2d35a5fb5ff83dc4029fd9e4f6ae843899bdee2cd7b5552ce91712aba163cdc8

Analysis

max time kernel
101s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 915KB
Sample260727-maydbszzht
SHA256 2d35a5fb5ff83dc4029fd9e4f6ae843899bdee2cd7b5552ce91712aba163cdc8
MD5 87a4bb38731369ebb56096a05e161145
SHA1 7baf32a7a42ae1a9d19501060bd16b77736fe500
SHA512 0c8e70e6e7be05c5232e4d657ee1c790a6d7e0883ef59f8a614ed5533c0569edcf921027b4b1e2961065605cbc453761f63de756f96ef45594d69b5d6bb676e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/C:A3k03kHRJS
TLSH
T11615AE13EB9500E9D10AC1749AE68A23EB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/4932-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c551-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4932-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5860-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188c8-198.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0010000000017618-253.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-472.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-717.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-879.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-906.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1086.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1161.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1291.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1353.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c551-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-40.dat	aspack_v212_v242
behavioral2/files/0x00040000000188c8-198.dat	aspack_v212_v242
behavioral2/files/0x0010000000017618-253.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-356.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-472.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-498.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-601.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-717.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-879.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-906.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1086.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1161.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1291.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1353.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5860	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe

Drops file in Windows directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4932	2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5860	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_87a4bb38731369ebb56096a05e161145_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4932

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 915KB
SHA256 2d35a5fb5ff83dc4029fd9e4f6ae843899bdee2cd7b5552ce91712aba163cdc8
MD5 87a4bb38731369ebb56096a05e161145
SHA1 7baf32a7a42ae1a9d19501060bd16b77736fe500
SHA512 0c8e70e6e7be05c5232e4d657ee1c790a6d7e0883ef59f8a614ed5533c0569edcf921027b4b1e2961065605cbc453761f63de756f96ef45594d69b5d6bb676e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/C:A3k03kHRJS
TLSH
T11615AE13EB9500E9D10AC1749AE68A23EB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 7c44c20453157b7f8a70788d6f50d89a28028b49b4fc5f87ba410d619ff3f160
MD5 82b1537b3a9ce64b5f9e3ab0a0657818
SHA1 4fa6c9bf6ad211f32eb6171e0b4316849269fe60
SHA512 3aa7efe83b51e1b2156c10467572fc5603694c88a557d44112c4e7f9083c53c9fd8194854b0c93bc8a328452f3a0d74f54a5bbc42bf44e94f3e21bf8747d6592
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/C0Le5ji0hmxNrM:A3k03kHRJSPji0Aj
TLSH
T14B658C17F6A402B5D027C1B9C5D69A5AFA7138821B3086CF1359C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 930KB
SHA256 8b5a80776a1458fc94d1c66645d77392adedbba03fd0aa59065b5c202145218e
MD5 84205d5192ccaa506e7dca23af644c51
SHA1 4734497ff10a94096392be59d25712b7918ed75c
SHA512 a526df5a29e66a072b5d1509e92d61adbbc6aee7f27c85ae8afda22cc9da5029581390c5d97a616d4178788f9bf3f9347dc8a8c30d17422a1f53211ac1056b00
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/Ma:A3k03kHRJ
TLSH
T1E215AE13EB9400E9D10AC1749AE65A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 939KB
SHA256 48f1437cfc8922cea906db69ef15d71dfd0507a08e3dde138598c7904c322846
MD5 c94090c285788a51291f456d9e744359
SHA1 2a5df3017977eed26a948b43ad35499e3c5ded54
SHA512 c4ebc73b82a5e6e707395ee9b6d99b5de2d5f2c3bc26cf6785dfb1ecb49ea60f4a916767ee8ea0405f46fe3cc9253a3879feae12bba1100d40ab6e5afecd1527
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/GZ:A3k03kHRJg
TLSH
T19815AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 939KB
SHA256 314ed170dd7129855723e405866604511f22be963819d0624b1fd77b66643a0f
MD5 5a39278422f39dde05fa8851617401a7
SHA1 bb6fcbbcb88d6dfb667ad1450170d5221e7ae735
SHA512 f2d0ddc6a609e563ec353aebb76c9ea0fdf9004376c609a7d669b40d8273e3276c338cbeb7afc5a89be39767e5a638b213e7458bf085557da262a859deb1ca87
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/x1:A3k03kHRJ3
TLSH
T1F615AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 939KB
SHA256 44fc7073997d0a33d11c4ddef09829c3a2a657cbcb8ea77c751ada76cecc132e
MD5 aa03de14f71df46f8f1b0f5f157af887
SHA1 e00d836ec735811b9e010066f16b223a016fa911
SHA512 45d0af315f3021568bd54d9ea906f3886c6ec93d548ac8c2a5496cb47311797a70c877ec3c33afb0187e2c1ee2a9bd22f6983465d1547030334f74151322ceb2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/l6:A3k03kHRJ8
TLSH
T19315AE13EB9504E9D10AC1749AE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 939KB
SHA256 0d78329e54aa6aaee85bd15361be8d868ee08c3e61ffca0a34b4ca3fa10f48eb
MD5 7ecacf8fddac70342a0a73a21b550bda
SHA1 c2c13a2fa83ca64d00cce5ef131f83bf7e5ca7c5
SHA512 c8488a77bb13bab8a1a63d9ae4d7ade49ba6edf9b8e732e06dde3efcc8c11f6b2dfd71be084f65b7b40511e0fdc7a87b779c79ae1de09fa66f12d3f77de0ecb8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/7N:A3k03kHRJh
TLSH
T1C615AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 939KB
SHA256 0ee71c2b49937ce19edce043250c59bc947c9c7652fd73643eec0cf04fc12aae
MD5 08e34706d794917f5cadcc20f500c6ce
SHA1 246f12158078f119a6382a921791167447bfb598
SHA512 ba6d2a48e1f48cfe610eb56c09bfd2251e210371c171409eb53ce6e14488b6602e999880e66999d4c447572f53d8ff734597c296d697a633a253afdd0b7cf4b2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/Zf:A3k03kHRJB
TLSH
T17415AE13EB9500E9E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 939KB
SHA256 b89c73214bc384cf8be6e0d043ca2be7952775e63374576df709983c621522ac
MD5 7c087ddf5d328f987b500c55f08b863d
SHA1 282a553d8d694d4948896abeb6357d95a4850734
SHA512 fefc7ba80b46523745b39f839359840fd3f89f4d465b7bf2082ae0dfc49da8d78a98dd44e542231b3356e2de079a731eee4b0cbcc39db9d9718b114b41bac1cc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/bo:A3k03kHRJU
TLSH
T10B15AE13EB9500E9E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 939KB
SHA256 e94b4258360e03923dbca0a54b60acf23d05824d7be09b5d8a57c8fbda8a65de
MD5 1ff35ea254340a21f1d61531c6804a14
SHA1 98a50c3530157625e2d4bca5e16f94263c8350d6
SHA512 cf7abfbaef5f311c1af611c658fdc3c9ce9099affb5d2e136e79c5fa7f26088afee72dfc4f08bba6c37274fecfd592a86967eb238a964f8ddb95a850f3ce04b8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/Pu:A3k03kHRJm
TLSH
T14715AE13EB9500E9E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 939KB
SHA256 c5753d167e3ff8b531ec809fdc5f164cc134a1daa33adeaab659d4d6076fe7de
MD5 8ef61ed69c98f23151e505f26f111a9e
SHA1 a19fb3884d28a01bbb3dcba2a8c4031b6dc4e5af
SHA512 2a53b58a357b15001b9d2b24954a4b2952e7b9eb641904dc678d12a124dd344cf2128c6e3414ef47126ece36f9db263f5f35a189418e0fbd936c439b4ab4a9c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/d9:A3k03kHRJn
TLSH
T16415AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 939KB
SHA256 2f0b70ff744abe6c02fed9fdde7d4378546ae9d6371b0301007e25ef8b8f72e8
MD5 48e1216405cfb2fc887dee8f5a5995bd
SHA1 9cd15d32da81ab88423ee173b4f998c616fe4fd1
SHA512 196bed2225b15d797418b3802c7d7db9797299fbd9af0fe5411d40f96a8c473bb22b468a1467e693a08de20d544ec3bfb2dadcb6eeca22f24d810806027268f3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/5c:A3k03kHRJ2
TLSH
T1C915AE13EB9500E9E10AC1749AE64A23EB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 939KB
SHA256 f5b5968cf4f0c52aba42281c365982f6f3453b67e1bea5a7ec8dca264d2f49ac
MD5 08cda6ebbfc8a7ed194a464bba2ba3de
SHA1 fb693e433f59381da9f24a2a37b50e438ffb4bdd
SHA512 ca383f1874bd887b07167814230c8a7483e98e9ca601a9a4db6d444f1492d8322def54f71f2912e1e7e6a1917339a75085194416175199d286bc3d03b59f629a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/yp:A3k03kHRJk
TLSH
T15915AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 939KB
SHA256 6d08cf8d1921d7aa7a3d3531147a296f92e50fc99bdb51dbf65a6d562c74d9c7
MD5 8f9539cfb646d245a0ddc34cdd68f0a4
SHA1 64c8bdebcdebbb244bd1af1c3f20983449f9f9ea
SHA512 5781b7ef8d0383aa316852d1c3ffc914d60c2ba9bbb6ca215a110304b6a5929a5cb7a7043a7f607cba2844b76eebc367e2d330acf217a8b8b495c4a7e5eb4cfd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/FN:A3k03kHRJT
TLSH
T12815AE13EB9504E9E10AC1749AE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 939KB
SHA256 11f7f93ddd1d0003c5f84a7fa0644ecdf8f0340b404ed2cad164c5858923092e
MD5 0689572efc7040a16efa505738629201
SHA1 e8738c91ac9807a110497b2759816ce721cc5e9f
SHA512 3fcdae4aa3e9b11e2013367218fb8355fb9b64bb4f9ad5a25a04bbc460dfd423132207dcfd17884a8c354c8ead18468413231b0640054970d8a86f5e5a280ae6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/XF:A3k03kHRJl
TLSH
T11215AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 939KB
SHA256 1d9b0c29b3eea569ca68df57afa4ed6d39100d7df87efcb40499e3e9177503ca
MD5 e841b67c128bef9c9b2b460ebb7b2c8c
SHA1 69ec4fef66774823b555110a1e7bf610c27fe460
SHA512 c800cc09b7fd3b6a9e3d6721317d2470d30dfa72f3859adbdc3f847b36b0f50acc15538ad47b5addc6b72eebfb69c1e3b27b30fba7fb8871c948b0fa8bff1dbd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/oC:A3k03kHRJJ
TLSH
T17B15AE13EB9500E9D10AC1749AEA4A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 939KB
SHA256 56c463e2dea182702f785986ef919896ae9115539437a03060692a0733480d9c
MD5 99128d481367027162f5160f24a0e406
SHA1 cd65ac9a7c704cce5a972162e03d600e56b71cf2
SHA512 f575a041ca4cd98499197413294a63d61674adf211d406fdcadbb35d75fd852ad59c7c171431e5bf74b46f2bbefe110a5f22b86a12901c122c51a973379e3ffc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/7w:A3k03kHRJ0
TLSH
T16515AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 939KB
SHA256 001dc7cb176e03090c72ed73d0c1fd86cef2d21aea0ff380363042aa1be4995c
MD5 aaf4bac7143575aa9ae5af3a0f1eaeb7
SHA1 901e677aea0f6ed43e405bf763af42923bee599e
SHA512 56ce5b0fede8ccf985b2f570fabc8d18ec7fcc85f8b0b650d01bbdf08cf8282f8e63719ea5643b36182dae43d905d061ba09872219889e91259bf0afc672adf1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/CT:A3k03kHRJc
TLSH
T1E915AE13EB9500E9D10AC1749AEA4A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 939KB
SHA256 27a9ca7a71453bac98b46d6c657fe03ae7ad194ac1b15f04bf88295543d5496e
MD5 42f7594ff02a504c98c95e72bd47b0a6
SHA1 80a4e45f51fc235986ad93be0759e721f165cd3f
SHA512 af8f21535ee0edea0036852a7783ce69aee6a0d0b36b6dbc70b94545a4d0461628bf4c893607f9603600bc4b02e634d9fe7b52d80eb418fe3aa36f0f8686dc65
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/Su:A3k03kHRJ7
TLSH
T11715AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 939KB
SHA256 e4d042b6730ef9e99ce323bd6b0b3f3a3f409ce15de35fd142a42f5c296fada4
MD5 b68be19298c7a22686f41eba75318ba9
SHA1 58fd0dfe8a896c9c146fa21cc74e684437ec07f7
SHA512 9e41addaa9842c0c64e84e9fe22a48140b9548b4d6b5bb8a63e693c2ffc0bc94f098748ed3682e9e65ca279c94c74be26242da57f972c7abf83ef077cd5f6b36
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/Mb:A3k03kHRJS
TLSH
T14815AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 939KB
SHA256 40c0e0599c962def4d2249e37548d44fc74f25d5d4256f36f036052643bfc561
MD5 c1e80c06d76cc69e6ab611d03f2e0c5d
SHA1 fec8e441ef7536323e62d39ef86973b43bc3f4a5
SHA512 d85ec83ed4eebdd3f8013803fac60629e1afc85977aa30b497ccf244d2a286759925bf8b2ae30600754a87a9b81e5c78b5480134be8fa0ee34ee29b28d4bb6d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/yf:A3k03kHRJy
TLSH
T1E915AE13EB9504E9E10AC1749AE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 939KB
SHA256 8f6024db82c6097f20d40e5249ef8f7a9f3e25d74f3ee78950a0496c250b1868
MD5 7b100121acb1854e10187826e57737d3
SHA1 25d18a5102cae795052834b1f7eb6f48a40402db
SHA512 cf311d2cd02328837a31d300dcae2fb8982573f6026212e2bfcf6cc614f703e65fc5077c06f8f35ec5b5a8614fb85f1c7d8489202e2f2d6132dfde9390e6a625
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/fK:A3k03kHRJS
TLSH
T1C215AE13EB9504E9E10AC1749AE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 939KB
SHA256 c666e3320ce8cd1708e039e757898e1fd49923ceb0d983e94541e24fecf54d80
MD5 5e3503afb49bd64fb93e7bfc8d9c89cd
SHA1 dbd75784ac3030adad48d4a8e6a2a085f52aefaa
SHA512 e5b69e08cbbb581da0ee79e16a7105db1aff2450c93706229d0375f9b0fb16514709bf23188dc2b6132b75807d3028c479baa7270ba1a80c5d29e09f6725c85f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/4k:A3k03kHRJn
TLSH
T11715AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 939KB
SHA256 4b89bef24201d3e9f00753ff5f5556f9467c3308c1fb8b4262b9d3f9edd94f7b
MD5 76f4823bcc1af87d5e539ef025f397e2
SHA1 fac4fee5ccbb718031bd1cf96c41b8da8082bbb3
SHA512 592103a7674c89d06aae845a7d0e0e9d7dc2e3c417bab472212a4750187bd14ce78c415601fba1365e13d1178e7c0199b23a6b80686c66d3f7798a15e8b64b6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/50:A3k03kHRJm
TLSH
T16F15AE13EB9500E9D10AC1749AEA4A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 939KB
SHA256 5660741797c52b277a666c82feae9b87ef3924156d95f8bffbba4136799e062e
MD5 ebc86d9a85fc5c0ed70d86d173dcb50d
SHA1 93fc19d70db50ee25373f51474621f03c3f46f38
SHA512 632cd2b5a42b2e6f5ed55558e630f022e1a6a4ea82eed8cd1922d484cf91a935092775a3869f2fd5305689b134f26e453f769cc816c8a2107f51e4fe770dd3d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/sg:A3k03kHRJf
TLSH
T17215AE13EB9500E9E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 939KB
SHA256 f63a13b3c011648fb9cb68f28289852cc379e0a10a0b6ca70dc46bd409ab0c03
MD5 b9500c31d4a16502a655b51c009992b5
SHA1 ad6d9751ded3ddb2ed4fba3df659eef9b795efd0
SHA512 e42e40bd4f43ad837264b2e89445e7a1bcf12184c1a800bd92d0f6ee4e684b99b8519704c91ad910038373b4a697f69c5abbdba6e688d87674b3f330287983fc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/Jr:A3k03kHRJ5
TLSH
T12315AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 939KB
SHA256 8a55cbeb1df3aeb13918db4b281d182f880106f47c7f62b006ab7fac28ea0916
MD5 18a6e0eab1f1fa9a9bc6b383dccca02c
SHA1 87acb5a3e273df149dac269b38ba6769156218ad
SHA512 e489c418e302629724a5c6d62942d4ae42f690022b3557b57fd6215487fcf727fc1b1c8308139e8d467e1b2d575f210cccf4e0e57be51421747e26d34a2b3fbc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/rn:A3k03kHRJz
TLSH
T1BA15AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 939KB
SHA256 871ded43f29c5e2028ab59723453c775c3a38e794095ea9455a2d96f5bf185d1
MD5 9709ddbc45d64a6ef493bce9bd8c4834
SHA1 efc51621f128e44b5b7441e3162f211ccb9f3f9f
SHA512 8024d3370296349903d22f4c639a0ae701ec1ce10973f6cb00afa040cbcf6ce56489742d0d8e0fb473b45d5fd1bfebfe4cc88807700d86942e26919142ee90b7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/3x:A3k03kHRJx
TLSH
T1CC15AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 939KB
SHA256 c9f93c879153d993ca6c968327cb0777819da112efaadc7bd821d0413244f36b
MD5 e1b9c8d75920f770e879524aa96e3c8e
SHA1 b5b75a80f75fb492ed8070b591925e4baf6ade49
SHA512 a2c94792bdf1f2075b085cf5c398c36383527b112be76925a13247b5a8cd66c505378add0b9bf901e4ec27b988973eaf9e4cf0b3f6044768b377fa1f64aa86b7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/tA:A3k03kHRJe
TLSH
T1BB15AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 939KB
SHA256 be109bead151ae3e9ed36394f196a570dec1c6024a7128a2954c8f23f2b75ed3
MD5 9d679cdec481ef700c17bc430a6163ba
SHA1 8ae32eb9be92f14a7e95a3fe88236f487af342d9
SHA512 4664b1c08b0e4e4f7120329b62f588fe7e6b90814a301c89da0b6cc361158dc59e786f93967e8660430e4a947a99ac09246cbb9ab9796f7ae3049ba5416bc81f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/m9Q:A3k03kHRJD
TLSH
T17F15AE13EB9500E9E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 939KB
SHA256 1193cb7faa5adfcbfe6f7bf137fc418f36da6d416830f1e62f98f79c090b5535
MD5 1929d4b47d238fe0d7072d86f298f16c
SHA1 848c4ad07e42265ca82f12cd558a4163c6fefb2c
SHA512 65cc1ff0371731c10a14096f6d2589c057f84123df98c1dd9ce0e5fc2a035d85cf276d2ad79abc5cbbafd0a7dd8c1aea52ce304f35e6d8fee0bb7491d0e8c4a3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/D4:A3k03kHRJk
TLSH
T1C415AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 939KB
SHA256 d3cf7dcbd76c5e35d28958843fd1b51f94c7a4d52f32c436948ce9df00fd4195
MD5 8e1262a4890296132246acf774fbd7d5
SHA1 162ddc6a5ce0f543e4d38688b2393d121d331d7f
SHA512 0f15e12311fea482b4fe89ef3aee5344f54eacad4be9da6a425814a4cbf183f1f03d8b13de09dea6c05a9adc336fa42e744ad337c26370c9095df353c3810adf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/qu:A3k03kHRJV
TLSH
T10915AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 939KB
SHA256 49da5b0804acec79ab207ec6788fc3b8160511adaf067be869841a0189013014
MD5 a9afcc4fbe8acc99e74473f148dc7784
SHA1 fbd8ba8db17e0951c9bb44beeccd1aa450dc71db
SHA512 dff741cd7206f6a28f827bf71c143e162333e7b85329f69481a301d59676f6c1fd95b8418af4a8982eb31d1c604964e2206c52c13c5eda5b0fa358dc810d0a1c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/7j:A3k03kHRJ3
TLSH
T1AF15AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 939KB
SHA256 5840f3a474aec255c0f8ed52f8dacb545d3c11672478d3ec67515fdbca280e81
MD5 76a3abc435bdfb793f9ea573d77f772b
SHA1 3c3703471f4810258a080b6ed7480b2b2b2211a8
SHA512 32466ee2d8f0680f4be23c9edcb914859723598be3a511f07927e3bd11a742ccbd9f2366c54516cf7d8502735476f52ebc37411f8f4c4b2f6d734cc60fe3a16b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/Gg:A3k03kHRJf
TLSH
T1E315AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 939KB
SHA256 2f6f8269b65263909a6595fd9b472cc8cedbdfdbc86ee48f3db3956ad12dff90
MD5 4fd0c9fbdb492e2a074d73d9ba45f4ae
SHA1 89a2dc4ccb50491add740a014109376b19d2960b
SHA512 575c16b02f23e23267ec68b3f2f2a2c91aa51a9e8ce4a3fa0cb3458370d8ddeeaad00062223a7f49212bb32d52ccfa10b4e90172fa8e682ffbd29b35ca8086f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/pI:A3k03kHRJO
TLSH
T10515AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 939KB
SHA256 44bda01d3d6b527b5e65b4b4e2cba236ccbd1d1b1365531d060d1806c65f9075
MD5 2ad85a27b27ea3eefb8d1e85ec432dfb
SHA1 e4128e6842976f130cafd7ec16219521aa6a3070
SHA512 47b9291c11f47570c31b61072840afda4d393e948dd86856f6afc51892ced013f148d342817646ad2209770dd3ac42a9bb7d78635e4d2fb9cc2b56521e77890e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/Lo:A3k03kHRJM
TLSH
T1C215AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 939KB
SHA256 bcb121a554e45b14cc9646959fa81cc151bebec3c82f42074ea96adb55be500f
MD5 beaa58979c4c01cf81564030363b5e09
SHA1 30a9206bfff64429eb857df33b65c36a7988054f
SHA512 c1195ba40e53aa9dc767600a6a188a252f8b2d619006f0ca8cc71c29668acf64ad4d2b83c6bfead050611018b6c48607f033fb32814caf38dfdd75936acf45d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/w+:A3k03kHRJh
TLSH
T1C315AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 939KB
SHA256 31a771746b2eb033f7c624744d58870b5b0ff431be007604cf3c9d8603842851
MD5 1cea9741e5f47cefdde2459932596cfd
SHA1 551912d9284f215e866c91af0002c9e51d8b5259
SHA512 91ff5a0a787437fa50bc4dc707a5e0b355394cff26e02c0c1fba2e22a9116ee285a9a82808892cc7ede2206af731d290cb0aee066d0f44e78df328e86f4db16f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/IQ:A3k03kHRJh
TLSH
T11C15AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 939KB
SHA256 62fc0c44657520130e479c1ccb68e56b4d250b8dd398a855d70ff79bc648105f
MD5 97f85685ca1644d13d25994c113b0a16
SHA1 de8b37c02b049488e92c4a03dddcde3556d6c09a
SHA512 c079be1a69e9c27459581fbf5647162ebc4a84362ff1aaa97bdfcbca2db6a76d3c8ac47035dbfba5851e84134929f0ea6faa48fbead2c5143f4ac319bf47c1dc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/BX:A3k03kHRJN
TLSH
T1EB15AE13EB9500E9E10AC1749AE64A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 939KB
SHA256 526c29f3e01ebabba9ac9e5243b635c5b7053c73bc194a310b7e643be9b5c048
MD5 0a027dc4646a87c3a44169563a8cb239
SHA1 39d0d49e80ff56184439443a1eb36e55c0103451
SHA512 8f05597ea12fa59173dc504c3e60a3bcc57e23bbb4564d18267d679180f1852e0f21c4197ec4902135354c56cb2dce2a156c6b2f2f20614f7fea7590628e3aa2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/7L:A3k03kHRJP
TLSH
T1B615AE13EB9500E9E10AC1749AE65A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 939KB
SHA256 38682dff33c70f54d5a6e7e22c52f0ff969b3b0339f2efd4b5628eca52882587
MD5 ac1c859336fc15cac62fe38400f43069
SHA1 ce9fedbb9fe95a0204307faf3cf8a401c8b3fbc6
SHA512 711ea32b435252d4305665081e6d461373b950e64f092731422dc51a8887a0f13dbbefcbdebc18747975536534dbced80b02bac66a971208c77f88a8b79d6476
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/BM:A3k03kHRJ6
TLSH
T1C115AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 939KB
SHA256 e5ec688163972604b4bba1ec4ca6f25cc8195976df50f8a27ed5535acb0ac09e
MD5 0e2281747fe205fc7f3587c6f69c4ec5
SHA1 4686643d0a58363a84daee87544ab9f15c4620c8
SHA512 50aab8ae0f36547121d7f278037b1143edf34de747245efc55a1d3abbd095216de2716a87798149a2a4001f6e7a8e75a4b84b9922282e5271a147b93034b881d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBR/qh:A3k03kHRJ0
TLSH
T12815AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4932-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4932-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5860-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads