50e8c918181f013ead041113ad5966e0f67d61b9e1c3de9de2b8726d5de9cce2

Analysis

max time kernel
104s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260807-a9bbmaxzc1
SHA256 50e8c918181f013ead041113ad5966e0f67d61b9e1c3de9de2b8726d5de9cce2
MD5 3a4282afd02340e8d64f9df3184e6a40
SHA1 2487f619fc26166443f68832e04fd9026edaaadf
SHA512 0e021f622b5de8ca752c52d43069c91db516d80fb41781ce2800b3304be974e1ae85de376c1ef4bad0b52a817a1946f87b6a90251f6d006cf2ed2700918ff874
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXF:A3k03kHRJa
TLSH
T1EF25AE13EB9500E9D10AC1749AE64A23FB757C56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1776-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c53c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1776-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3316-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001ba9e-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ba-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-570.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-644.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-760.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1205.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c53c-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-40.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-222.dat	aspack_v212_v242
behavioral2/files/0x000400000001ba9e-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ba-441.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-491.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-570.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-644.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-760.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1085.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1205.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3316	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1776	2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3316	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_3a4282afd02340e8d64f9df3184e6a40_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1776

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 50e8c918181f013ead041113ad5966e0f67d61b9e1c3de9de2b8726d5de9cce2
MD5 3a4282afd02340e8d64f9df3184e6a40
SHA1 2487f619fc26166443f68832e04fd9026edaaadf
SHA512 0e021f622b5de8ca752c52d43069c91db516d80fb41781ce2800b3304be974e1ae85de376c1ef4bad0b52a817a1946f87b6a90251f6d006cf2ed2700918ff874
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXF:A3k03kHRJa
TLSH
T1EF25AE13EB9500E9D10AC1749AE64A23FB757C56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 598dbb2b34daffa6649c8cc55c5c8cf1b1ac8db14bb77aa26766593ce7915ee0
MD5 8be6a784d4b80038fa913787a4e95525
SHA1 a76487456c388d95a91f3edf436dcedc717a6b9c
SHA512 250264a12a21cad2bb95c9f951086001a9594398e894c40c08922f48cde7f0bb15fea065f708b1519a356cf121464d3b1d91b04e7794ff1f5daa0c5cdfbbd8c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXB0Le5ji0hmxNrM:A3k03kHRJqPji0Aj
TLSH
T144658C17F6A402B5D027C1B9C9D69A5AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 8d6462bcfa74e06d5df8cd59cb060e570370a04dd0b27fc705943d27f66b9628
MD5 d13ed25464cdff1eff015fed13c0b5f9
SHA1 a8628cb29c2f6f9db1b7cb92aba5b1b4b240e130
SHA512 9f7bbe648468de47a3e9b1dd1c1a44af4c95e12181ad563c29d3f8eced38f1961a15c65fb4fe6c881bdef4be17501a25f2663c194609578a79ec2557545abf40
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXDa:A3k03kHRJ
TLSH
T1AA25AF13EB9500E5E10AC1749AE64A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 f466ac0beba17dcadf0b40adc6832bd8bd512292e72fc7f858761b9ca6266e03
MD5 cfbdb7a07bacf7ee1b78e5ab8f0d37af
SHA1 c62c015b9d2799e96ef2c4de1d702f0f54ca97e8
SHA512 23f7705c969a6b991d9ab5aeaadb6f9756c136e0ffbe3e6e3c6cf281b6f3634d8d6cac7d2f30d1d1c50f4bcca229d2b44183bc1a7dcc22bd4aab0c8bcd75c0d7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXi6:A3k03kHRJ0
TLSH
T1BA25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 543a4ea079f16b0f982df76bc6827609dffbc0b14d6df4f27c84b3d1f3b32831
MD5 1e719d53fe7366bbb4a6f19fbb0f0c33
SHA1 8ac23aabd3c8d278f0785dabe59d34d066ceebae
SHA512 8cf999c341bae7d410da53da7a1ef805b1efc53c73d307c31694a1207352d1f9b3436fc386bf2625e28c11a4c768f11b6f3ec83f56ac9b7378389926a7d41ffe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZX6N:A3k03kHRJJ
TLSH
T12C25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 94b2f73f7ea878415a7e1fdbcb5110b164436d81ddfa9238510ec65861476f14
MD5 a3af5085655e46b03dcde3afc7ef66b2
SHA1 d6b439a331d9d5cdfa93c46a1512ac0c217986df
SHA512 12708d6ec6895e582f038ad804f0a7479635f2628ad8f265a0beec4a0ade8017c6292321eefadb85d4d2b0226222ac0798a1805f0b0593488eb0412d628bab5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXgf:A3k03kHRJJ
TLSH
T16325AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 0f32db9c51dcc05dadac1f9575e74a5d72cd820ceebbd9629c796ee7f28d331c
MD5 3dc315ac73a50f593a9cffdf50eab036
SHA1 f16b784f92e7336e5b0b6a4dbf4741ce21718b1d
SHA512 b0c1176af9c2b8df5b1c03fa06ccdccc646b74397f49ffb8c4261f430f2224cca3da86a4d7b027b08ae0ec0c1a2f5a286da584fb765da623b8f02fc1292ec1bd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZX6o:A3k03kHRJ8
TLSH
T13C25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 f1a17c6fe24acb1794f92ad3cba077983d54a2c491cee32aa42de770e2e3a8b1
MD5 742ec16df153a37a21c02ac9b4613239
SHA1 949a3cc11926738e2db00deaa0cfa65fe06c8946
SHA512 fa9309032dd1eb9e96eb061263e0352c2e894d1b06bfc05d1e8d59ca95cbb495c1f46922b9814146adcfadf193d75db9a8f4b02a04f9c027e19aba37094b69d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXOu:A3k03kHRJ+
TLSH
T1E725AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 c10182a41584cd321259db90cd8d16ec25d9d8478a5fb21ea9f65a8b90627ce5
MD5 e4768aeb3f5f9cdabfa284f65b53a65e
SHA1 1007f09e328e5704fd4df87511f5ac17314864c7
SHA512 5a8a537b4c60a83d11f095fb75df11ed21af57ea3e46730ef4e562ee0ebb447c49c28447521383caaff022a03bae0122f07e05364db2d9416c624a1fd754db98
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXC9:A3k03kHRJ/
TLSH
T19C25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 beba0148a20ff6c485a2fe9c695badce01aaca2fe6471b3052efede34a9b28d6
MD5 1513a653582a3b05920739ede060a450
SHA1 fc0f4e526cbca6435fe39129dbb3b571804ec562
SHA512 f484ccaf83eb82faf74b18fe4d0fcf17ee94b2e19ee555224eb81c43c098e24f006e2661b7df859c4e6cec42237f1346e9d8b7aaa027656019f8076f01c890b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXCc:A3k03kHRJ+
TLSH
T1D025AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 04c4f2aee215e6eb222809bb3defd143b11136d66104f0747442b10c211dc393
MD5 2329380b429ad143ba2bd65dc6794740
SHA1 34eb149a8066cbe91184ec9be16b695cf38fcff2
SHA512 6e9597d7e434567a9603f90d112da2f9a35e557ca5344d9fb76c299dfab1447fa8db706b5300f9e3823ef2055ebe5408ed1273a0ed606cb17d626ee5e50c8ef4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXLp:A3k03kHRJM
TLSH
T16A25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 ba1706593a3de022ec1b687c339bbcf4f906aab06d6585af3b017762cd495e70
MD5 f724408578d126312cd0c491439b9a6b
SHA1 b1142d7ab30a0af1589718714c50c5b0c6c5abdd
SHA512 e9de6f658712d6704857b02b54948d782b652335ff59f94e72cebc948862b7d01f9f10af089d2e27754a47fb757797c28f6c8eae39812d101321c73227ee509a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXcN:A3k03kHRJL
TLSH
T16B25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 444f81be88415094e7c24b42df65b544c18a190387a23ef966576c2422bc49b3
MD5 f2b2c572c476aa1183723167132cd462
SHA1 8a9dcd6c039c61905457ddbfc500762b7a138c69
SHA512 dba0a516f273d3e8457f9c3f13cf80e708c887df5be3f20f5284c24865551571849081af9578468d94d8c69af269b91ba2f0a332a547e428d6d4c83b851dfd1a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXEF:A3k03kHRJ9
TLSH
T1F825AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 4fb264d215ecc1540be4d2edb8c516061156e2d8376ca9454131836e322065f6
MD5 b4a37eda49a7fa7f4c0563f9c04c49a5
SHA1 0ead2ef510b6ae3106944aa34779a3cfabb88d90
SHA512 61512222db558ecd8767b44de76b94ab102c66c004f848d17aa5bbcb5fae32a3d11b80f3a1502bb9a73263445f80067482dd256ddd1703db96e7df2dd970e513
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXhC:A3k03kHRJh
TLSH
T16025AE13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 fe0c4d11fbe26565a06fe01aa26072e010ef03698d7962e1f73aa1b1d79a4e0f
MD5 217b4d75539b7fb964f1d1dd75209744
SHA1 1c0fb3a67efa45745cc9de64a6a60784ceb2ba22
SHA512 0b9d63ab33dd7691c6831afdda94aa52e293e951174a75f1123f26a91a51ccd49d00dbc483e0f3f01872636ec01dc6c8b13205f3f25bffef8707693e26ec27c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXiw:A3k03kHRJs
TLSH
T18025AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 03422008e150862967f2baee39d66653d8e4b91e3180db7ad5d2719bb2c696c8
MD5 5099ff70fdff58756a2a411d460254c4
SHA1 101234c4eb3ccc6470f5b412ea51e23623c1259e
SHA512 7fbf7f1a4da2227f6ee6d2fa5881313f6f1ba1751d0c1ca9e8fa99f358bc4107ae7a8e4d857c360366ef21faeac8acf90d587b48075f0f6dbcadfbdb58d22a89
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXpT:A3k03kHRJU
TLSH
T1F425AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 afe8ad8277502e9630606795ad853d6ae5407ed20614716e35b6591beb8db0fa
MD5 1975512b9d05c1bafa8442148692cc16
SHA1 f327ad41b9708f8950016410ac8145c00b05b931
SHA512 dc80cfbf44ced210b4289843986d4315c977209a98d88254e99c46a413eddb2df82088a5ac91e999ef3a85dcb11c10eae04978e384a36694eb64ec1f2ad0f791
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXHu:A3k03kHRJD
TLSH
T1D825AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 17ca3a8a959af57dc0488b49d80057aaf2a295f1f1a0331821aa4af7938d0f3c
MD5 5c950ac7298669faf82dd7ef3cd60d38
SHA1 57ff657078cd8c9f9fdc44ede1a6a13fb3c22666
SHA512 3c14efd8b8ae1fa932d4623ae5c0a1e8529ff528c043a213b354ea256da89a37ae79ff94965b8f550165be34264bf53f7393a2782b9ee63d2391d2a119ce045b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXbb:A3k03kHRJK
TLSH
T1D125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 d9f20572869bff0874e5eff1299e62f9d15b7db2795621e0c1eeea85f42eb871
MD5 b0db801fbc8ab3e6f75be3fffe846b1b
SHA1 b932abb5204bdea6502d62ac71d4e2f62235475b
SHA512 28dea279aa1800acfaa771a2fc3ee56cea28e89c0e7539b80f5d921a2638028de15c96019a5143c6372e6a2e78ba369449b26378342c883d6440498e7ac24838
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXvf:A3k03kHRJa
TLSH
T18525AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 1ab23325b3d566f0e996d42bbe76735c3a622c9bdb4113a61117aec429a36046
MD5 4b59373f040e582ec6d4216c91018e2c
SHA1 40a54757c50ce73078fbac6a5ff414796ff73273
SHA512 dddd4d6640d54dddd62d5db1651c9b3b8a82f2cefa0cfdd9b05c0785d5c7c65e4f5dc2cf85ec98f29d50017140e3aef847d774d9397e1710631dfb79ad375318
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZX4K:A3k03kHRJa
TLSH
T17D25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 3cfa862f1b7565f497fef124766f94c36ae3eae2bc54ec3e399183c946571750
MD5 f13b7bf2965b90a6cc61b101c037177d
SHA1 c8352c0bc436adfdf4f517e56929e88434143a5b
SHA512 fc48e1431d156ab346322174a64809aac7e6e098e97876af1d4b6d4bc0911609d1093cfe9ba0912b257b0d479c70b4b992da69c895b834bd64479ad052d9f171
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXlk:A3k03kHRJ/
TLSH
T15625AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 4af95b49b8b1a24aefe355e935ffaf7ff5206daef02ba6c66deb5c21ad4c35d3
MD5 30dfff65225e3ec3c7aadeda5ebf6ea5
SHA1 cf0ede7ffece45d9a76f2d46559601ff0866791d
SHA512 ad1cc00abeea8fd4b1c64441a78ec4def05f9cd5e4fa503596bc806b838f36eaa25e031802f60b7d14110a01f7735d8c9acf07c3a82b016784eb54416dee2d84
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZX60:A3k03kHRJO
TLSH
T11725AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 90e29ecc3188c05670d932b086cbacdf17c41e7d7e59175db804b9407c917196
MD5 933cc9c47508bbe18ad52ff0452d10a1
SHA1 565ecae76e205ec5bc891ec592132e05caa3b16f
SHA512 e97a4eff265e864508737310e8a5e17985a2186a91cd95f9ecf31dd3f01f44770ca48c71976be51b1ded7129adc20245d2e02957988ca009667201e097bb0967
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXpg:A3k03kHRJX
TLSH
T16B25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 f04a4f98f53f689c1ed9678f0b3b3f2387f786274c4399cf7955042dc63e7cfb
MD5 e3a4ef89ca00bbff8a6b0816e0b204a3
SHA1 065410be1d8d01f8d7ed1394f238292839e18df2
SHA512 3bff277439a395d167905cf08db11f4abd8ec34b5b8169e3e05124d0d549e29793d2f13b8ecf82f78a5360c79c808d7f02ba97f3ea3bc7ae10f7c2cb1f9b27f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXQr:A3k03kHRJx
TLSH
T10B25AF13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 fc03da02984607b6dce78b98b8e329a28d6bdc5845988445e8cd15db48b2265a
MD5 bc5648253b0306dc99ecd40b7eae7a56
SHA1 1f133cac5a754b1eaed536965068f5f6a118c0cb
SHA512 b5ede9609cd407b1aff0261d10984933dd2c50e648c233e3575a141367bcb4f4efddc1d0e18adf6be9d93fee7996ac7e95e8e2d2303773a0d0459bfd6388f382
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXOn:A3k03kHRJ7
TLSH
T17B25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 ba4d6ae83a8de9047bcf3015b7891315eedb075253ce623a3d0ebc17f0e07686
MD5 1e59187e90c2efae3287362b4d4a3ec6
SHA1 3540c7bc27e524a450ee58248641359435755133
SHA512 0221272a500f1d60ba5f0be116c90c82163797f772ecd0f736aa2eb2a32f8b2762b6b9feb417e85ea291b920a72f16efcbcd5bdb253b876302cdfcd1a59d05c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXEx:A3k03kHRJp
TLSH
T17525AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 4615b54e609a4c9de93f22d1537e5286e9c1f8bfc4618463d32836477565a1c5
MD5 962e48b3d1e11e8b5193e45e13e75673
SHA1 1ee1ff675d6f4c9f02525d6c548958c4042fb20e
SHA512 bed8586e87270d20dd400cb28ff8164e82b5d8d6602a3d11d2834c08e1312154b5f41b5fce65b964e2b422aede7651e24c51cc81300b89fdbfe63006ce20d79b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXOA:A3k03kHRJ2
TLSH
T11325AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 fe5c3773d3618acf615693c145c0d826c915b2c6596e29d321a571dfe73b97bc
MD5 595d14cb530ab068c09d7e1286264fb8
SHA1 55ff2a734c4ac6bdc1ef20856736b83d5976fd3e
SHA512 b95eebd30233c850b6495eaf5daa61ee51ba56fdcfcbab246b16bc0732ae739ae1c537be9574678225c375ffe44933020fd0b489029c8ccc0c4c51c532132756
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXH9Q:A3k03kHRJr
TLSH
T1E825AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 84b31a86b58987a7ecaf029a85276534a8e6e95135cc1deb844d617b7c8fc6f6
MD5 06d47a8b0ad797629fc0164a1c1356e8
SHA1 a514e4b926f1442aeeeb4b1f15b7c58f83245539
SHA512 c837fdc1b5d2fe59319b6be08c966d0f993cf4911052131c481a8aabdb2b4bbeda46adf2c686183685cdc9b29002a3325bd54e6fe34685b015bca5c3ba75b622
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXO4:A3k03kHRJ8
TLSH
T18D25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 1dfe71136eab19d0cb75616a4c3c5cbad3f1acb4333de7a376eab0aa26d28152
MD5 55497066526fdaed45a9a35a46c5548c
SHA1 07465eb721fe6874ac8ce942ba15e84d6ca97c5f
SHA512 dcc63442f70fcc10679aa9f911fc40e097a67b27314c32bb8392c8f642d8a914e760e99ad95ecc35bac6779ef8a1af2b5f5416829331a3bc8de1e5937a328979
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXtu:A3k03kHRJ9
TLSH
T10D25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 b4f96bac602746cdbe57d5be48a57d3d6628489fab3b169433b16467860067ab
MD5 e1420f9776a0bcc8eb779156bab48b5d
SHA1 2f442e50c66e1410e0de45d0eeaf64752b49bde9
SHA512 8c953b5b478447c84357be31f59d48df1f1c1674f7117b75c72e67c848e03812ede9ed590c5a0d67efe5fc6af2c231d5d3a668705a2b51e6c024f76cf7b5f3fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXgj:A3k03kHRJ/
TLSH
T1C925AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 26502dbe4759b9191ed3e07a3baa501dad00cb516e9b43e6340e06085d33fdbb
MD5 e5f58be692d1e953d0fd90b83eb0d468
SHA1 3eab9d2bbc129e53b119645eba45374f3bfedc33
SHA512 fe7df981e7cd5ec4e1797a9bb39674fb4fb8f84c20f93f220276ccee5a3e67be8839e0e5be9e896c126c4035d042478be5c46652ae0cc206a5c0d333058d6762
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXRg:A3k03kHRJ3
TLSH
T1C625AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 980353433af0b545d7a0c7ab38e2b3b9012749f67c9c141f3be78b3ff699f659
MD5 10b691d7c12fb54e9aacc8ca58bf9b0f
SHA1 a202f91c71e47b5bceed20e73256e6a72c09cf59
SHA512 bf3763d32436a2e689b1c60489320a9e13502f1b79581ea3d2ec66393a830887db3c7aefdd7a9d039568e6c5c971bcdbdff73ba50a01b0af2789c7f61fd7dd06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXII:A3k03kHRJ2
TLSH
T16425AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 d554d2bedb427e7b4caee8ff352ce30c8b97afdd4b7308b4e2181a88e46fedd0
MD5 50d3104aabb1d315fb3117f1807881e5
SHA1 844f2b915e282cfa5b291bc7d0b2c5d0fd3640cc
SHA512 4c452d78ff70e6afda729558a64160c9e803c3042a37467af1de6d95a8b8ba461feff8229866d6d112f1d873f92adf38e673b57285daf70dad2e74d421027b20
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXqo:A3k03kHRJE
TLSH
T12B25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 1076cd3fa55dc49db802fd7e8a0e24dd6b8bc56ca6e3ea994aa6664e07e7864d
MD5 d36a276f1a2e0510b41ee4f243de7cf8
SHA1 8e041daf4c5b52f2e8fca7b7ddd7ec10a893b54b
SHA512 f83d6d7a348668ebc4887504f32f6287d3c4d2277d6ffcca6267d2df2471930e46dea6a94a150944d506b5ed13c0ca499d86274e6803f931f99028cc72294fcf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXB+:A3k03kHRJZ
TLSH
T18225AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 30c78c4c873e247753f884a2d029da58b12464cdee1bb02d74f2316d29919884
MD5 e758e40cbec19c01a4eb1aab2205f13c
SHA1 407d3c5eddf0ce0a41613920cdd8e22c7333bdd3
SHA512 9bce0f9fd2ad69d3c28c083bf6d87af2d82b80a96ca1584878f66dd468860d6b99455fa912f1578895f3835ca17ffe20314e37ffa0285b156a26562a77775e56
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXPQ:A3k03kHRJp
TLSH
T1A8259E13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 1e5271943ba2d6bad87afb89343e5915b2503d17c3ab1d01f3fb262359511abd
MD5 c3c3c3a8fee52768fe202cb922c079b0
SHA1 143057e56b7518822679be08159dcc2a8c547421
SHA512 76b7a93f81831c92f606ec0749f97be8c464b38c477a3c8f6ba81a0f6f1585d8d078a47eea4219b49a1e2953183824c3c67a8fe3a218d04cd78fcdbff5817a75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXUX:A3k03kHRJ1
TLSH
T13225AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C6152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 b731b749922c56b3e3288ac3850aa5b63f0381cef1d13842484955298f4b5944
MD5 e7f5f735a7f480be3c57882e2d0c26e1
SHA1 3ee59290548c78928f48bb15d2a7bc86ca6a5d6c
SHA512 a87fd58c1be2422c56c6947d0c30f96f392879940bd82ef7214191cb62f070f1c5602fce4db3f53ec7537d4f84691c1d555fa4d858cc588128debaf6416ab89c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXyL:A3k03kHRJn
TLSH
T1A825AF13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 32ebb206c14bb0ad592e5d65025d1f804b2ffcd3d5f56e6317ddaf18a0f09f3f
MD5 1826d770bac6edd746d2a7d78132d9b1
SHA1 3ebc2a9459367e1f390bc4dac5010f92f7af3536
SHA512 834a9434ba70a637b5541eb8d8d11e13c2be6664ffb19010292a4e3bb73d019e2f5aa10a37dc4ba9537866163a7b59c546a8f546f754f65f40153cbf95f5515b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXWM:A3k03kHRJi
TLSH
T19B25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 7bfcdcc3b72f887a5fa609b197df0593baa7e38d3ff79779d323bc48c0541471
MD5 9907b1a4122cdffa33646d47cb68a58b
SHA1 4e0f481727ec0b59cca43be7cb0786696e253cc1
SHA512 61b3cf125d22ce81c5ae8fd79b3eb68c4a9c57780c4fe0a6052ef6f1af60942064f7cee7c33cfcffb202714f5fd36f36e0123e81337e343968882753d05c1157
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaplFotjZXfh:A3k03kHRJc
TLSH
T19125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1776-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1776-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3316-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads