c6b3a64ac5965086be13499ddcee019b1dec19fa8688dbbf2d2b367381840639

Analysis

max time kernel
92s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 919KB
Sample260809-t5x5daak6s
SHA256 c6b3a64ac5965086be13499ddcee019b1dec19fa8688dbbf2d2b367381840639
MD5 6b8fba5f0397e4ed4a93103a18032081
SHA1 6186b985ff466a6c9b3f971890979aaf5e790169
SHA512 20e63100d47fb0d04b98788e7a0acb613fc45d3c222507056caa3f2ba188ddf30f27e662e78ca2b55f50b95485177f0f808987f02f11fb4e7c47115f96a1042e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+C1:A3k03kHRJi56r+
TLSH
T131155A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/6112-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001000000001c496-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000016cd1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6112-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4560-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-270.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-464.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-702.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-972.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1015.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1058.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1109.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1396.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001000000001c496-5.dat	aspack_v212_v242
behavioral2/files/0x0006000000016cd1-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-240.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-270.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-464.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-702.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-972.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1015.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1058.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1109.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1140.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1337.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1383.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1396.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4560	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6112	2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4560	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_6b8fba5f0397e4ed4a93103a18032081_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6112

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 919KB
SHA256 c6b3a64ac5965086be13499ddcee019b1dec19fa8688dbbf2d2b367381840639
MD5 6b8fba5f0397e4ed4a93103a18032081
SHA1 6186b985ff466a6c9b3f971890979aaf5e790169
SHA512 20e63100d47fb0d04b98788e7a0acb613fc45d3c222507056caa3f2ba188ddf30f27e662e78ca2b55f50b95485177f0f808987f02f11fb4e7c47115f96a1042e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+C1:A3k03kHRJi56r+
TLSH
T131155A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 43137fd00909ee189bc9e1859aafb203c15aa92cac336421b8916782891ebf1a
MD5 04868784b091956db657ab6fed0de359
SHA1 dd6e29a17cfe1ea046bd523b3de40cb68ee1da4f
SHA512 33373f995dcfebe6e7588684735ee223c0234aa338b89a3a7babe278e1a2b1878fcbbcc402b81bc16425f9e0704ece8fd7bdd22af01c9aedc6818d49dbe2e182
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Cx0Le5ji0hmxNrM:A3k03kHRJi56ruPji0Aj
TLSH
T13A655B16F6A44BA5D06FC078C5D29666EA733C421F3087CB0354DE293F67BD19A3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 934KB
SHA256 e24ed7742713380003226756b9edcef9b4a8d04ef99ea1f4a4654b4c61bb0282
MD5 2b8dabc880bf06d2cc29702c4722d325
SHA1 7db45a7b7361ab8881e8546d1e63287af3043595
SHA512 54ed71861c21ae17dd2c868dd77645a1d17cbd6afdd36883fbb6028289f3d7aa52866c207467a6b0af5299d8e9dd27407f202a9c50d95d6b6af7948ad07605c5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CTa:A3k03kHRJi56r
TLSH
T185155A07A6980FA8D11FC1748A968A62E7737C111F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 943KB
SHA256 dcf11d85b9ee840eb8a2df1a32a2de6995b0311a8bb59d611fafd626e92858bf
MD5 87fffb4200306208f1427efa4f254d51
SHA1 0543302421ba4458bb639d6641d20fe29b2057c6
SHA512 52921f4bda3084a05adedbde390182c3d0f93a85a4dcfd18979052a2855337a57a9dd5660bea72dc0dcec961e2b5a1e2e27785fefc16d7fd03d178bae51f97a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CS6:A3k03kHRJi56rY
TLSH
T1BF255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 943KB
SHA256 7dfd42a0b910348529dc9b97585e2afd7c9ce2f7c4b649c251a15c6573946898
MD5 358d547838dc13ad264df9d5cff0abcc
SHA1 7015bc59686fd5054fe7d7fed7d2055e1a27b016
SHA512 88afb1b9545a9b94745a6e838aa72cd15e019f47aac73182bf68af6fdc8a2e4f9643802c2b833156927c2e58e9071d9e849d04c8754f400c74c02049c67bf5a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CKo:A3k03kHRJi56rI
TLSH
T1DB255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 943KB
SHA256 6fa58ac12e654571dfd763e1df52ed8539a93e769c98a9356fc39a8bdf22a764
MD5 319966a5e2b92020394e20bc08336901
SHA1 1cb392f28ed9836e435c27564b713959bdf07a95
SHA512 1618e6808dd1f03eb35c40017524a4a0e65d0c87e24f288d52cc7f545de44d7052fb1e6304d71ce0a474fd8b894581443dab2e046e0bcb4a45a57177a121209d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ceu:A3k03kHRJi56r6
TLSH
T197255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 943KB
SHA256 5d06ba8761b3e8f3c03cd5406e36f6a4cba52c8c99ae90874f7c353264c5e137
MD5 2eaa82c1a13eba2f8f6e368cb5bcb06f
SHA1 705a673c159101579aded1069d797067b05e2b40
SHA512 fb855efed59f9b63f554d2b8c312f852324afb25a7e6ae4f5a55551a21e345aaed6cb443cf4d20da4d2a44ad6963c2efee8bfdd388d273411ff5837dba31f788
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CS9:A3k03kHRJi56r7
TLSH
T17F255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 943KB
SHA256 b15e6ee29a59f1c2b846ff2a6cf0a0bd3d55b5cba929e046b7bdee5df1fe6d23
MD5 fd5ae76c8e3ace1a63019776ebca466d
SHA1 c7a6824f719b7391c5d0f3a37585d484f1a84d5a
SHA512 df5803633029889954115bb25277ff6ce7e5e52842db71e20e070d04847c0613425d0997f1afbbf8665f763b78123a4c232b2d71f034e2a7e9e1c6743c5c538a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CSc:A3k03kHRJi56ry
TLSH
T12A255A07A6980FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 943KB
SHA256 0271857ed3354a5d4146a8e94a99f7281cd334f0f780910d214a393f2058fe04
MD5 f256c522b13d416dd1e03c118ebe0170
SHA1 18cfffcc091a4ca717204631639f3481ace4e75b
SHA512 37c22800b2d6ba8c1e7b46b96c86c49fa9c66d7acbabb93c17b21d4dd7b73e3f15095140ad9d87ebac8a92db65fb75ac4a7c26c70379ab08622cc1eb1cd2c178
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Cbp:A3k03kHRJi56r4
TLSH
T136255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 943KB
SHA256 ceabca3a8935915d21f8b67aac152c4e93810f394bac232421b5bf74d2cd03ba
MD5 578bfde2c297941534e76f9e9cf46a0b
SHA1 48bfe186f6c1868f03dcf7bcdafee8a660d1b28f
SHA512 34df500718cd7d1da405f8ec5e53f230ff8ad2dc6d76f8439e274dbbe5fbe6fa5cdbcaf0d7fddd241ec02bde3a9dd90ebd92dafcaa5878a55a4c45f3db9dce43
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CsN:A3k03kHRJi56rn
TLSH
T1E0255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 943KB
SHA256 d8b6a0b0d51a25f68b26f5eb04a3364796ce578bd3b2f2a702cc9d8d2c25aeea
MD5 9bdcbbfb5c5a8892f6dd808104b777a6
SHA1 62a8808aaefd899f7f5cb33728e092c4b56a0219
SHA512 ad07c47d82e0347edeeed6d189841c645bfb76e6fb6a2a42c51dcd61497eeab8d5e3bb2064805c57c10ee3e9a4cde4c9936f2d8c4717c62a89e89189d08116b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CUF:A3k03kHRJi56rh
TLSH
T1DC255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 943KB
SHA256 3e962946afcd3fc00afed1028c44315e51ed8ba5bda166c2a5832e88249fcc12
MD5 2e93fdee81be26cd3703be24182e24bb
SHA1 49c99673f723a7dd37765fb34f9151915a30a72c
SHA512 8d98161cd841071756e74ed9d782a89edd82577825c24ea88788768a76b8e7130f95c3e13b882c5fb543d99f4c23054f9dcdaf14827ce532a80361625bf2c815
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CxC:A3k03kHRJi56rN
TLSH
T1B3255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 943KB
SHA256 b3509dbfec3422c97f129f9c438bb7a62d51ab6fa95a3b933c40ffe7ce229126
MD5 82ed72e5657626a3fb18abae79d30504
SHA1 f48c35a0d53e0d176872366e97597b023e1101eb
SHA512 04eb71f830fccee2b578a870333104a0badb8a5ed615111ad34b91b39d792daf5b950499e87ce124c7b848320c31c6f0a998eb7369152edebeb889155666843d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CSw:A3k03kHRJi56rQ
TLSH
T134255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 943KB
SHA256 0aacf940518be5574e7feb53981ab38caa740c497376a30b9482f843caadaaff
MD5 7e7ba5ac50b4c1f1df0b16dfa7feb4c9
SHA1 4fcff6a5c1acff29861dbbb3f55b3919934c05e6
SHA512 183c21656876a1228d708fe86811808ee3a5a9cc20dd1ca7f668ddf97e99c77c3c5a57801c6d3830b573995f05c64ca9892ca4b2cad933376995522fc4b845c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CZT:A3k03kHRJi56ro
TLSH
T154255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 943KB
SHA256 6b1a716d5579a380ee01580e38f9905b6317fa03d87ced62d2cde5e6dbe8ad36
MD5 ae7f43e95e8ed4a55878a0007f65ec30
SHA1 5ad2be63f5aad75904149e074aa0a7fd50eddfba
SHA512 93f0089c250aa8d5de9a1d6a8165d0c02a3bc6596b6c921596765d497d386fb7a1ba99caf2c40b1fcdff21cd933dc77d3b64a5f554e064f906c998d5ed1b2005
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+C3u:A3k03kHRJi56r3
TLSH
T132255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 943KB
SHA256 d65e94267e9c1c27dfa19d630aa97513bca491ba3b506a21c8e098f60e8620e5
MD5 c6436bfcf352a2329fa5c90f1e4bb62c
SHA1 52d18b5140df1d2e9496c1b9fb8d2090ad2cfefb
SHA512 85005e655bbbd16f70fd36929b0fca9089d82e13db9ec70f2b5057ef984602100f751d66ac867037dfc90b80d1438038e8ac77232dce27542b7bcb0ad4d4fe3a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CLb:A3k03kHRJi56ru
TLSH
T120255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 943KB
SHA256 c2d18c0a1944aca58c5320e8d04ccf830127ceca28a8be49e68b9092633df492
MD5 dfd3fd1590b4ff0988e5321813853f2d
SHA1 1af20c350812f00d3abfe46515d3da86eeb3cdb5
SHA512 f196f94d717aee9997842a421ad56b6151bfbbc24936fd4a75b231df0f583ef4cd455be4a2ce44f4b66750d4373d4d639d9e5642382162cf4edc51f3e361c6d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Cff:A3k03kHRJi56rO
TLSH
T149255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 943KB
SHA256 4a3cea31f32dadd9740a72fd96dbed8007cef37287439c936fb32ec0c4cf2330
MD5 e16c4469110d87185c8249b5f03f9ccf
SHA1 8cb0951f0bbfbdfed2be1af0a347288a71909399
SHA512 e4ee05823e9620f86fcb74274e8189d1db336a8d3521de1ee7e590476c23945b0817b09e562fefa5e796ff6dc227f50d25ae51bb1c96700c0cd4845616b8edd2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CIK:A3k03kHRJi56ru
TLSH
T11F255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 943KB
SHA256 2dc241c173202c5c1a9a311fd0099e702376d7c2257bbeefa8ff82576e3fed28
MD5 0b3df4b8fe3b3b3083da1f552d1a6521
SHA1 a9953aab2e28d2eefd920190fd2e9302078e520b
SHA512 39d81dc3edf4d5dcee0d167474c6b624c8d098ff5a6192e9ad5cb88de9ecbc55b58ea0ed148e862ed3e00af8d20e6bb1ed3fbed0c8bcbf74f92c6713fd7d0916
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+C1k:A3k03kHRJi56rT
TLSH
T103255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 943KB
SHA256 d8f86ce5326e4defd5ee746facb25948e38b2101a1175216f97b4b4320d315db
MD5 659b3b3b170f12f36649f3b358e5effc
SHA1 dbb4a604c1c3de835e0d47d75ac4032959f191c0
SHA512 7578e24177738448ddec25cfa104be870ec1e9da706b782faa1540b9e0b1e2c913a8e402940af0abf4e44d9e7cc8a2c4f330ac3320dc86a5a3e11f585d6dfb37
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Cq0:A3k03kHRJi56ry
TLSH
T143255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 943KB
SHA256 1d0b0325e5d9fcf50c22f93b2148834a9c0c199761e72b65a62b2a2d548a3ecc
MD5 352aa84252beb80f5d78c643ac2604ac
SHA1 d7437a5e188d884ac2f07487414971fdf496f26b
SHA512 2329c19575d8227cbca58fcf3e10ecf63b18ba70628a236f346c34329be2491e36b4024a453ce3fd8789a8a554e0545716de56f23e4f2b0e081c971c3c50a703
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CZg:A3k03kHRJi56rL
TLSH
T1AD255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 943KB
SHA256 f1ebc92c38f1bdb72a5a2114707e02219cf12349d2795cc14d7b59f57320ed3f
MD5 8c0b0f7b8312e21ccfda62568afc4a16
SHA1 9108a0a1fad2dbdaaa73db9d28bc8506a8f0b6d1
SHA512 54577228eebcc3b4aa999a22691ec178a5b67a224bd85d53c9e493d4cbd36cc86014bd11a482b437c75d4d6fee7f67cd6751aac36f4318bd4490f37c93a1c4e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CAr:A3k03kHRJi56r9
TLSH
T151255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 943KB
SHA256 cb405b8c347b65fa12f7432262c15eb6fa8a68fad465137e593afcdc6fe40692
MD5 d1b8346e9a2af56385680c2bded1d65e
SHA1 8a2d1bd108d85c6aeba4446fd8618a36d153cdec
SHA512 9b626197490a307a7925b616a3887a0e3ec0335807661e1644654ef56c9c21484804aa2afe4bba7f1551f93c444dfb6864543cb7552fd6af3875cd051969506d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+C+n:A3k03kHRJi56rf
TLSH
T1F2255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 943KB
SHA256 d68a54283cbb9dc83c032e046a9c4e8d36c43a67ffdc6c4797608f46011dd788
MD5 fc9238556cd460e7ec33b7fd1b4714cf
SHA1 4def959d865540ac93fdd8f1e91898750ff5b721
SHA512 e076652a1ccc6f3f8ea50b53498a938cf57ae378ead83b17dd2a3bde5409ba2d1988fd6a223f5c8cd80ec8b7c9b05c331f064dae08464e2f7651204d2fc3edb5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CUx:A3k03kHRJi56rl
TLSH
T110255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 943KB
SHA256 8b71fbb50ab36d5ffa75ae539287d3a8b1cf63f1077d3b24df0cf64c838d7957
MD5 dcb980e69bae4ae1869010aea1b8e54f
SHA1 fa2d163432926dc8bc16fc569ea3f48bd6f5d7ed
SHA512 91b121635851074e3211d2c41ff80d79ae305415f59dd9895b7211ae9ace0785b3044f75ddad8849c323be63347b2a20612511c7f595aa7bb8d8d60ead4f22bb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CeA:A3k03kHRJi56rq
TLSH
T195255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 943KB
SHA256 7f9bef643aa75498c06296e18d263dc0942a798d25f32b0ee105b85eb5af8354
MD5 fd55f22941f35905cec683f84953d80d
SHA1 87d2c81e6cc1fed6d0cd66a87dbd6221f5ea937e
SHA512 a0ed6d8fcdb14896f21938712252dd8ed6fe22ffa63d92187585674cc2a17879a60d8808f102b740926415ba217d5790439243bacc2ecb705d06073c661fb79f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+C39Q:A3k03kHRJi56rX
TLSH
T1C1255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 943KB
SHA256 b017cf772fc9f7d9390e771af494c46e1ef66579fe4ddbb068b438d87f918ed1
MD5 e5aa52de12af5009fb55d3d4aeb2c55f
SHA1 bb970aa62f95e62ba7bf1c7b60936192bb125a74
SHA512 b8ec5bb2f32817b9c6968d0c05936930661ee4ff43831013a06bba053dafd7ab809adbd9a411a32cb7c2d66832b64dd5eb9d6acebe7fdeaaa901879118b7ea87
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Ce4:A3k03kHRJi56rI
TLSH
T1B1255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 943KB
SHA256 1268b72dd6ec288343067d8b3de7c926799173dcce81591bac036fc89aae48e6
MD5 150c54f172a9686b9737a00c8113df5c
SHA1 d77366ecdb93a6e1d65581304db82d101e319152
SHA512 14311a72b7b03b056e424a92e1e62d048342a8354373f61d636109be3c8715eaced9d111d8f9e16201e05aaf29d335e061b0698e4e7f3b1eab0d742a262b8e9b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Cdu:A3k03kHRJi56rZ
TLSH
T16C255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 943KB
SHA256 e2ac50d85dba6dffae18378d4b46d13099a227a21dbf07874ce960d803c6b472
MD5 611f6aaf490be2bcde9d52d262fae88e
SHA1 c7d0e446d3a6807b46d06d6786d6e79484b4be6c
SHA512 780f6ab1b3b75a71045ddfa7bb609dcc443dcafe5bc3e8e6e417e9087ef2bc64a47e9b955a5c7c97cb0312900f0aac48906c073986c95cb0d77d11b81bb996fc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Cwj:A3k03kHRJi56rD
TLSH
T14E255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 943KB
SHA256 be78f5c64e2cec151289a11cbc1f55fb4bc192659e4bf64526cc24dd09a94882
MD5 4eb2085946e9a60d4ec835a0d0027265
SHA1 12bf59431f78df235bc60eef91dc1614d3316299
SHA512 10f85aae34e66fefb7d33f050d7bbb2a86d12a73762eaf355ca85c59d7b1900853c3e156cbcef596efd2028d0ca5fe26f5b7a0237df0746beae8ea7a6e885500
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CBg:A3k03kHRJi56rr
TLSH
T112255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 943KB
SHA256 b42f6ac315d74af6178c5505cdc217a23d139cc1b40cbd3a740512e9c2029240
MD5 279dc778555106cda34ab03153fb8aa0
SHA1 f3189c57ea5bbeaebbf9e31ba2b26c89e030c5ad
SHA512 5c6d74bb78a50681f996fc41f96e7a5414e01fc28f0bcb3e8a0c8623468fefcde0335235b4b3b09401705ffa9bf4b619b23ae2751b638b284635a82f1c384483
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CYI:A3k03kHRJi56rC
TLSH
T12D255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 943KB
SHA256 eb3a1303a5b61a8ac6b67aa561f276a35a0d61745bb069f32d50f7f5cafdab00
MD5 9769177d45adf9be900960474c4bb3ce
SHA1 f2ace9d50967ebe6164354eb7f370f1c339b8959
SHA512 7678240e26c82a259e4adaec7bc6fd85bebf968da623b95aa0a750007efec3e294a89c675e787cd841e4d60cd921b7744aa7f4091edef66cbcbc31ff60b7140c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+C6o:A3k03kHRJi56rg
TLSH
T108255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 943KB
SHA256 08fc41e088720582b4f49834bb3d48dd05e3bb14e62af931251c9ac23fd171b1
MD5 ebbcdf040b37e737ac6e7d89586de6d5
SHA1 2d03ededb6d3c4af79d2957337a1540d3d526c66
SHA512 1887fc73faabc163a7b55d835a9dce1baa0823b266de678fdde643340a1d628921c63954adca52600d9a49879cd2da42b7c2dd11e5997a44baf51703ea417b11
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CR+:A3k03kHRJi56rN
TLSH
T11B255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 943KB
SHA256 11b44e977b7c78b39338852da7ce4cb5d7e16188787b32f183ad5e05b2d32d65
MD5 9288d7e3243de275b0c84c5f88994494
SHA1 fd7009fdfd1766489a8817bcd6d360ac1de4985d
SHA512 2c9663b7fc7bd9c4ad5c271b7fc0eddc763a7e0db917064f1025db18b643d271ba4506b3673c00e9e5264ff39a913f2549098fec0978597c13cda40a0c1fb333
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CfQ:A3k03kHRJi56rF
TLSH
T161255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 943KB
SHA256 423cf06a8333af258e684ece0195e8c69b2de99357bb72460814b5e7c29f457b
MD5 abe4ab4a9733597a53824a30232220bf
SHA1 85f1bbdf7ed3fcae7eb32560a497be98e3fe471b
SHA512 8a63fe23f00568436a508896190a6545ff68acbe01383626f686b0a9d0b78e528f1c91354c575161a025fcdb788f929481a2af7dc56b56f1f257dd4d7ab9461d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CkX:A3k03kHRJi56rR
TLSH
T156255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 943KB
SHA256 6b1887aba073458dc79a42e3e2e4723fe0faa691a0ccdb63623c4e0110f3d97c
MD5 c3f3d675f956d9aab2f106418cb62292
SHA1 b3abf6b27f9ac9c942e8478f163a208b3c5a4f9a
SHA512 958cc1099e152b16e0171f83a8aeecd751e1a669ad8cffac4dedfb1fe0a2f3d17548cd718f33d783779427b169b0987034d09878223b92e9fe403bfa48f4274d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CiL:A3k03kHRJi56rb
TLSH
T128255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 943KB
SHA256 0a4611b430605b71d9e134632617a81d5f5c72db3f1eb74b25ad75d86925c807
MD5 180053f20266cac2c2698ace2e137328
SHA1 a04fa6129c1a752b70e704dd142453c4a78af9d5
SHA512 08c64c578ca147f8eaf1a8653218335105e571eac20de3025dedaa9f1e5493565c072cb13bb4a9a6cd5281701b4b1601a90778361d6564ce2a8d5b097290cba4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+CGM:A3k03kHRJi56r2
TLSH
T178255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 943KB
SHA256 ebfaea93ddef3c8f9dce62075238a71d7acd1f8a15deb03d5a19741ffa5058ce
MD5 fbed304294d2d3445870dc2dafd33c69
SHA1 517b4d65d593db49b0ed73eb7abfb5845b9016ba
SHA512 11e4d588c74f7f3c6b33dd67e15174d568b2dc8c2aab17dde4ed8eb72c144e6ac09c50056a9729174b76c04adb9a82b09faada55fe409844ae25322fff7dcf3f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5TvinrmyH/Q+Cvh:A3k03kHRJi56rI
TLSH
T11B255A07A6890FA8D11FC1748A968662E7737C121F2097DF1354AE253F72BD0AE3A357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4560-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6112-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6112-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads