571debc5b14128e5d08d9be1060d0cc840f85f339dd317383c1b7d19c1ababaa7152d75afe6242b6377034423dd44d42ca74
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAag9:t/sCv7rTiw2RYwZCUsjwSTbAag9
TLSH
T115153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 935KB
SHA256 93c8e45a9fc0896b67b44029b82944d688d3f55cb363a7078b888b1379c9d9f4
MD5 0d8fe1e703dc63ef9480fb37a70623a9
SHA1 16f5b9a95e61a0a055d8d8627464163f294f85e5
SHA512 2a4e93c9465952dad42bdf0f038ba437c35fbaf15a54883c2027298331ff0b641e66ba6ffda4b04c2030556ac02b6e259715c0a2d9c5ac040c4823ff70b6ebed
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaoc:t/sCv7rTiw2RYwZCUsjwSTbAaoc
TLSH
T1AC153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 935KB
SHA256 1f87f94f6452857d32afcc819d5229b1ada0916870765c1082a582f4ca88bf77
MD5 60e16eec7fbabd9ab25025f7e2cbeca4
SHA1 72afdea94a7bf9704bb472deb8b144c8f220f5ea
SHA512 81d87f27b244f290a55aedde8867b10cd4596e3d3c03571bce06045ce7ba98e94cdd6c171cbfcdc5eef9d18e4b06220adcc49e48e39a58a862d5be24db64a0d2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaBp:t/sCv7rTiw2RYwZCUsjwSTbAaBp
TLSH
T1F9153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 935KB
SHA256 80d4c4db4b37c7e3e545c02124fd26a9402f24d4522292a948cdd042cbc59798
MD5 174c5b2ff0d04909eeb7ff2cac6fe86e
SHA1 3a9070e8104bacbab41022b527dae7c3c8edf600
SHA512 23bfaa5eb287835a8ec734d73f34ff3a5627d322837b4bfd47840206d2ca199fba19e7937bdb0a07ad3b1c9e1867ed8a9ec0c09cb5ac06200404b0e86be64529
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaW0a:t/sCv7rTiw2RYwZCUsjwSTbAaWN
TLSH
T173153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 935KB
SHA256 84068f18bf42874d4a611f85c1de1b0d637fd33ff7070f4c4c64e1e0545b3e4b
MD5 975ee8bd1be52762e5a0802a065d53e2
SHA1 6b8a79ce7328dfd68333bec9526908a2c9abf2f8
SHA512 dff74594ca66f357d6a7d52b6d775914d42d475238690634502582cec7b350237918363de9a9075e1aee6a0f8fb3924535b14b0b7cba05a9fc3ff00e911a3df2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaaF:t/sCv7rTiw2RYwZCUsjwSTbAaaF
TLSH
T1A6153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 935KB
SHA256 c388ea558e75071dd1099ca83cae21a9d9a7d9d6dda501a00d202e67f3647f82
MD5 e3b8edbd61ddd2dc68b24a62eb2c5fbb
SHA1 4435439c1c108ac8e7031ef41eaa038c44bf11f7
SHA512 bb4da7172c5f8227f4b7b8074826d5f6cc70b42d7518f59d8ef6c1e3a406af33084b312ddabc317a9d0797a7dbdfbfe0c220aa6a63f4c1c1672161ea9cfeade8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAavC:t/sCv7rTiw2RYwZCUsjwSTbAavC
TLSH
T1ED153A1767EC4895E566A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 935KB
SHA256 7f054e2724957c82238ee8781010793ac916912d669db1bd288f83ae252a0639
MD5 cd889705f4c128b6a5be31e8e54a2e5e
SHA1 e757c8de6d802c5210e010610b09a24ffc03b39e
SHA512 4b85e370412af08ea7ecb815a1efd678c22d9d96ce991a86b75bf198f00a043e3fccbf1008b9b02cad33968ddda1210de9f76846afbc52e7e58a2be40a95762b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaQw:t/sCv7rTiw2RYwZCUsjwSTbAaQw
TLSH
T171153A1767EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 935KB
SHA256 6a2ee1f356f19df4051f5a4297c808ae13168a265a9c1540bf13e7e8f8fa2c8d
MD5 9f67e2a55d4d0adf4cf473f2d38f4c9e
SHA1 41ba8e2b2bf9613283aadfed5b8ebae2772c0a25
SHA512 5f146eaef67ae38ac33022c6a7c0ea1ecd3ffd00a8d954507613fadfc9974f90a107e6885c0a8d5375e0585ac6b455a33495790bd90616fd5889e16e8d6d5729
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAavT:t/sCv7rTiw2RYwZCUsjwSTbAavT
TLSH
T1C2153A1767EC4895E566A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 935KB
SHA256 1a8d7a86b19135fc24e3dbf3dffdee79647f363b727092405a846bcd94482623
MD5 d4facb2b850ed458ebd6519138d73309
SHA1 d903571a6ba2a13aaac645058253411a6e41b8d6
SHA512 fe88cfe305d57b5ea28445ee70e7b89964cee51fb0eb32f57ce2d81154cebbe5cc8ba24b801ee323de399149d505da36c6f5cff13d08679a3ad93d748395ba3a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAapu:t/sCv7rTiw2RYwZCUsjwSTbAapu
TLSH
T130153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 935KB
SHA256 30ee2dd8e61e97ca1f987651c34b94c135bfa44ae1253354ce078b43ee5ee075
MD5 09fa5c0cc1448ed0140981855a5b4a03
SHA1 b1cdcfa547611d038507bc787152bf1659ac7f92
SHA512 a56ffa7b7f1cac8becc0dba482e786059dc749292d8a3e436f60b1c313746a4c97dc234af5f0e29127ee290001b1d81c6c40dd8e02d51363ea326f3deab8f325
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAahb:t/sCv7rTiw2RYwZCUsjwSTbAahb
TLSH
T18C153A1767EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 935KB
SHA256 be15250ddbd963663c43aa23d58b29cbcdd04488e78be12a830632c8bbf1c980
MD5 c2fad3ea5c362677585841350583a15c
SHA1 a61458642d29e6adaf4871f3771189e9fd149e9a
SHA512 c73ba15697bdfefa5cefa174c355edbbe22053fc773cdad1f014342d83facffc34b091420b87ce63562f8c1d63315979fdf26f4b037bfb72dccc219408a29aca
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAapf:t/sCv7rTiw2RYwZCUsjwSTbAapf
TLSH
T1C8153A1767EC4895E566A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 935KB
SHA256 58aa498bb9ebe22740c66d00e72e0194acef32dec298a277d1d8e6fa9a3f0679
MD5 38ccf45061b5f58f7f8907003e2ab545
SHA1 02a6510d3e0e200b90cce0ee4bee985016274394
SHA512 64d82232263d36048bbdef80e34d8620867a855c3027e64cc25e2da0c74a2e7c338d5f9989970d04851e985bf03d53c836748276234ca03413e5745a723715a2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaSK:t/sCv7rTiw2RYwZCUsjwSTbAaSK
TLSH
T14A153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 935KB
SHA256 2eb71ee09c54b10010f343d3f1cdf13e62e7242bf5a2386f753d2710e7269569
MD5 1fb0c1200f827c44360828156a9087e1
SHA1 bc1e10509c30ffa12bba1cf4bb523d3485d02f56
SHA512 a3bb541a38c13a4761ec93b1b4deac2d5c9d05c81e087401e1a1907269ab9707071a021417152574375eb84c49f6d0f5a35331ded733c3e99db2e629eaa90332
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAa3k:t/sCv7rTiw2RYwZCUsjwSTbAa3k
TLSH
T18B153A1767EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 935KB
SHA256 e5d6de2566fcf38073e63bfb0a375ed058dddd3c9ee6b8dcb4d2ff5175a80b8c
MD5 b2c9440681d4926e54cf0c32c869f570
SHA1 c7b05bece5ec6a0da7be423ed2233a267fa8416e
SHA512 08e82d302c0fd437094c1e0c71512c3a86b8d30e2407d203804d005b1b135f126b6de3ae17d71e028740cfa3832ba3d4ef84e93c21cbd0ee8f415f6f32fcf14a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaA0:t/sCv7rTiw2RYwZCUsjwSTbAaA0
TLSH
T188153A1767EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 935KB
SHA256 f2b39d768210ec1960b32cd7bdbd8b833056d2addebe6d24c1c1bdd34b3c3cb5
MD5 4aa0614195412a83ca2378aaa1483ed4
SHA1 e6c0bdd61921507998839023948eb53030da285a
SHA512 514eb006ca5f968cbef75d811979f0beb10ed3bdf35c8395c4ee7afe78e7abeb23f8f62962a8d1dd19d7e0e310e402c66dac2f4596bebb6c91c48e74235ef8ae
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAab70:t/sCv7rTiw2RYwZCUsjwSTbAabg
TLSH
T196153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 935KB
SHA256 18ab6b84f0f8d459760c95416efa3f41b03fac8d7c51abb3275f16d648691043
MD5 9419fa10d0042027d6254b41f639b03a
SHA1 90215bcbbcab39a1da31960b2314b5858dfebf4d
SHA512 abbe9717aaa3a069c9a240309637e42d3e7655fd347a3cca78218a2d062a1b4ffba2fe371495dd294e2af79081c172e85a79c2331a669351ce8b38d51e2a2656
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaWr:t/sCv7rTiw2RYwZCUsjwSTbAaWr
TLSH
T184153A1767EC4895E566613089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 935KB
SHA256 59ff4d56528ce825391e3c72408667b4ecfa874f4bd4b229faec3f49901401c8
MD5 ef715ad6332f0926d69f750dae3016c2
SHA1 5c5331f2283810e0e9c0a77de74eeb01b3754b7f
SHA512 1b3c5322eab5d954c58c58399291b2f643466e5e3627767e1ad67d687ff67786ecb3ed8af1dfef4f553057c6c415dec88668ba4c8b567945145a4bdcbb273d09
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAa8n:t/sCv7rTiw2RYwZCUsjwSTbAa8n
TLSH
T129153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 935KB
SHA256 0e9126e731ee12c4e1aecf5367c381d0917eebdef8cd1a25205ed5964c5c0e2d
MD5 0f52a971c4d05ee8ff1d21bdc195f163
SHA1 9d41435e25f75a114f05f5618c377b366765c8e2
SHA512 87ea20f8842d96f9fb87289f0df6a1e1be4fda519ba95091ff239de8ad9f25ba212faea2694643156225f543296e16fe479443e661c060d7213171b1debb623d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAa6x:t/sCv7rTiw2RYwZCUsjwSTbAa6x
TLSH
T13E153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 935KB
SHA256 8e2df6c6dca2c67ad158e6c80c7e11e3d3df435b586fe70f9912f94fcdcf190e
MD5 5b6236542f48c3635577865fef4fd0ed
SHA1 62772c9dc1f6b580e86d6aa538045db117112f31
SHA512 694404ab2862c91a04c1fa3626313e4e473e9a0705b57ed87256879540700010fb72aa7b2539f0995244c101c62ea8eb8666b73ccf6fcf2c11854573d06208b2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAa8A:t/sCv7rTiw2RYwZCUsjwSTbAa8A
TLSH
T1CE153A1767EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 935KB
SHA256 939a6a3a7dfb724624792cf49092fbe9a9d6d56c2d3d77f4993a7bd18c061853
MD5 8a95d1bf773e56aa7cac82700bcd24bb
SHA1 078cd468256b8f38445ef1833bef34822e8935d9
SHA512 7614a2289ca455340c9d6c4872654c5e02c89b0f13908c4e69e4b4a75afa6773c52d278cbb13352f78d6c503c740055bcf689fb0a69200c8ed2785fa3b61087e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAal9Q:t/sCv7rTiw2RYwZCUsjwSTbAal9Q
TLSH
T1AF153A1767EC4895E562A13089B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 935KB
SHA256 e4d9176b38f6545d68b493da41260fb8dae3bf0e0b514abefc6d4815100aae7a
MD5 9c88a1a847d69b3dfdcf8b2327d752e2
SHA1 d04c14e7e0a58d893f7aeda9328d0fe42db54e89
SHA512 de8100d1b5eb49d4217c2763b745c13135019145cd85a9cbc1c677e958bd02e0abf9906e19b5ccb96261177ceb027ec18ae85cdc2a94205a5ed14416697a546e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaQ4:t/sCv7rTiw2RYwZCUsjwSTbAaQ4
TLSH
T13E153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 935KB
SHA256 e5fecb55191240bcd37c008056f3d9fcce19f549178d1512905d297bb4ed0cfe
MD5 9f395048e39ab507454bb8cacd7c60ca
SHA1 9f8dca15617fadf6774308bf6ec417e86f0e50c7
SHA512 fcb16b1f85e13a10719db9cc639307f397d9942d246978ca61c9bfbf20f32da0b9a8597c39255f5a4d297cefa9676bf0dd21603edd1dd4160fa9a8ce60c5abdb
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaTu:t/sCv7rTiw2RYwZCUsjwSTbAaTu
TLSH
T1BA153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 935KB
SHA256 f89ce4abffeff00d4cae4f21fbec5071056aa313bed28a856d6b76c597e43156
MD5 aba90c2ea2233e4b6d90bdd6ce24159c
SHA1 fe51da15cbc913db0fb41c867ea230403323fa50
SHA512 6d4000d2767251a3e340b94116f8a743da5bbceffe1042bacc54689255d955c5ee5f429c004d45ccb74199edfb34904263f5e5876d6d6b537f7aecf5f4164643
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaOj:t/sCv7rTiw2RYwZCUsjwSTbAaOj
TLSH
T1E7153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 935KB
SHA256 c542d817b73e17baf550b4ccf963dbf563c014492052d86758ff503ea8324dd8
MD5 d245a6b1a3fb94a99972f5e975b8e101
SHA1 7876859f48cf7b4bd5a0935e9e7b0cf65fa6777e
SHA512 b74f06dc4190276bf49be1cad9bb446958a370681e475719474c0e86d2cee60987aa3bef3eaef4b0a8c8a297799157fe71c8fb873198a5dd3cdc72acb2db3fe8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAa7g:t/sCv7rTiw2RYwZCUsjwSTbAa7g
TLSH
T113153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 935KB
SHA256 2ecb44ac13c7eedc6f9cca9e3ec2c2379d5570e1fb8fa067b1938eb4b6a11a7b
MD5 94c89d635be1e5149625d1b957ff387e
SHA1 192cbeb270e79c98d67119e71fdfe13edbff9ca9
SHA512 235ac8f2e22e3c465cae2fbd832f98daa5a6deb11813c87530f9c0a74664e8e9bf7dc0e242254406dd8244f3e9ce4f1c90206501fd7e50fbadf36016fe3aaa8d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAamI:t/sCv7rTiw2RYwZCUsjwSTbAamI
TLSH
T18A153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 935KB
SHA256 0f6da3ae236bc6408dd67782bda461c92a32c2918b3cfd19b8fcd425d548cd4d
MD5 df197e523c5d687f93b1e1570c837dd0
SHA1 751aea65edb4b5495617ead86e28501264367618
SHA512 f73a1fb4cf25adc9ae2d955af1d3b217bb46917371ab758cbb4fb9e6e43c8f58eb93fd717583a77505e9ad62c0db7204c0e386493f4849d6d2f012d015c7f1a0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaUo:t/sCv7rTiw2RYwZCUsjwSTbAaUo
TLSH
T1B9153A1767EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 935KB
SHA256 92e07429180988b4d1db366e18006063990dd27dc4f4b81bcf0bbd45d51b824e
MD5 ae99be9714419d20abc4209a875685ca
SHA1 6750fcdfce1af1f55b4c75a966a920223cc6b88f
SHA512 3389916aed62709117f6a67046fe768879aff7269fd888c95a1b5627ccc076aa94193d302468668ca66f88fd295041c8e066e5e0318e391ca50fcc3eaeb87fb3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAa3+:t/sCv7rTiw2RYwZCUsjwSTbAa3+
TLSH
T12E153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 935KB
SHA256 bef4143af4e1d22548b3056abdd4cd401dfa3a3bf5ae7838b24bb6d6baf558a7
MD5 2905144353bdaa3dcf14069e018ea728
SHA1 bd3753a99930cb4b1489dc381924dad36767e72c
SHA512 bf480d66a0bc58fa86a739d63908aff7344e530cf6c5ed02d4523663e32f12ac3c218d859a88f6f755550fb4e769badbced717bc4a77713e6713eb55cdf6f955
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaNQ:t/sCv7rTiw2RYwZCUsjwSTbAaNQ
TLSH
T1C9153A1767EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 935KB
SHA256 1f45d1c5afd4f10eba18efbb1859f6c9c0adccece80d77e0b51cb9993dfbaf8e
MD5 c26a3e0e7155e0ddc776719ccf925e75
SHA1 90c599da763f136c8a7e9626c3add58641e680d0
SHA512 711bbc1d6cf0bd10697bf1cc158591928f61e4c9910c642962d622c6058c81a57eab21e9b6b4e0a78a233df5928c7bd84b7163520170954e5fd77078f219cd77
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaCX:t/sCv7rTiw2RYwZCUsjwSTbAaCX
TLSH
T121153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 935KB
SHA256 ba9efb2880c2d3e8f65a6277117b6b5a499cf05f92213263590c7005dff92ea9
MD5 5329b72729b06924ec3bffaf1810b806
SHA1 5757d0bcc36afd1828ef8fa6a4cfc95bbba398ec
SHA512 8ccd1c9f243fb6128c20b739bd33f32739d93f9a609e3d898cad6c969bf10d0c3114d0261f3c98c4927c6b1bb7038b19f0e69dba70fee26a64e818f494247153
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAakL:t/sCv7rTiw2RYwZCUsjwSTbAakL
TLSH
T1BF153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 935KB
SHA256 5002a24aa93146ce9fc6e4abfcbe019be04655ccc830a928927c732352671724
MD5 927174ba09db54c8628cbf7c6a87ea8f
SHA1 1287ebdcee112e2de82d0bce5440404c5923e1ba
SHA512 d0e051d01d9e1d4f3bd73871f87717b87fa232d92a87cea2d26e687730656c2c03e5efcf2958ef5faec72abeb3ea5aed3cb05c2358b874df38d61bed25bde0e8
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAaAFC:t/sCv7rTiw2RYwZCUsjwSTbAaAM
TLSH
T1B8153A1767EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 935KB
SHA256 ec26709dc0c91e5176a47854ca2430e6081b5cb107096f62f6ad4fb3f2cd0f44
MD5 cc01d4417426baff7317489cd662c8e6
SHA1 a5bc036bd8f867649ca84618cbcca98e9ff80e71
SHA512 d6a470ac2897768ad31a9533491daa7ae83bfa4cd56e8fd5a16c53d907de0abb53db5f450f88a3d4fca02b35c6e826e1416fdf84f5c23603ab156e1833b3c52a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSTbAahh:t/sCv7rTiw2RYwZCUsjwSTbAahh
TLSH
T1ED153A1767EC4895E566A13089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3452-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3452-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4444-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads