121f846303b4892da81ef10a26f6b21e267db0672021a3f7f394c74e56e0b85b

Analysis

max time kernel
94s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 910KB
Sample260813-e7bxla1hqd
SHA256 121f846303b4892da81ef10a26f6b21e267db0672021a3f7f394c74e56e0b85b
MD5 77349d807952c5b07c9589f2b7b663c7
SHA1 961487fd2b2d2745af4742a9d8236092fe0f376c
SHA512 3ee354294e9df96cd0dc44c19a2274efcbb8f1b0720c6bb2380d57bca18bea2f0b19a8a18245dc3f51ffdb24d2dbaaf8cf917b38fe2eb7e0b3ce13ad3562e484
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbu:A3k03kHRJD
TLSH
T17615AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5424-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001000000001c545-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c552-33.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5424-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2084-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-556.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-979.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1034.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1116.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001000000001c545-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c552-33.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-489.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-556.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-727.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-979.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1034.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1060.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1116.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1210.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1319.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1363.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2084	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5424	2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2084	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_77349d807952c5b07c9589f2b7b663c7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5424

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 910KB
SHA256 121f846303b4892da81ef10a26f6b21e267db0672021a3f7f394c74e56e0b85b
MD5 77349d807952c5b07c9589f2b7b663c7
SHA1 961487fd2b2d2745af4742a9d8236092fe0f376c
SHA512 3ee354294e9df96cd0dc44c19a2274efcbb8f1b0720c6bb2380d57bca18bea2f0b19a8a18245dc3f51ffdb24d2dbaaf8cf917b38fe2eb7e0b3ce13ad3562e484
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbu:A3k03kHRJD
TLSH
T17615AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 c7642c2b924d4349dcd26b7890525bb20d7cb68acf018c6774235eaea075025a
MD5 8c360370a2e6bda52bc217821fb3111c
SHA1 ef80fd1ed9560169cae719d57a0b20dbf023e4f9
SHA512 ee1bae0645b6ab9154d48bef9055a3ba2e73edfd9e82eba153827af259351aaf6fb1ac98af4813d3a9c6b80016a243af06e6ff2f048bc512fc869bc55c8c662d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbe0Le5ji0hmxNrM:A3k03kHRJ/Pji0Aj
TLSH
T1A4658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 924KB
SHA256 e57db1e8c4f1e8054d0aea56add173b51d2ab024fe1c4505c6feb1ae6f8c2fd9
MD5 e59b4e662c20027f473b5d3a0ff2b962
SHA1 c983d370ec74a55feebdf01ea66163c1e8f0e1f5
SHA512 dc1415e849dbe6530a20e5d6b02c917d6626403651b01cbff215a4a5497d20e6c1cd54e96b61ab64523d987123e4990cb729b044adcebf8822a7941b85bae5fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbYa:A3k03kHRJ
TLSH
T10115AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 933KB
SHA256 e7e4a0d100cac07b21d620ee3e5eb39e6913dc17165e7722ab9c2db7199d0bad
MD5 4bda0667993f1d71b3fd226dcceed11b
SHA1 1fbfe5f030c5c22c57a57f2f9bfd2d71a9ca54b4
SHA512 8727cac33a0eb45a0c234d6320f76318464208244d0b24658012485338d1d88c117886f1283e098365444e98cdc9a13441950781736b16e5bd967dc112981f79
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbx6:A3k03kHRJH
TLSH
T17215AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 933KB
SHA256 8b44784d192f1384000ea6bb3106545825fcf9ffb334d328f4633678c9aed4e7
MD5 b88e4f35dc1219d240a208ea1601f51c
SHA1 64ab729b407e65f0077752cb284addc27adb1518
SHA512 c93c72286a6e4946e460d2a41123eb051c65008507744b578619c2034d74b9e41fada4c27e643e3e15a717569435dac1a2760589de600d26f2a48eaf9bc0e3c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbvN:A3k03kHRJa
TLSH
T16C15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 933KB
SHA256 0b37aa13c7d591b4b59f393f6960e4dabbb10183550750d70e19c4a4656414b0
MD5 3ace30e9b8219561bd0cbdf6156e428d
SHA1 01ae3cbba75b4c21e49a32fd97f4c4b27e2b2d87
SHA512 b2448aeeee139cc1a238ca9bcf6113852ec6a3d1b0f2648634cf2f412c690235519140bbf6ca52de40ff89a5e3137863665b7781a2b70c05d27ce23a728d62ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbVf:A3k03kHRJW
TLSH
T10215AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 933KB
SHA256 eacdc0d584d32575225a842dc55cf962187e73df54b8ab4c74e9eb35f0ec5ef7
MD5 b52bafedcd6cb73cdc1ffdae81716483
SHA1 10df7fe23addc928c027c50e20a1e23a54102978
SHA512 2258fab3bb7ec4717e82af44c2b8eca7aa763d27d26c3c1f49e84d036a582576238fed0bb46bf0238e2e4c3fba07a0fea25ef43b9f249f7e805f579c93285c75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbXo:A3k03kHRJ3
TLSH
T1DA15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 933KB
SHA256 cac2c83c1a3de11f6363eb3d3222423684c1be266a7902ab076fabd2311c3e90
MD5 9728f75d98853ad1486b3a0a0f0635ee
SHA1 24e8ffc28e79906193e404e95d4634da9ed42e6b
SHA512 206b4584353bedaca3769982a98a2ee35c1cd5c358945aa4d08c0192971f3ef49f9b53b9e8c4c410cdc381a37682f7718a20ec5c9616095c56d5fe3ca581dcf7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbbu:A3k03kHRJ5
TLSH
T16215AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 933KB
SHA256 f029d1fecb8fe86917073d894efc78290ffab160b9548185f02553c62843266e
MD5 6b953c423e42f36a2f683e69eac4056b
SHA1 90c8ca2017995c032b051aa1f5b4ae75162e873b
SHA512 6fef2299468d8b25b0b5aad3b73dac731e2064af34ea5b53edf2f8839e65b272694d5ccd30e7622062fcc1d561e412b78bb5ede5c895d7ec292336512b29e8ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbJ9:A3k03kHRJ0
TLSH
T15815AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 933KB
SHA256 f324a0731a38031aeb75ad2cf277324156a63d7c17d2eb1d62ffe07b1f938ea8
MD5 2d3cdcef4e1d1192c5637bf5592a6dfd
SHA1 d97415ffeec6f175579675e42ea9c8db7864507e
SHA512 b772272e893b7b71d7752218a8f49022ff0575cde6e5413baa73d7a6964a1657e497353d60b7788b3ef126e925dca9930fc6d6c283a86195173efa1a2442204a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSblc:A3k03kHRJd
TLSH
T18415AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 933KB
SHA256 82101214ce1de7ef21782d912bb5ddc7c9107b669c1d4097c14a60f060b084cf
MD5 b4a50adcc24162f8e3bbae5ffa97b3f3
SHA1 287f2a025e31e09cbc1b67bf975bf27644f030d0
SHA512 e61a47368d2ffde84818e4f990a3f39fb6e10a59cb4d1b19d6efd9d2be0abc1684b07636d29115225d90779cd39149273a56bf0e0ec31d87289a28ddaa069d44
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbep:A3k03kHRJD
TLSH
T12A15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 933KB
SHA256 a346affcf9b1f495630a0937089ae76e5853acb319244c862ea2eaba81188aba
MD5 4d67fbd10ca2aaa597fe35a6a2a6c55b
SHA1 10a88d50b07794dbdd1ccc6f7133a4d843e0f76a
SHA512 c172511a488a9b79c17394907480afbbdb4a2769aee29b1dee7eeadc80f70bc629f2f38103322ba807b30271b76270388a68641f7167fd5e6a96639c50be6d96
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbRN:A3k03kHRJ4
TLSH
T1BC15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 933KB
SHA256 6aed55141deed25b119522bf5b9c6adaad25bcd59bc3eecd3eda046ea13f19bc
MD5 0b6f7ac7670b1a357eb8349c1cb2b5b6
SHA1 8a5d02768a466571699a42ccfa7c65680f484496
SHA512 089abc957c8c2b26e3152d63a41c6b8157fe83226b1f13fa0ecd4a20c0397d28dbdb7bce26dd39193fb3e227096e5adc032ba2bde6e0418e871692f2052251e5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbzF:A3k03kHRJO
TLSH
T1F115AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 933KB
SHA256 2a87c07bd4012ab982a63cc04dadd9ee74055a4f52af61aa4ee2611501927185
MD5 6c2b7f48565c229a36f4bbcc9381dc51
SHA1 ef920815afbbde5adf3ad5f68e3dd6fcc4a11759
SHA512 7713f019a1938fbdfa1c25b4d156f379259c3a06685d0aa8e17b80116da70e1c4d0630850f84b7f9c5f3d721ac0d75bc81be8e4bd72df6301352a18dd3cdfac3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbcC:A3k03kHRJq
TLSH
T1AB15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 933KB
SHA256 6839533c960dec4bd3e75e25645d5b66bc12732c93b9bd5727da53ad05fd151a
MD5 b9014cf64ebb4a348d6d5a5ceb3e38ca
SHA1 06966566815608dd2e0d0144d88ba222bb76c691
SHA512 a797044108692df2fde599293f013411b723ff1f7502aeb075e8a35bcaea8f059b613cdfcf392d489923ed78ec92d0a1d0a053bdd800e652f7e40c61d7692eff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSb3w:A3k03kHRJ/
TLSH
T1C715AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 933KB
SHA256 16d134e9758d4fb991aca0e7fa87e6d7e9f492df63c5d4aea8db9983de9facf4
MD5 fac69133e8ce332a763e0cbf6ec0991a
SHA1 d35cc4b70359539c985ca363853e53da527e593e
SHA512 bb56faf8ef4a5f513ce3278ad751842fbe29dd3736c3b722434e8d9be076a291c4c9fa5d3b67aeb44cfb3b0b7957993b32bbf244470cc96a804ac1587dec4d3f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbmT:A3k03kHRJb
TLSH
T1D815AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 933KB
SHA256 e7e192408a668c8d5024a12e0a9ce563fc33455c86845f3aa5b0f09d857d21b9
MD5 8243da3497803afe3d1833bdae789ecf
SHA1 75d5439290202aafe2ad7b10aab65b48b082e6b1
SHA512 a838a3ae126b7892abb5a521b49d01b0e28594297f21d09ef3d30be357f391cebdde3a7d65bcec747dd8b73652664c9f8aec8336d6ce2a3582c4064840b97a2c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbeu:A3k03kHRJc
TLSH
T11A15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 933KB
SHA256 76bd3a6a9995092696a56a4f2923195509ec743fdd479e0d614e906dc060dee2
MD5 eddfbd34ca8bc28c8939843fe90e63fa
SHA1 9dfe3ffb02fc6e70a70eb96fdb745bdb69b84532
SHA512 b912aca79de76a11b100c93febcd64b6ea72059f7adb65538697c07851a6fe710dae9b72d8523735c375caa7eded0dcc2947df1a3000d05b5952c97f17351398
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbYb:A3k03kHRJ1
TLSH
T1CB15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 933KB
SHA256 0dc62f7f5e98700ea268bd74a1234f4dd455e848371fc8c26ba323e40680bf23
MD5 296d33db44e03cc329ffefefcbc89f29
SHA1 45bbd796f58aede5b84256a4c4188a3c5946baa5
SHA512 7f1d9733261737b6a75dd9fb9353ab2e4209afb4e56b29d4821562bfd0752034454920294948ccb5d6e829f59352c405bb6bf36c5e3dcd4716de70521a3e6fc1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbGf:A3k03kHRJ1
TLSH
T19415AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 933KB
SHA256 941fcf7a6578d8e690c60b31f92dd010e3509c3d9280b0e234f4e1aefce8e159
MD5 1e1150ad6881d1a807e633e392fa2e09
SHA1 508dcfede769421615ef19922b4dfd6116947441
SHA512 5fc542ad14c4e7f8185b16790518af43fd80e70c2da3ed2d6529915557573bc99b9f54b92961eccbc9cf6084f51ecb5ba838f50933f602e067c9e8d150a5c989
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbDK:A3k03kHRJt
TLSH
T1E815AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 933KB
SHA256 7b7c949b5e7bc5f7e8d797019b4a75f4e50dc48eff9c6d0a8e040801c784b4f3
MD5 413caae358e5c003ede7d5bec72a5e28
SHA1 49934230d069367a0ca2fb055f69593ac772df86
SHA512 b0647a68edb1db042b8f03d55943130a7174300981950ee75146b12f0fe5f21fc9a715aab5c0aa84efdb428d76cc1f73f6a762c22655fc155d4a7a446f12b598
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbkk:A3k03kHRJE
TLSH
T11815AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 933KB
SHA256 5d3b96b7465d2e54b47ba89008828fee55c2c13208dc6dd4ca64466a3a903836
MD5 8eab65605cd6f17eae6672e7f3224bfd
SHA1 97723ad7c44659925fe761a54f52ffdd8ba83e61
SHA512 55dd18e8ba406c38f9b11a39bdaea4ab813ed9a3ea1045cc8bfa7ecd7f31d615f3bfd550e0fa16daf75df8223ac9c4f4a33462fd440629c331c9626dc658e263
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbt0:A3k03kHRJt
TLSH
T11815AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 933KB
SHA256 c62981a31256752f39bd925b383032b0bc9e3991b43be6303c843fb3398c4910
MD5 27b1de2056da279285ca1cfcd7103d12
SHA1 9a6fd813aeb7b8c7ccef884e85fbd8d6916dfdda
SHA512 db7d14b2c16feeb1a630874c54cedf060653314a8734867e60a946338ef3ad73073500c188039351df5fe263a20a71c24f20dd32b27a6f778262a28e264fcaf8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbwg:A3k03kHRJc
TLSH
T19715AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 933KB
SHA256 e2a72f527c4a2c886115fdb9d3cbd1ebb7dcd0a7b93fc13e3c481fcf7d8b7b4a
MD5 01dde6c13069d6486749d8f9db4b778a
SHA1 e3ef04d82fac7807ef4b12f6539099d23f0ef20d
SHA512 5aeb05f2b911d82143ada731d26755c450e42e6881fd89e35bd640550f72fd435ae96c6ea753b20db5937b8d1c0c800068a7e5504f4bd244fb8adce9e9e015a8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbFr:A3k03kHRJu
TLSH
T1EB15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 933KB
SHA256 4d506dce2d7fedac9790fe699149dbeab8cc6aa7a599e5a65b86c34a2e00d558
MD5 60255ef09119a42663d08bcd344e46cf
SHA1 c16d8a2ee0223f8428651a875bfb83e4718d6b23
SHA512 3c6eb956cf47e4fd5c3e84df8be01ab0252729bb5df67082e71987d5df0248a215ced921c9831a3564aac6bf4b2568f1d5e3a7b2d060c7ac47766d27a9fd5894
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbPn:A3k03kHRJY
TLSH
T1B715AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 933KB
SHA256 9af12f0e566a4910185b526fcc524f18303f248a93cc14f6898c8e0d532f1ca8
MD5 7a20c15adb1177e753bd956e8d639d4c
SHA1 611d327035a714b0f496f33ee699833149fd52c6
SHA512 4d44b23a89e3118f24bb889d42f16e86b5190214de5985e68501366adfc928efa4d741ee82fe40f4e1592e1e90251d3de633c4fde6dd3a3d0c806a77d417bf8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSb7x:A3k03kHRJO
TLSH
T12D15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 933KB
SHA256 acbd0f932ef820a51b7ec79a6c4491157e114fa2082c5fdefb1c5557fe085da1
MD5 63a5c271d1eef78a61a821fad2a37487
SHA1 307d7537984e0668824b99af0c1c25a40e14b6e7
SHA512 11021dccbba1116c28d3e6bcc86fe81c411e48543c82e34f8d9abda23ca594a480fde41203a54bd72d0d54d07bf11469d3b62b45d812da976e435452d3d84a3d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbpA:A3k03kHRJF
TLSH
T17215AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 933KB
SHA256 36b2b189e790ada27f51e0bbb34df3c6d67c4151afcd3b7cacfcb8d1bbbe2913
MD5 959e4b0c0b416bef501e365295606231
SHA1 31fbefbcf0af645a822c4b540abac8989521b0e4
SHA512 fe4d731f3128c534401fa3da516e7cb62b947c6ace844ff6a04272c3044a2c440c96cd7c266f2e2aa1a154db0756570622c354c52663b79166b83b485c228438
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbi9Q:A3k03kHRJk
TLSH
T18D15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 933KB
SHA256 7856892fdaadf74b5d44cdfff1b4f05cb3a0eb547396c142c0c2ec05dc29fe73
MD5 a2fb5d8f426288141a23d4807ebe1801
SHA1 68ccb7d47f74c40c702378551dafce7aca203308
SHA512 e3f7f266a99aeb0c7cc1786cf55b8795a9fa129286b4b2526cea4f15fc3ef3d3f00359b0eaf5394ba20cb8e767c2c746ed644033f4e7aad2671285025abb3248
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbH4:A3k03kHRJP
TLSH
T10B15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 933KB
SHA256 ab82e06b69b898d35c057268e712cc87933d5276941f2a48122590966922c5e6
MD5 0710e14b0a35da7540371efd8106266c
SHA1 d8c76ab41e820e1c3c28ce3f4d477b287f8289b2
SHA512 77793c6e71853fe40afadd1261a3303d4d0909500b40c5d7b5f4ad36e833aa16befe836e94b95368421515c021fa94f5b22e66660ba4461c6c7a976abcca05a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbmu:A3k03kHRJC
TLSH
T1E415AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 933KB
SHA256 e9b3a24d9346a5c7b66b57ad026a3dbbb9054d719d56a1c3e7d6dc57951739aa
MD5 b13fe4e2ce29c36f27da5515a94487bb
SHA1 d557a71dc097cb35b463c91eb24110354e0ab2bb
SHA512 8ac098dbc99c78a73906ad3dc73151eed5488e1767aae11fe8af2908e25ae915fa290ac2d2c17dc1cb1c0e337de81064280df695fe9011f058b51c28e2cee001
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbXj:A3k03kHRJc
TLSH
T19615AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 933KB
SHA256 4b51aabda2c489dde01e989ba9b00cd5c25595657e1ea7c9433adfeabff6e939
MD5 c72d8ad4e0ff5e4fce803c559fcbc856
SHA1 bf3bebdc34463b7790b70f005e47c6d6cd368895
SHA512 9d1406950de18e56eddcc0fab1390a41a8f275bf233fb6c65abba7217f98f58679b1f8890e748efe508d4b2818ec36c17402819fa4c43d589f8d6104b4828f8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbCg:A3k03kHRJU
TLSH
T1E415AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 933KB
SHA256 f2f51b9f66ef5dda05d76076cea0df2e959d746603efa38002dcc0e76c620224
MD5 956094c792c9e794d4bf834588ae9b7b
SHA1 aa941f0e3ae82133bfa7096f8f6152e9fa668c46
SHA512 9db401a0240a0862007a80a611793d9a139e9a0a2a0695ce6f62c1a1520edb6838ba3de1f756cf6ae58017745dabfd9ff1e6d8e03123970147bb92e2741f7bbc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSb9I:A3k03kHRJd
TLSH
T1FB15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 933KB
SHA256 499bd28619777c9551d29a49427e68e6af1c7b6c6cb56b9053f275f3c9beedcb
MD5 82fc483e2f71efec94c3c26545c31348
SHA1 4fc6758f41212f96ed3c46453c9a0931fcae5202
SHA512 228a94b74e895363792e275c757a8655c1f31654cbbe41b74a2e2791e918e49aab13d40745fb357d39c89d5210f6d8966fe558fdd1914c84e926a085a890542b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbvo:A3k03kHRJ7
TLSH
T1CC15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 933KB
SHA256 43b23061f5a4d675f026df7191822d60d168b5fe0c39487f7d92f91972f8263d
MD5 c59efc3c26a6e2b376f122a45a49f289
SHA1 630519ee29b7667f5ed3ebf50e0264fa7f16fbe7
SHA512 51799f778d3f83dc989001b31978a0d09daae9d3e3420b23d892f4696acbae9bbb7f26dbfb7726e90e15a40843adf2112e297fe1980ddd8d475d8edbf03b4e02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSb0+:A3k03kHRJe
TLSH
T12715AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 933KB
SHA256 adb8abab1b0f022ab5e4d99892e7639d2c3c53a711869f0ae49ce876b35837a5
MD5 bcbaa65e684b2bc34d78dbeb089be96a
SHA1 3f88d7db9289296d4f8be63269fc29bd0761569c
SHA512 eb35fa3cd58367baed9633dc559e9f6907c44484da50d083044f42c3bafde8f3406f584169de80678995ba8116d3e960b91e041cc4d1cb52e346c5bba35a912a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSb8Q:A3k03kHRJK
TLSH
T1DD15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 933KB
SHA256 06d051a5c215d1919103a5d898de69f6561a5e7fac2168a588ac9537fab3816b
MD5 02d3f390bc9d07bc4d4e4e97cff3e69f
SHA1 24e3e64837c4b58b952c195e8e48906272d94115
SHA512 2d1edbfc395113258cc4538451f3f87ecbd72d15904d069a381479c299413164fe752dba082844192af212e6406a85c5094c848f8ae817543365a6fbee984915
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSblX:A3k03kHRJa
TLSH
T19815AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 933KB
SHA256 68cef74bdc2f16de2581672e0a20282cd2636d3e7ffecdc316c4ad655628742b
MD5 b3911098bd27079b353e1c2faf70f3aa
SHA1 1b0b1f1fb363da510dd713a76c10a79396c5b8ca
SHA512 8aac438862a9ce75b2ced74e40ae97e3726117568efc9c8d4b57e3819ae343f85105ba56e009edb90b4116507aaa18371843c06ecc2f6f98e31c150c2efb2b09
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbHL:A3k03kHRJ0
TLSH
T1C215AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 933KB
SHA256 7e70df405bd2032ad4c9f5f2939361201be918c86469d1f558552193ffcaa1df
MD5 f6d743a0637ba5b558148593b5ab1dca
SHA1 7ccc5b01ed669be555bf1c59312b1741e073efd0
SHA512 33d2668cd2e952264f14af3bc502f75711c99e0c38618bdc6c2f32cf81534fd6918666be012e73bda102805e34ab3fa6b520bbe4ebaecebc660fcc043a3a0ed6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSb9M:A3k03kHRJV
TLSH
T16B15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 933KB
SHA256 f91edb03cc9ceb36e515049e81bcb0c5fab27b8da0e815ae55e36a86948fdbe7
MD5 3f03f8614dc9f934099ec583c6e7e14d
SHA1 fa033a280384d7843113a2b55588c469a5003992
SHA512 51d9b38418c34800f22dd71e120ad41bff9195259fda7b4c11d2f55d7bab5aed69bed6868c11bfb494fec7248cecc86a8a3faa77031d311381d84864c1b34aff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSbuh:A3k03kHRJv
TLSH
T1A115AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2084-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5424-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5424-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads