5f8c43e518e920c350817c27b1f7bec183a21f86080a61c06e12ee33264364e1

Analysis

max time kernel
105s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 09:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 821KB
Sample260804-kygdlsge37
SHA256 5f8c43e518e920c350817c27b1f7bec183a21f86080a61c06e12ee33264364e1
MD5 f23a080fd875dc794e65c7df9cb324b9
SHA1 99fdacfc6542a7df38099e241c2524a11bec49b4
SHA512 7759667275376588bb527334643a73c3f7e6e534a4d73f100472ddaf7fb073455f8dfb9271df080f4a2c552b66c95446644b2fbfde92de1fe3f3e57f6ff33f52
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQw:A3k03kHRJP
TLSH
T19B059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF2358D6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/3472-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5f0-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c87-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/248-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3472-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001bacb-490.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-521.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-601.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-717.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-785.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-976.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1137.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b91d-2116.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c612-2147.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5f0-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c87-57.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-234.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-440.dat	aspack_v212_v242
behavioral2/files/0x000300000001bacb-490.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-521.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-601.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-717.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-785.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-798.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-926.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-976.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1007.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1087.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1137.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1151.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1323.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1342.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1367.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1374.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1381.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1400.dat	aspack_v212_v242
behavioral2/files/0x000200000001b91d-2116.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c612-2147.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
248	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe

Drops file in Windows directory 50 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3472	2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
248	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_f23a080fd875dc794e65c7df9cb324b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3472

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 821KB
SHA256 5f8c43e518e920c350817c27b1f7bec183a21f86080a61c06e12ee33264364e1
MD5 f23a080fd875dc794e65c7df9cb324b9
SHA1 99fdacfc6542a7df38099e241c2524a11bec49b4
SHA512 7759667275376588bb527334643a73c3f7e6e534a4d73f100472ddaf7fb073455f8dfb9271df080f4a2c552b66c95446644b2fbfde92de1fe3f3e57f6ff33f52
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQw:A3k03kHRJP
TLSH
T19B059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF2358D6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 5e7af52578403fb1ae48c5f8ad2b7437ff1b1bc0d678ec4e39b5dbd9fe1573ee
MD5 b91c53f7de73558e23a83668a98b17fa
SHA1 5cb3d7087547192b8ca942181bfa28d2ad0a3ee6
SHA512 4a2d7f111affc92efbe06d9daec32e5957106bd05601b79b647bab29725461fc686b543542ea86ee6a9aef4c6b2a075d21daf3fa553457e97ca07c4ad115ad13
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQI0Le5ji0hmxNrM:A3k03kHRJ7Pji0Aj
TLSH
T1E6558D17F6A402B5D067C0B9C5D69A5AFA71384217308ACF1398C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 869KB
SHA256 a176b59473d7d637cd609e36903f54f76526497ab1ac841fd2172b6ed25e2ead
MD5 0f2aebc668ce513e43a5cfb5de34aaeb
SHA1 749c11c1592c1b5451e7c75672ce71eb1e67db63
SHA512 a92d9a31aa92e51ba844c9c4aad12493203ac03a71db7f88e6e85a049ce5ffa51c75d5e0c847c809951831b4b3a8cde400d687294e9ef8373db738be0aa07e98
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQRb:A3k03kHRJeb
TLSH
T10D159D03E79400E9D14AC2749AE68A23EB75BC52173097DF2358D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 845KB
SHA256 7eeba2742d95386a07632b50c94995c130103d064d32e8ef98b6e08fce1c90eb
MD5 76e43713197e2437404cdb132cd4cb2a
SHA1 a76a411a2f66efd72bef1af92d16923dee28db80
SHA512 68db47991fff39722fd9f4e6b454b05b8e100182aaf679d1410dc4ae7de46faa7b68098489414da043ac1d74f791b7f04c2b11f2b38d7fe51c8c3dc282c4c037
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQD6:A3k03kHRJD
TLSH
T1B1059D03EB9500E8D10AC1749AEA9A23FB757C56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 845KB
SHA256 4f1a4eea96c76c18574ceec9dd3d385c91ed14e22bcf9510f4c8af4e09070fc4
MD5 e8e8ff243faf28479284af3377ae8096
SHA1 08e053176a4f34fcb0c744060ca9265d69845091
SHA512 67a8a37de71cd07fe66e94c111e75ea15136bc404c0cb039cb51f58a777a774cc6a12abde6e46728830a03f1e0e316af7b48158fed311b9f0c8b95dfb04e3cf6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQtN:A3k03kHRJ+
TLSH
T104059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 845KB
SHA256 b21e70ecfdeabe4e9cf12ac9d5b686a271721c8c9bedb9fca45fc0de30fa8522
MD5 5daee07167ee8e8affb51f80509782b9
SHA1 b5b262dba65abc62750acde2e9ae0f56ec980f79
SHA512 b32148898740e2df4e8c10c759191574390eacb00f3bde8d3f61cbb1adc2571abf5d262bca06d2e71b9b6a2993b2f8d5a28e538d24120bd12748c197a7939053
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQbf:A3k03kHRJS
TLSH
T147059D03EB9500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 845KB
SHA256 478422118c2f9604cac50c9a045b979de2fd8df76682bba38fd715c67cb8fe97
MD5 e372cc0295ff91a956f5ce550c89a2f1
SHA1 d800bee3bc3ab798f0004d8040e5e6262c4016c4
SHA512 741b41a72fb3b8562d1343f5dd83552c313e1f8a28390e80a57afe576da658da9996581f57e487d269fdc2bc724677c9c4c4ce41babe56413edc91e5fcbfcbd6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQNo:A3k03kHRJb
TLSH
T11A059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 845KB
SHA256 15eb3c703ccb5c85639ac7d0630fba69c8b270ad6c6f8922ecaa708e9cc3388e
MD5 f5e0083b9af092859fef7c3c0ce7461a
SHA1 b453e18f1fa194374f272ce142166e7d081db88d
SHA512 5230c0d0b95d734c3a65f4109980ecdb2b146ef9ad4709d31ec40f8329149c215dca9b730e12535bef920e00c3f2f79a1d8aa97851aab73d46a905c5a17d0e11
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQNu:A3k03kHRJd
TLSH
T19D059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 845KB
SHA256 ec7d101eb529a7445b30bd6b53c68e42f4cf562b686c7c711dc378e63a15f0aa
MD5 ac4fc2b39895c0623918b0972c1ddd81
SHA1 3284313528dcdd6bfc641dc6a8eb66706b860e8a
SHA512 9f038152c9250ad3e849fb546a8fcda3ab30016da3cc41c3eb25beff100ec7dd9ab3fcc085b57ad28cf9a44ea1e6a1e37ab1d993af9a611283bc5b006719554b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQj9:A3k03kHRJo
TLSH
T105059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 845KB
SHA256 85c69c6b4c8c6f858bb3bef69402ff34073d0497314e3bfe63b976626d88081e
MD5 dec26fc019abe2a1345d4ada26eef6aa
SHA1 6a72b370b6d69a3176c50964a989dcc821da5e46
SHA512 0a4bbd2fe63e67a25d7dc603ec30dd919a4d92b8ce07c2b4b0249cb46834840abc26a8d2f502f3741c8563d57a97dbd740715baaa2dffb88b01c402125452a15
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQPc:A3k03kHRJp
TLSH
T192059D13EB9500E8D10AC1749AEA8A23FB757C56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 845KB
SHA256 bf638a5cf76c4d25cc10ee8a3f4c3ff3886128b806031868b2369c77a84d9afb
MD5 9acded5dbc46f9ca8e35b4ec1de90cd7
SHA1 3e1dcec472dd6d1edab1d6132cfb930ea8f0882b
SHA512 abfcfb4437422bb5ec8b165f963ca4a2c65abb48e44b7c07665deae919f9cc60a3940016b8e447a618982614f32d0417401b46ce2de77d5c8a9b28b35909aa82
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQIp:A3k03kHRJH
TLSH
T139059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 845KB
SHA256 bdb2a517123dc7af6868b66716e052353cb68c304201e61d53e3d10087aadf78
MD5 1f26b85e4723a7e2b02159413f328bdf
SHA1 205725513a17888457648174afcaafc4d9bcd8e2
SHA512 aa0a42e17f3194cb0ba8c344ef6f4253f8240ab3971eb6590cc24fe61b475b6bfe1b5f8f2b9e94051b040c168781d631e3570ead435e592799c23aacfcdb9ab0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQfN:A3k03kHRJM
TLSH
T143059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 845KB
SHA256 74571b16eeca1bb94da74b76557502e60c0f34be8771978b88eb112706f7a8c1
MD5 bfabafa1718d4cdc51b0a5a8d823032c
SHA1 0b83a32832f8c6c5e6be7c8001815d9ea99a4eec
SHA512 d1fceb6ffa355ebf1c9d440ca7df55b86d6f3cbce89440b2363a4e7483f5663b37ee30d77ea47d53972824322fe99e398ba03b49129dc2d94902258d3377f2d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQdF:A3k03kHRJa
TLSH
T118059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 845KB
SHA256 ca95028f6a0479d46fcb5461597c2ff2b484896ec6d02d25d14420dceb924998
MD5 70d568e304b63e669f2db21be3db8bc0
SHA1 755ffc48318fc9c4f5a37c89435813ad06930db5
SHA512 a286488eee4e3826a0f91e0479f368d0be279d714e1be0961a5c78d72324be3b9fc873e961ed7865e850a4bab5895aed9fe3c21d2a420fdc59ae0d31928e6b76
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQuC:A3k03kHRJu
TLSH
T180059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 845KB
SHA256 ce2846374ddbcc782247baecb875707614a574198f5fac8fdc75631fdb7eb3c0
MD5 b57d81dd85d78809f02c9aaedbd943d2
SHA1 cfac0ad008a986faeae457202ca7bbbcfc57dcdb
SHA512 556f7d4bfca315b8653f0698f2c87794581c416574cc835dd6d22e3f7ef59ed7cca481704fd25a4cc98583f9fb3a23b9670013f17aa013b52ece04defddc9da4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQxw:A3k03kHRJ7
TLSH
T1CE059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 845KB
SHA256 f396d2e616432829835385f30fe67d6ece304e60a9b7da6775cd1903ef5a3ced
MD5 64229ca099bba5d78ddd12dde1c10251
SHA1 dae897c80e1927396e9b3866649d9666e4754018
SHA512 3607b7e4471492800d4a8a9ffa0e40d3233b71e7e40c2eecf1d9ecd2b80fa08308aedab621e8527434cdc9bf2d21141b487c0b6d17bc64253d37bb4c9e20b3be
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQYT:A3k03kHRJn
TLSH
T142059D13EB9500E8D10AC1749AEA8A23FB757C56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 845KB
SHA256 96e564b52b1faba0fc2c39dc486a741cfdb349e4ecb2cd0ceec5d61097bf39c0
MD5 5fb45527c4c49139f391726274e87083
SHA1 656ac9684cff601bdc6a8c62606a89c4bc2c3b84
SHA512 b2a4c6a0575a6e0bb167b334683a34b3729c8db3c262836321963a6484968c1f24fed88f80b18c4a57a059736dff5e5c8fb9ceecbc4ef5bf542733de4441bba3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQ0u:A3k03kHRJo
TLSH
T156059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 845KB
SHA256 c5bef64622e2e0cd4d4916d9e93f771b8f1648fce54c8eeb22255c86397bbda7
MD5 e693566fcea6bd7add75e8bb91240aca
SHA1 29820114f8ac330ea70ec376b8bf9ee54aeb3d91
SHA512 8a30d8d8d3523c8452efe8f6313bd1b061d5e84f7919f41f3b3d41ce1d38d432adde7632a6c5e0f4cb6d44d4d3a8dd91ae568374a5e1241c74c75741215854cc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQib:A3k03kHRJR
TLSH
T1C5059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 845KB
SHA256 aa5dada6b2baf8beddffd344ec184486f0df6a0e65463ef567c830824302652e
MD5 3b04050d7e052e795d95d09f9228c626
SHA1 cf43d02df6d2ac567820066e92d67d7d0444bfcd
SHA512 31527c83db878eb54afe00591a102e57c979e1ee912650dce00f25f0ecf953b2ec76f948f9658db2a71d349c2a805c88be02b1cfa78ba70cc06d344ae8df035f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQkf:A3k03kHRJR
TLSH
T18E059D03EB9500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 845KB
SHA256 7c4b2b1f587bc908ecde93943ffda42a899e0863bdeef9ba76c6fb724d403a7e
MD5 44269eba2219a58d11bc060d9c86bc2e
SHA1 f1fe1772ead3823a910713bc51aed29d15dd2d4e
SHA512 1a979c0f41af5088c5d3eb4b3ef2477adec9df9c2e65d71f2b25c5aa3dc2685fec3b70b8f6d6c5c1410e843fa48e86766b68e76a9b78d35aee7bbc26a3b0c881
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQBK:A3k03kHRJp
TLSH
T161059D13EB9500E8D10AC1749AEA8A23FB75BC56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 845KB
SHA256 43a7dc976f12a6ffc6bfbf8103264a50fc327bf992f2ae28e3277b883b40f575
MD5 2e6ab7bef313c085fefbadf4c2969bef
SHA1 965404c1b6b055e1da77d7c083972db50565dbac
SHA512 3aa291c8600a3103b400b9c90702055cc93feb8a62df30e95b95175897ce56666fd283c080462f0891ccc170ecaa801a4ceae52f668b4b27b8df77ae5aec2e2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQ6k:A3k03kHRJg
TLSH
T113059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 845KB
SHA256 215083a7bb13ad83d13407419de316ba9eb0dafc18feccf854876736c33d6891
MD5 dbd49d057d433fb30de3d893f605c7a5
SHA1 d707737468a69c22673264a96e303861fdf43eeb
SHA512 5985dc2737e354f7fc9774c8dc8535a3e9821a876ed26bc3094c626eae7ebacf8923ea5480bf30d5266a1b7fe95f30ad5f7e690db1fb327ae6b52979ac04153b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQf0:A3k03kHRJp
TLSH
T1BF059D03EB9500E8D10AC1749AEA9A23FB757C56176097DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 845KB
SHA256 5f92340ff7ae15511f17f01c2fb74c457672618e830361b16b31e4a0de67652f
MD5 c0bf4ee0b9a055b0e768cdd7cc031746
SHA1 13934d28cf499ed32efc39c63b6af67af5ed808d
SHA512 e7f5e084f537b46fc58ff7deb7d2e2c384e7c1091db5066993c13a6e8b69cb3b36e5c8a778782dd17de7b71f2ac426699040f4ece26b331aed81c0754b52a4c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQug:A3k03kHRJ4
TLSH
T177059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 845KB
SHA256 b6fd1e84923426ca8020734e9254c992e1bbce0f3193c2fe85c35c8ca3329f90
MD5 1f1d5a22c23395ea32ff2b2a6a8b2e2e
SHA1 830cce33bf5251019578cd11b6e992f58b9dd809
SHA512 858319fbe1d0884fde36e9473b256a442f314097d8eb44234af785a74e5e94fa00755b90530216185cbb4d4d89ee3ffc27d81c5ac3375506efc0059106972ea9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQ3r:A3k03kHRJi
TLSH
T19F059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 845KB
SHA256 5192a54186a78effc78c552591247f025ee9ec271c62b66e4ee2b607d3d9df58
MD5 71c294b6c0b6058951c88961f3e4347e
SHA1 89a71d864e5684572fae2d4513e561c2fc6ba5c2
SHA512 f424657f9f34fda096154181800660bc826906fa33ca77988a4b5eb5992b11cfc2e8c00b188f9471d58a74e41e7993e230c37714ac0adab352e7e60a0902e3fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQBn:A3k03kHRJ0
TLSH
T169059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 845KB
SHA256 bce5c82c326012254c2010dac5a03beba1c2bcdf68503dd429f24d41fb8e2e6a
MD5 37e89b8b8f810673f39a0476b4d96d43
SHA1 38cc26d16f7325e246ae7306b749efc358f10ee0
SHA512 e6097a1ead113919fda1aa3ea9d23903e3189b410ce37b5a20b3fa086532f7203c389fb4a1414b728fee5ae6d6478c5316b71bd0986b8695cfb7a57768f97566
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQtx:A3k03kHRJy
TLSH
T122059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 845KB
SHA256 45f2b0cd70d1fd1aea6246b8dbeb8aafb7c22e5de4828a5c77ce257ca74f6519
MD5 684b37a4c9e3cf080e2781f12c0c3cd7
SHA1 29601df28f57f8a60ae82cb8b94ddf68a4c4a506
SHA512 c39d0a6e57cdd503a5c569feb5689f5dbf0eaabf8f8ca6e873122e01cd3aa178fdffda2e6016f4a7f97e9790272261fdc9d5f6cf365546c2a366d6f20cae55a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQzA:A3k03kHRJR
TLSH
T159059D03EB9500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 845KB
SHA256 c7ad968ba7bf175d16d9ecbb1997dce94879e57d65c61e155e834ec6fd600891
MD5 02c2838e3803c7016425ff26c93c805a
SHA1 f4d1a212a0587014c70ad4b282ae4731e35e6766
SHA512 ad36e9c7f8ac23f320b4a706f84249d77f9a9d3f7ebc1ddfac069712efdee4fe825d1de307c7a477e98759f285a3effc240b62c122094c5e8a805bb59f51d7eb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQE9Q:A3k03kHRJo
TLSH
T16D059D13EB9500E8D10AC1749AEA8A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 845KB
SHA256 bafc20a015ee01fb6a4cce83671e8d1915743f2622e16c9ac7c9af610e0f2f76
MD5 26f204262950ca3c6d0d95bb37030e66
SHA1 1b510f54be3428e21ac3dc1fedc66ed501677e17
SHA512 5c56c497a2391dabe46bb16f156ebce8838ed6372a305e549736660e83c156f55f0291f7f2a94125e7a1a64f87ea38c87664668e89be68af8391368532f3e1fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQd4:A3k03kHRJT
TLSH
T1F2059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 845KB
SHA256 2f5e19b40b32bdf2eadeed7a63553d038bf70a29ab642c411719ce539ab06fd1
MD5 b5fe81703ab972acc3c04c252364011c
SHA1 9c797cf49d13b594feadbaad65327d66cb75a727
SHA512 1d4fcf6faaec274662ebc013396fba6ae9ffd78dc99c99310218182fe5a46b33d38d327cc2758c7a99205d53f77e6bd1bbb41be006d0a365133f957541656aa9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQ4u:A3k03kHRJ2
TLSH
T1F7059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 845KB
SHA256 46046201b74e637a61cb7f5e8b013672a20e3f180f84c3488c670e22e25940bb
MD5 ce0118309ee7d3e23318587cc78d01f6
SHA1 7817fb20196fb3adecee10330e7b5255c5f242fc
SHA512 e32991b629ed43aa9ef36baee253c3edc6aa48f43824b0e2c70c6b479178651ca41c42ae1f8011bf5c9d5743e498bb46dab0c3b727a1138549b3e59f2f3de045
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQZj:A3k03kHRJI
TLSH
T13F059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 845KB
SHA256 1f61f9470e3d016cea1ec277d5a24c7283e8d387e8a840b5cf9b716c19672ceb
MD5 e301a0dd519e73eca120fae9b0eb723e
SHA1 3a572a251447a6393ee6b991e3c7f42f243aebe8
SHA512 6574f8516dcdc1e6e731fd06a3e76b10e2dff14bef419dbaaae16902c999848ca1e5027e53c7c7d79605ef81e2a14e0f9899cc071e1ffb21ae0c015424f74f00
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQAg:A3k03kHRJQ
TLSH
T142059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 845KB
SHA256 637ec19a3f806e3fabacbb30a165cd8dce8371c9b65092eb97d083674abe9e72
MD5 cd038d419f39bfcb46af4eaf69de1932
SHA1 56a8c244b54a1af113a617c86f929ecd207c76b9
SHA512 a6652fe681acd2f1358b7959bcf3054d1277db8c68cc7ce707353fdaa98988b40ab744bb788d36388de5b8b143a21d056e68a212b6d6df8e2c0bb592b043cf5f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQvI:A3k03kHRJx
TLSH
T190059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 845KB
SHA256 5e2c962ca8d6c0e30ed6352cd2c835a0b8f69fddcec65ec2ee8acc21acc1552b
MD5 15aa3462c5a4a09e856b6172eb070f57
SHA1 3ac5fd80e2d996a9a75f55eb5fa4eb10087c538a
SHA512 8ef7997ed7b50f5561aca16e56034bdc9a61d5939a015402591019229371d33e82a8054a6559700b5353439bffd9a9a27d29982319cab41117083f484cbb4c3b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQVo:A3k03kHRJP
TLSH
T164059D03EB9500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 845KB
SHA256 d4c63fd9b949764681bd354552c0b2078e701294e299a718b251b9d9b3ecd2b4
MD5 7702b9906434a2215930b82816cd4a72
SHA1 1bf143ce7b5c828a9fd360f46894a26b6da87b99
SHA512 af2aebb5140111f87214ee415d26418475039a5562f0fb8e6257373fa1e68ba40aa187e3e0b30c7a84237767059b43d34d5cdd2164efaf17058711e1bea89482
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQG+:A3k03kHRJ6
TLSH
T133059D03EB9500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 845KB
SHA256 b66dd561847078ce60ce5a1166ad43cdf710773e370a565375ba77b55069e564
MD5 4308d487b25c088e514a02a1f64940a5
SHA1 7434d62d56f0e748ac0e005678dab04d2d6a49bc
SHA512 cf32f1453569a388f8f14bb0969162d75c81da39960c7b5a70b049ca4bf1cfd471c4bbdd8b632f1a12e6ca5646a6558892a2051650c5ae9495f15d1f4aafcb2b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQGQ:A3k03kHRJ+
TLSH
T1FA059D03EB9500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 845KB
SHA256 3e71403be10fd373d5f2bf8a16dcb770336820f9f7371bb9515891db11d0c6de
MD5 194bc7a3f082dbfe6c207f8ee509ebbc
SHA1 2ab9bb34031b371e5a99855a8579cd7de59f3604
SHA512 6bb8e00b13e4bca3975f1e542dbb078206cc3cabd27f68ca51c8998b999e979dc2d6e94bd0e5edca61ba70e60f258b4cc78d1686fb6c035c4e1163ef8cbe5409
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQXX:A3k03kHRJe
TLSH
T127059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 845KB
SHA256 c21d1cee2b4fe9ebacb19a69e973c90515fb63089cc999bcce6580cfcda5fb59
MD5 200a51b9091c8c3c53fbf86d7edc396a
SHA1 182944619b77a14291f907888a962e288f7c1aab
SHA512 b9025451915a97364f9706892bc9aaf58bde24288448643102c7687802c66f1d24239d96bf17aa65c9b56e8d646cdf9c3bfc958291416a01d781236093f2d1e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQNL:A3k03kHRJw
TLSH
T17E059D03EB9500E8D10AC1749AEA9A23FB75BC56176097DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 845KB
SHA256 4e08889385de335bb3e038653f1d504fdd95c234bb31048f4fb06155e50471ac
MD5 55a0f4636240f71d52d18bf6b44e5f66
SHA1 5b9862c077728a7a33485e35dbfba671974b1c26
SHA512 d34c82a7e9f506befb2620aa6d34a43441827b46081bc85d6da5dab086923c12e6e6f2e38c178af09601d09ac6c1c1cf3e9f15fa15e28fca674cca5dcfdbad46
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQLM:A3k03kHRJh
TLSH
T19C059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 845KB
SHA256 961179b37b43b7a261691d4e97a8368b914c29c7b0e192748e5d0e3af93c581f
MD5 8b618afe887b83fd442445b7cc6a5d58
SHA1 ce1e136ba0ea4256b7b5223c980f83fe6ef5a10f
SHA512 51062f990c362c36c20ef9f95d34ae41c0e9853549eda1552f63ec2b6537462ba29c4036fb9b1808a0179ae3993c581e6863193b4cd68938ccc030c769d51081
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQMh:A3k03kHRJz
TLSH
T17D059D03EB9500E8D10AC1749AEA9A23FB757C561760A7DF2358C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSBuild.exe

Path C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe
Size 910KB
SHA256 c97d1991f86dc9ec6858e2ddb2deb06835b15bbfd919f4e2b9c0003056a0edb3
MD5 cbe94122660f464a278a096ac10f26bd
SHA1 8dbb13c5ada8b608f008787ae324c06def5f1ad4
SHA512 38bbb8d7c1ba8c0a84da8697bc68259b0b5aeed33db26209e012cb2b5db9da4a86b2896b5b85846e30feac9504b70345c985b88ac14374ecf9209822a36bd927
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQwV:A3k03kHRJfV
TLSH
T1F115AE03EB9400E9E15AC1749AA98A22EB75BC52173093DF335CD6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SMSvcHost.exe

Path C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe
Size 950KB
SHA256 1b032e1b27f6180ddc85dcc3576a8fa3b363a30d187556a22d906b0b3df6bf4b
MD5 bc2ee77201839f291c8789ec6e43cbc8
SHA1 f90ba5b46702c25a0689545b1232728678a29ff2
SHA512 d96c69ac6b96c7fad533ac60477478de633f9f31467c9a1cffce0e5d3cdab031155fba31066bc2117cb21ae7e6b064fa8805b18066779045458293942e05da03
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z1UEQFccx2w6:A3k03kHRJkccow6
TLSH
T1EA25AE03E7D500E9D24AC27496A58622EB75FC561720D3CF2358D6152F73BD0AF3A3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3472-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3472-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads