6c0768ff119a055fce57bc7bd3e933db0e548d34161c1629275ad72bb0074f6f

Analysis

max time kernel
100s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 11:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260815-nl5r8avepg
SHA256 6c0768ff119a055fce57bc7bd3e933db0e548d34161c1629275ad72bb0074f6f
MD5 132a90c3b42c6829ed047c0da100a020
SHA1 77ccb08fc455754f34553e57a9df46c09d389d21
SHA512 8adbba42de29890ef227847109913842ad647a175809d433bb42e72083c657774aa76287d05dea756098793cc2f55a8f56ac54af906add0369ecc81f985f61d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQw:A3k03kHRJARJw
TLSH
T156259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5492-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c652-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5492-94-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1428-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a3e-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982b-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a3d-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bf-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-709.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1121.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b00000001c652-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-39.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a3e-234.dat	aspack_v212_v242
behavioral2/files/0x000400000001982b-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-440.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a3d-495.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bf-623.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-709.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-980.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-1041.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-1060.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1121.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1146.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1171.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1215.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1428	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5492	2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1428	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_132a90c3b42c6829ed047c0da100a020_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5492

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 6c0768ff119a055fce57bc7bd3e933db0e548d34161c1629275ad72bb0074f6f
MD5 132a90c3b42c6829ed047c0da100a020
SHA1 77ccb08fc455754f34553e57a9df46c09d389d21
SHA512 8adbba42de29890ef227847109913842ad647a175809d433bb42e72083c657774aa76287d05dea756098793cc2f55a8f56ac54af906add0369ecc81f985f61d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQw:A3k03kHRJARJw
TLSH
T156259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 a44c6678e2aa6d49334381b87c1273bf444a937acfe7eac71ae4ee8613493ca3
MD5 88b4b773a038096ce6870840f03d7d64
SHA1 d34bdc8b1b44046ca11e7e266de9e8b909c04068
SHA512 5e2e19d6359561803dc5e8f5a58e93a011d17e6952cd06bddf39003d74ac151c6df98cbcaede384a3ca5c8ce4a047c9c2b6ec85013646e6d6cb1d6b1cfe916fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQI0Le5ji0hmxNrM:A3k03kHRJARJIPji0Aj
TLSH
T1BE657B17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 955KB
SHA256 45514e4327ff3f6492c76a79d5de7eec6cf99644cb5f4af7147e89a75e2a909c
MD5 772e9cdc603a27c82159549377ae31fa
SHA1 37dadf0a30c969494bbccc76d0ec23ead2a4615c
SHA512 432ea8428f22fc0237c1cb61ffb8144b477d29f0b96a04b235d43d99b8a44266b59d170cc24b7747e00e128f6840d4fdb59d117245df41c2c9d5dfc09c5e0778
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQya:A3k03kHRJARJ
TLSH
T180259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 964KB
SHA256 11211275b05b3a1be7d270b24b3a3714a3485f563f1eba5224a3be1fa0b73cc7
MD5 9327e894ff29ae8a30f8d065bcaab75b
SHA1 834b9047310bb70a1a72eec56f4a8206c4c5866d
SHA512 ae16d1bc87c90f0e004600743f71d9bdd3af9fb867fb43041f20c1986d2be8713e94bd04d6e8ef9284bb493c615a3d308624a2419ec23c95e9c45708eb7ae5c5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQD6:A3k03kHRJARJ2
TLSH
T102259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 964KB
SHA256 3deb3d53d4486487559c7a576db81a8403f9275cb71e8054c29d413d8274361e
MD5 18b76ad6149f00c133fbc1c3872a62c6
SHA1 18bb0d96fdb4b27aba743664d06367c7a5084c24
SHA512 79c8033e44fa0d7f00f5fb5aa061f2c4a78a8e67a0297256b0284c2571743029b78081a8c057c007f359b9d4ec95a88c98c660389f2197871b24007c9186b817
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQtN:A3k03kHRJARJH
TLSH
T1F4259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 964KB
SHA256 22474980003c52a35b934c29b087f01dd4838cec80f5c46cc5c637ee5537de6b
MD5 8821c5f8fed7b452d3da6cbb3c5a7620
SHA1 389ecb32944d42c390427ab6bd2812d0683eab31
SHA512 3af708a1484181b09e654553cc96a60cd264d5863a30a6265e98fe0decd7f70a5f9b8b22d44b986c83c22a9708a34dd45af4136186e5725aeaf8658ff39659a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQbf:A3k03kHRJARJj
TLSH
T14C259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 964KB
SHA256 47fa82ef27bef1b4017358b5cac8b2bbf1d706229a713334e79cfb04ac41c95f
MD5 c30700c58fd357f5f50f0d62d0941c1e
SHA1 55995217e782a0ce22147bb85991482266061d67
SHA512 c4e6a0c2f214bd363512280575d444a499b746aa2da02124cd6038a40109e336e589cf677c771a451bb5fc41a0377ea0479725957be1f820e2f60153b184e3fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQNo:A3k03kHRJARJS
TLSH
T1D6259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 964KB
SHA256 25b471f7567aef2490483d6034e194c6cbe8502fd74a2781e49c59303e7c1338
MD5 a47d8d982aa1e23c6ec52dea3ec6bcc7
SHA1 670903cb44ac480dbe0b7f8407c66afe1e467c72
SHA512 4a99afea00da4007afd394a10aa5ea7ca83d556e39fa3d32df7db7922d0d74fecc4f9d52b9dc291a4d4371bd20568d5770e0b6390207c5cbe6e0b1de5c828aa3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQNu:A3k03kHRJARJ8
TLSH
T1FC259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 964KB
SHA256 9030d3cd0ac3a66e09aa40e57ae3591b236f64d3839f823d2a9bb4b4b32d3a46
MD5 3a19ebd56e922a2ca0e2c7d6e5b09d48
SHA1 63748f9484829e525d8cee45fd49c65f5787991e
SHA512 2bfadb53135e74a650c604f3113d84dc25d7bc7f10be37ca955b310c3a05d460ed2b914b91ff1a447d1ab85345baf83f3b78f90427de8abfd9a19427da787aae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQj9:A3k03kHRJARJh
TLSH
T18A259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 964KB
SHA256 89f387eaea0bfd3aa25084700483f5b2e88fe5116be6f934bf1d31f817444ea7
MD5 b51bb7fd15e3dad6923f6c749f80ef01
SHA1 0023eae36929fe664f589cd38478277e850865cc
SHA512 42b22e97e28f8f246162a173bee0b8303d4e54f4ade44ea8fabdf2992b7e27f39fb55bad0ee80510379ec3fae00b34471ac75f3ba9b3d963d7f0c57c93e7f311
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQPc:A3k03kHRJARJ0
TLSH
T1DA259D13F79900E8D14AC1789AA68A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 964KB
SHA256 94275df9a028d83d3690b0b4189568261acff222fa4eb825b70afc717ba889b4
MD5 cb495e741b694a42b43d2e77bb6e638c
SHA1 8b6bd6c7ce4869f92eed47db2e39513ca73b2b81
SHA512 928bfdd1b05ad1a84bad77a32eaca5087f3640d34eadf09345ce59669ada008455b26697997fce225bc5376579ff018c1e47fc2675e13636a616c9f07d53912b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQIp:A3k03kHRJARJi
TLSH
T173259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 964KB
SHA256 73c849d0870ba1aab9c5afaed2ebcb201286265d5978343f7fe581d33d34cc69
MD5 51483e74c7b38680a981c7236ab4b491
SHA1 eb1231d5320b8d1a590f874183852d139e3820b4
SHA512 9799d4493e759b03db6cd24ed850d4777f5de2240b5689adc1a2cc37fac70e66652684127d0386eb9335c72e070439027a5cb24ee3ab773913961eac0110e39c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQfN:A3k03kHRJARJF
TLSH
T18D259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 964KB
SHA256 aa571d51950645cfa3ee561118a8ec413e16c261e744999d34b854adfce1d1ca
MD5 096376f46fd142765ae0364e6dde37a1
SHA1 b32d0ee6425d47d9ce0eb3337f8c8a78ca19722f
SHA512 ac5806433f82e5da86a38940ad590fe001ea17e310446c67218940688b45d210dd1b7d16480ba16af93d8d3ac21528b0f57e05cf65f49c16e1527b7587650ce5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQdF:A3k03kHRJARJP
TLSH
T105259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 964KB
SHA256 2ddeda14a41a5d26856ed499ed84dfbc51344d8295fbe97a76cb76bd01be60f7
MD5 710ec72b2d3f43d8f195485e2f165f51
SHA1 dd06319288a65b6573d542df7faeedafdd53dd81
SHA512 225dd16785e8312f0e8d81e4c71eb8d8c92a6f8af4e2e756d8abc4dfb52e2128b2061226d9201328eed22507fb2f9c534a665d53c446bcf8359b020c0e5854f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQuC:A3k03kHRJARJD
TLSH
T177259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 964KB
SHA256 15e134c24d848eea7ce9eb34867b6f4640a893cb7a0bdc831f27478425eb3e8f
MD5 5a840efcb70c65078010d3453639be55
SHA1 c6b38dd437d60128bb7f1a58c496a9b7a65de467
SHA512 e7ac79af26fb689f8ed7a8d85683ad046b92f7f942b095b5a7e2190ec3c16e741cf199bd36a2de6880261a4ad163701c343d3fbdbd8445a15310deb7ae126609
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQxw:A3k03kHRJARJG
TLSH
T1F9259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 964KB
SHA256 877f34002bb9f33a95f321327e7863e80f45f5a21a0481a6c4565309316f9967
MD5 73d8e76edb56f38b9390caaa0e822300
SHA1 745f0f92f44b6174c0c4b8dec480e284cced4924
SHA512 e179093cacbed31cfc9ef1708f09d79514c15a459494742d546f059125d0906be1dadb9645cbf4a4a9bf10f2f8d940d9c8404bb015d6c711da6fe44ec37e19d5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQYT:A3k03kHRJARJG
TLSH
T16D259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 964KB
SHA256 b97c80431d7c65a13227bc616c5e8c0d855cce465f289613eb19b7da09481829
MD5 b3c409df793e70992226bf07901c02d1
SHA1 8dd15b357ad3920f2650380bf24bcbb58cf883bc
SHA512 1bd007526aace807bc0d287cbd7a1abff3e5d465092bf9fcee8865c83d7ffcc27b4818a578b88909d83b4602d2da37f797bc77e87746098843c65c1029b96b4c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQ0u:A3k03kHRJARJh
TLSH
T12A259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 964KB
SHA256 90de2626d43f66e2086eaf311742bb0ebd906c9755377997fb9fe3708f413048
MD5 82baf1553fe1b43c6883f9b2425877e0
SHA1 5d01fdd45aba56cd2449fc73bc8ea8f9294acef2
SHA512 a8e2c3d1add16bd49a285ac0f56e0775d3a400a69c4915268dd9b94a054cdfa05eb6686707c368d62fc5a040c38a68fc69d2fae2235921dec09e83d338120868
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQib:A3k03kHRJARJA
TLSH
T13B259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 964KB
SHA256 2c0d10be7a337b6a1cf89fa42110ef204b3d41cfdbc06bb21ffe1b6a395eb231
MD5 2a709898e087577dc1457a3aa570a9fa
SHA1 a6319e634f934d1bd33909c8097e169a67e1582f
SHA512 e48993419fcf6a4fbd726297d3febe35509eb3168c7307bdbc7ce2b7f91276249034056db79170917f888dcfa87cd54b862872d7d4cee3fa2f25b34fab5f3e5a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQkf:A3k03kHRJARJw
TLSH
T101259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 964KB
SHA256 e776cc8f91a64823d5c3ddc2432844c5626e55ef991aa7f61ee6649eb74f8d5a
MD5 e313a2bb5b4c3153b7d582cb266d42f8
SHA1 108ddba3554a1be34529835f52e911daf7e80b93
SHA512 1372fb53941574f8b12dda173a95241128aca6ed540edae274e4b6a7a0c7dd704c88011943156a37584aa8a3514851fab1bc88066d7eb445f9e83a3ace2973fc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQBK:A3k03kHRJARJQ
TLSH
T167259D13F79900E8D14AC1789AA68A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 964KB
SHA256 5c7d519cc5b558e89eb85d8a84d13ba9389fb0c6465da874482269a5fc453022
MD5 7a813749e9e3fc80a4d1d2c41ac18882
SHA1 dbaffe013d1403e9c00776ec825b3e45001061b3
SHA512 ae6efbe0abeeccb41be8cb57257a15d29ff608b05abfb63bb39c76b6e082b9c37b8cf8d4d43b13b501f30765019be99bc5a80be4aeb224cae3e720cf919a472e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQ6k:A3k03kHRJARJ5
TLSH
T1C4259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 964KB
SHA256 eb181c7698cfafa60e8d40ae325800e695cf9de1d72d5057b1e356173a17dd98
MD5 4050176ed6ac59cf72b503bb10366beb
SHA1 8edaabbc7fc174373b7e2b43c728f2a8978c309e
SHA512 825af1b8b8b08794315668526723839ed222a0cabce43fc2ccd12e64c2497b7eeff56c34f2854025c0154742b38fe815d1729989930b7ff5c9667a5cbebacb45
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQf0:A3k03kHRJARJM
TLSH
T194259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 964KB
SHA256 7e8740e32ad7517218dbe9e24f23d75bb6a981e3db939d6271dc87125f2b0fb1
MD5 d5bfc0a4410274c605036914b7a85cc2
SHA1 7e57bb0fa52a5b809ad8d1099051d84778faaed7
SHA512 23db3be107597d53d86cfefa045b52591aef2847073ad3e4cfded7b6dcd698d9e2858e14f8e3d4d344be5e67a087ad7f3ad1501084e61bf731214408804cf0c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQug:A3k03kHRJARJx
TLSH
T1BE259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 964KB
SHA256 2d3d978f5d4ad4d2dcd1adfd56201fd33cf23763da9c34e0b2519e6aba6af744
MD5 752dc8f0c4c3482143d4ec357af2ba80
SHA1 76588e38f48ed92040c101703cfb25aaa3adf2f8
SHA512 570a31a5420907e50269aee75fb3e73f0164944851ca92d7d69399726b50bb163777252dc9608ed0ce9314f5faeeb1984660bf56a9d31b3b9357dfa285207066
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQ3r:A3k03kHRJARJb
TLSH
T1AE259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 964KB
SHA256 9bebb63ac0b8e570afd01f78f4f0732851bd98fa67ffc45891db035f139ce3a3
MD5 03a07f0f0df7bbf24c3172501349e9ac
SHA1 43d5002bc10af2ea8e6fb942f5a0c99df4e2ea13
SHA512 2352d774c75539ec4496b4cd6c139e58d0436f76a8abeab02955c2e3ce9696bf6a4026606f4ec4a05639f6aa80c6d476fe29239d65d4d1b021658fb758c99a52
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQBn:A3k03kHRJARJt
TLSH
T185259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 964KB
SHA256 7780b6407a4c054473f9b7b52a5b54d59146eb731f588e9b3da35e0d30d8de9d
MD5 5a1b629a2f854361c457c9f61e7649fa
SHA1 09775e8f2a8fbd11aeb97d47b834bdddcc62e78f
SHA512 5d024981a20cacc930e31d0fdaef3ebbf78c4fe11fd56dd78922d77c5c8556e6e7776e951de7d6f9e65f7f453df75ad4fb54099d11e2152eddf7f6b27ec19411
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQtx:A3k03kHRJARJT
TLSH
T10E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 964KB
SHA256 a324304772c41ce9d5dda17834da803afb5efba9c494b41936fb7e2f8214a239
MD5 06a772dcc1d41e5fbbba89f2fc33b418
SHA1 dc56723f30b189fcfca1b69dbbaff2e7edaa831d
SHA512 fc74516c00b544dd37cddb245add35ebcf1eda6afa26ade10abde719a5af5ea283c33516573c715e33c51583d8c548d7b8f8a0f057937fd0452985012bd6f0ea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQzA:A3k03kHRJARJs
TLSH
T1DB259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 964KB
SHA256 92e4105102bd84d2ce69963c18e111a995b53ce1025ceb9160e06bedf7df7bde
MD5 0830bb217f1e08fffe0a56ffefce75a4
SHA1 fa24f0fbc0a590fb16c9d3c651d5b0bf73f21baf
SHA512 e153b6a3b5739194e37d6768dbaa384728a63f147cd3cbc08d3ea8da0c94d5c0c6f98991eb9bede9af728ac0595f79fa4a4df4eeaf867deecc0a740f196c25df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQE9Q:A3k03kHRJARJN
TLSH
T1DE259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 964KB
SHA256 72f19def5e529d3f1710baf6fb09fcc1a2a9b46d414c02639cad44167d7f7cbb
MD5 88b945b03dfae1c6e21d7fee1159491a
SHA1 05710b3850a9ccbfac5b54c0e632e5ff4a5c327f
SHA512 794348b8bb17cf67c32f9b79ad52ea2ea687dd323a0721279d32a808e35b14fdaeecfb04d5220b36aa638c61d55068b0dbdc27c32abcf043d8f8a26bed75ee06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQd4:A3k03kHRJARJS
TLSH
T1A6259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 964KB
SHA256 09cf417eb88e355d2ad75531b069e78aad201e9326fe9a1f807ec6e117f1fb89
MD5 4b9b0146a07e181830a7396cb067e8c8
SHA1 5b8d8b1e6a73e2dd4b002b6cceaa3b61df02da9b
SHA512 3e7b04b75ace515bc06a35085dbd3eb16dc8d2a7195846f3e036d1207ac835418d2c03fb767d4d6bedf818a855f709f55d3a7a13ecec6a9d42948699dc913310
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQ4u:A3k03kHRJARJD
TLSH
T136259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 964KB
SHA256 66af9ab45e2d2324a529110642fad7f425eeb810ac96758d78437e29a677603e
MD5 959926059a06a234cbf291f6e9cd4bab
SHA1 3ebedcbb27a24b498bd3525841471801998d8c4d
SHA512 317f3de864a23dc508e60acbe3c6bce3cc234798317cf79afac5527af894190d9d32260baff70f814a54ef8941d0c306cf92311d12f28b289a25accae1bc20ce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQZj:A3k03kHRJARJt
TLSH
T127259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 964KB
SHA256 eb1f5ab71e74dc12f272a5bcb3e619c535908acc04c7a413b9c4e50fb9800337
MD5 b7f76110bdacf95016ff1d11289b9d16
SHA1 ffb0b8f2e8998a196e4189787c049d681966b91e
SHA512 9bb058eda2c21a683f25fa4a1db8aca6ce81527b90fbfeae2f708f99a258c2fcc223c881e78bda67f29333d18cedab694f400f96436c9e217ca587a3cbd84ec6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQAg:A3k03kHRJARJx
TLSH
T15D259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 964KB
SHA256 ba5c1dc6421c1530911a1ebd39b089717c61c74112d856ea9f39f2dd1e353028
MD5 8ee45aa9020489bbcafa89a2cf8a26af
SHA1 12bd06923fe056e382c095a2181f364f20d9f572
SHA512 7f608204ff78409605abf89dcd94c4a46785cf57118d5a0f6ddf57f0b81a5816afb74beacd2dff2e3279bbb5529d313d881b41ca7645418f949cce636e37b4b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQvI:A3k03kHRJARJg
TLSH
T175259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 964KB
SHA256 85cbf119447e23e65d4ae12d703466ea4326c7c0f40688dce8a92b27ac83435b
MD5 01325ce618411ec39c817390a71a8ea7
SHA1 735f502276c13c59635202e9694ab27bb9b94b1e
SHA512 4bb66ce09f59906a5f2b1dc6df3db9ee05c90a2de2df17ef8cdf95341003a970269e12b6fc29c56e8505700d712198589239cd0880f537dfcec4d73ab329166f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQVo:A3k03kHRJARJC
TLSH
T12E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 964KB
SHA256 caab0e35e9ac564eb0895a7fbbfd0fec12668067f2b985ff0ac041bea795184d
MD5 2e5abad6685cc05adf147ce9f053ea70
SHA1 399224e4f82c0702d592513045b2e207e69b9609
SHA512 4f54a939eaceff8c5b4f3dd07e812c5c4435429bfaf1a58d6a41e24255d47133ebdab8eb704bde1e4adf8d7b0a1659aba6ad9c50d73f57bc6ba298800425cc1a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQG+:A3k03kHRJARJn
TLSH
T18A259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 964KB
SHA256 dce93538033e7f072557a57974d202df9908fa3919066847283113a2eb0bcb61
MD5 a21155d230876c1ff8cdb377836de9e9
SHA1 d427757f9a0de8e055f3b60343bc0a19b2c34612
SHA512 e99a2b77d022f011d8d01782d1a64427de2ac1b0d76b69c57750a5e27b01c6f482bb16a6b7cc4cd77133f0ef4b6745c4268ede4458ea2d9b0f8be3765b7b72ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQGQ:A3k03kHRJARJT
TLSH
T1FC259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 964KB
SHA256 da433e204203b9b9cb0a20813adb7c202f02763521d2ff19cbeaf363c8d47f06
MD5 6d58e74349d9b3f6a3f774fd52a13133
SHA1 1c8d957345d0f42efb7a2fffa22a1e56a6db1bfe
SHA512 14f9ab74fa894520c6603e4cfa727ff0426b87ba88dba9d8e3245d24cda68ff9241b33016a75477016941d9f7fa19976afa0903d4b23699b6aa5c7bd0258c055
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQXX:A3k03kHRJARJH
TLSH
T18D259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 964KB
SHA256 1c0aae2778d9744c10f4e262c008d4cd799c5330b54f35edcd689d0950f347d3
MD5 e9795a09bab1839094439c58d615979b
SHA1 64784e07080cb6c660d4b89262e171a71d8da4b0
SHA512 b9092a7e21d53d08e18b52a58200b6bee6bdf713a614dbaf74f57896755e74852dc85bdb2e83a162c102c2e9665a827193d28c17dd2c35cbc277a9ab8de6f95d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQNL:A3k03kHRJARJp
TLSH
T12F259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 964KB
SHA256 1b5174070b18984a67403736559a03fc091398a907630841b9288cb8aef0106d
MD5 c23424d22113a3118ed3230e7ddefa1a
SHA1 47254aa59a222f2d29ef02c759a8340fdefb3bd3
SHA512 fe54405f9f3ad0b372f186251efed28e5f5900253e1badeefdd742e9606357e4656e74e7c12179e932b8ea52b1be451fc9c4e8e9b1971c029a558e2d8651e57d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQLM:A3k03kHRJARJQ
TLSH
T157259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 964KB
SHA256 006038db4fa54e2d22bd4a38794704851668d6aaf5027c1be7d49dbbfa4fb488
MD5 b100117bcbf70b14d7b5bafdfea8ace6
SHA1 513e447b1c80fa27ff0cfdb3f89b632615dc182c
SHA512 2ce86c2a5201b74127616014f18c7dfc044a8e0e360942102b5d7994984e05dc150e824559dc9e72e29a8a03175505028189a491657034a0974258c4cc345112
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFxZgsoFQMh:A3k03kHRJARJC
TLSH
T1C1259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1428-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5492-94-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5492-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads