d9204ad2f405607b180567f86e3d9cb244c943e541601a4df4921f8221aaf9e0

Analysis

max time kernel
90s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 853KB
Sample260818-a3sbkatvfx
SHA256 d9204ad2f405607b180567f86e3d9cb244c943e541601a4df4921f8221aaf9e0
MD5 1b00ee616a2efc64d5fd16103e24b575
SHA1 01d3b28115eb9031a7c6da733aded6e22a049efc
SHA512 91e63323900a6c83bec3109f31deca2e457f524cd93c3dc33ac404dcfc97a95ee1f25ea84874fb805ddc601e40880aa933d801ba9a4c92ba1ab8ca36ce9f3dca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDa:A3k03kB56r
TLSH
T103056A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1932-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000b00000001c755-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b0-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1932-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a42-221.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2248-252-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001982f-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001ba83-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198bf-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3f-526.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-715.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-838.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1147.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000b00000001c755-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b0-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-57.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a42-221.dat	aspack_v212_v242
behavioral2/files/0x000400000001982f-259.dat	aspack_v212_v242
behavioral2/files/0x000400000001ba83-440.dat	aspack_v212_v242
behavioral2/files/0x00040000000198bf-489.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3f-526.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-715.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-789.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-838.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-878.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1041.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-1078.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1127.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1147.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2248	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{CDB16BBD-CB19-4D7F-84F7-16B278A1D844}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1932	2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2248	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_1b00ee616a2efc64d5fd16103e24b575_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1932

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 853KB
SHA256 d9204ad2f405607b180567f86e3d9cb244c943e541601a4df4921f8221aaf9e0
MD5 1b00ee616a2efc64d5fd16103e24b575
SHA1 01d3b28115eb9031a7c6da733aded6e22a049efc
SHA512 91e63323900a6c83bec3109f31deca2e457f524cd93c3dc33ac404dcfc97a95ee1f25ea84874fb805ddc601e40880aa933d801ba9a4c92ba1ab8ca36ce9f3dca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDa:A3k03kB56r
TLSH
T103056A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 2d5e30124165cc788cd322d623b5b39e31de3cd34f8fd18f391ff6a42f77a2ce
MD5 3e79d4ca78d11adf0fca1b5c51e07386
SHA1 d3a477ac296353392565e63c441327206b5f858e
SHA512 38d83a29e84b6b876da6f91b6198a2d77ba4d8cc046eac1bfaab74581d51171da196ec97a991b11b9be56e4e157bc0370ef3d448c9b6f4950d486461b72b120b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaP0Le5ji0hmxNrM:A3k03kB56rmPji0Aj
TLSH
T1F4654A16F6A44B65D02FC078C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 868KB
SHA256 8f388fe8c9a8af9408b6c6a1926c3d5dc0b05f349c2925a73e7ef579b5ce2886
MD5 adf30c9e76feb791ee4b3ad87dcaf8f4
SHA1 a14322b1afe47c6a821e875df93ac9b30bee78ea
SHA512 7e57a75412cd00dcd87f4c4743642d9835ac32e830531e81c99dc2037aaa1d14dfab4797380006a4b9daff8ac1b85938514ce0ec0b845bda35fa3b57637c1065
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaRa:A3k03kB56r
TLSH
T19B156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 877KB
SHA256 d1a29019940fcc4c8277b906b1732b74549355d9fc4992b35f4f7274a595a718
MD5 b91325b2faf1120d2463f25c62a5f6c9
SHA1 0134bf1c201226aab878bdbb30802d4f806449f7
SHA512 e2aa4eee00d920c2e105582613ae044ba24cf4c9e8253685f00ca4c2b48a055a8d5a1dd8d018a0a1e6982905e8009c5fb316147515be5883f4cd22fa30f30249
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDao6:A3k03kB56rQ
TLSH
T10C156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 877KB
SHA256 d745e4671553ec7084608f35a7d10fbbebc4f9972220ba7eaa24c35dfaf3e1c9
MD5 068baacd922cc2e7fed9287de0911024
SHA1 e09462ace2c08075d7a9d6e2ed29a8d166fe0935
SHA512 6880905a719f97e5e61db25ed75f77b2c7d25b60faab298737adbe55364c9d3d572f672e851e2f28533ec2842998d4059b8dc4154a55264a0d9b1a49a4f6a34d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDasN:A3k03kB56rN
TLSH
T1EC156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 877KB
SHA256 00a041901dc52c3143c77e28738848112876f7a307559d4f3b26a4e85bb2cd89
MD5 a19cd35f10e430f0701af8b132d5e7f1
SHA1 83bd2d061077b5af4b43b4cee8dfa0bca839ec3a
SHA512 40fb1b8469ee6359b1118852ca33fdf5368be6341552ec0d54ec12db5f9d754134464d816fb5aa97dabf856b060d27955c4b72750e66ddfbb144e3231fab4faa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaif:A3k03kB56rl
TLSH
T153156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 877KB
SHA256 e0c3dfcebef8a0a4d9208c4db78d1a905e33fa520d64872d79372175060d0f26
MD5 8f414f869ac32c8a57111a9a06e860a8
SHA1 23eb381b00d330c8c6e460649a2441a1e665b0e8
SHA512 50ffcdb05166c9afe544bd8fd89a5b9a2c6dbbec99252710ca80a8d28638972f744b39b3323c5817008b04b36ac5747ec29309c2a5c2438c9a17d9c94fc1900a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDa8o:A3k03kB56rw
TLSH
T199156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 877KB
SHA256 b157bdc6def62d74d790a21fbc5a495ecb79b85ff71c1a66df3d76fe128f74b8
MD5 cb0d4405d5f350ca170a9f0487ce28ea
SHA1 677deec8028262ae1c94d18f28ec471692c1a279
SHA512 35e9b4f1fe29bcf82562547f2de721187fd81dac11895fed053d6d051a1904ce1ea8007eab5a1840e34ba54ae1f61d032698d5be053e26677b7320928bf0308f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDacu:A3k03kB56ry
TLSH
T146156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 877KB
SHA256 0ab64d29c743ff6186140ccc6e6861946b15754588ad32e9710f7b18b8141e93
MD5 cf0f72482a0a8882076eae54a5ca80ed
SHA1 2871c01b19347048cee404b40fe916d278aa2553
SHA512 ceeb2613efb73462f4072841e880cb87b12446f413704073d84130ffd285ac3e86dda6fc3fca68af22d69e7ea436799dcbb4ba442b1fc64ef6008f33c4c98769
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDag9:A3k03kB56rz
TLSH
T1CA156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 877KB
SHA256 31bfe8e960677b3807cf1bffe16aa6173c743b638bcaeac110121aa878c1871b
MD5 ea0fdce6633973f1589ba79bcb0924e2
SHA1 e170f1959b97b6f24f507658e139190ae11371ac
SHA512 2fb0fc64167b40b1f1f40c0501c9974e9c98cae03859304eeabc8ced0c56cd300367eb5a5dbf611ee521c96d8ea23d1e8b3e4e4eb9b86019d7267cd11ed9b76a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaoc:A3k03kB56ra
TLSH
T11B156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 877KB
SHA256 0111c24b5e9f0bf83f7113591b063609caed13ac9b219d1f7c4ac4c037062f14
MD5 1a682a2668f90bee80d57c7fe66dda58
SHA1 26df52ed44aba5d708e2f873fab130bf7f43bd65
SHA512 659aab233dc88d1711b731b1e39e14529daf9d2de6289f484b7c89c979c4310d0ed95c04974e1fb909d7bd192319f3ec42e0f750c541da187b23eed638570517
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaBp:A3k03kB56rA
TLSH
T13B156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 877KB
SHA256 1b922d62f2a715b1392f0eb1dff7670f468d91dba328a3a6b523d6444845d2ca
MD5 1467bec39f7f3f229189e54a444d6e35
SHA1 2901eb3e3a7db9be703ffbd26524fa93be551503
SHA512 3f5bacbd882b1676d82bf06fc9b3a4570b0e1734cc3713ca01d16433faa3d7a18794ca3dcb9c1ae6d2f86ff5635ff9f7f7000418a4a3cf3e2892723b506e9adc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaWN:A3k03kB56r/
TLSH
T1B0156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 877KB
SHA256 d714d59d2b011d8c61332fae7910b747d990852e7137f2f7bd8c27d41b1526b2
MD5 a58a0337da30b851d233ff749ae520f8
SHA1 3586174c54948c6eb5761ca1244dae438370ad74
SHA512 f8df134fb3ad11c6adf66adb94a461029850880df7265bcca8da7ded4c7f3f6a1bc9c2f34bf37bb734a25c07133dffee90dbf784e7421ddaac58ab2c943caf22
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaaF:A3k03kB56rZ
TLSH
T146156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 877KB
SHA256 fc0e63c87e0d6b44099f1b1fbeae312132c685b3f6a31b8cb0c641fbd925b1ee
MD5 9aee70f7591ee948865ea0c33d68a7e4
SHA1 9b3f86e8871b83f06dbd82595667a68627c71133
SHA512 7dd1a8e535b419626b50a489e2e1f223ec2e46bba80c4015318af790b1753e1baf0ae86a4cbf23f6319ad696b4e1464afd1acff0632802072ec093925ca25b15
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDavC:A3k03kB56rl
TLSH
T192156A13E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 877KB
SHA256 c5257a69628a99825cf9b9114dabb627d685889a77c5fefc52a3a48ded596d46
MD5 c0bb1fb4fffb536ee11bd76fbb6ee06e
SHA1 4c6747123034286a3e9fe7d03e97adcdf72da19e
SHA512 5576165d6925887f85a74c0ccf46307fb9be714f65c3b42dd27a2012c5b214275936692cf527f2c62a966cd7544461f67227e8ed7a81dbd2b1d48d8a71ae5cf0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaQw:A3k03kB56rI
TLSH
T1A7156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 877KB
SHA256 e866aa769fdffd6889c0784ba0b765f451fd68d7884d61d147724c605cd44374
MD5 24053914859a7a5d9919f1bf42930594
SHA1 c58d17c701789dfb6dcbbf09cb095c788bee83c9
SHA512 c846f26e54536de85e8ccbf362f267c15dfb8a8fdb6e6f6745267814ad9f53513f6816985eb7092cf78d7a7aeacca040f04be51722050a6ba7cace7f1df40fbc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDavT:A3k03kB56rA
TLSH
T1F5156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 877KB
SHA256 ef7ec12b7d920767f48c7d8d6ec8aca5a47524502e030a5a38c1ae93fd24acef
MD5 911e504ad17c3bc423ac5c877aaeb667
SHA1 9efe108cf2bb5fd380c5d449abe84ccf3d1d56f7
SHA512 56bbfda5e90f9b885b2f4a5dc8b1f43fc7ac983e66021148c56e17052c1422e6e07278cc8f6c2cd6b70070b7b7e70c5ca679447531048e9f6344b10fe006dd51
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDapu:A3k03kB56r/
TLSH
T163156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 877KB
SHA256 317c46f097d10396d2152600b288ea1e4c592601ac368afcc22cca9291a9f5f2
MD5 ce681b46ed7b067e602efce7c7d14007
SHA1 57552d0eeab4442d081df1138d068a67551d221c
SHA512 f15d73ec912ba00aa05852a40770c2245713202109cc40a14893fdd6b010920ea2563372e92dff7c27be272276d76736e025c68afd237e317e9a467c7133828b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDahb:A3k03kB56rm
TLSH
T1B8156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 877KB
SHA256 73adf91f953e34ce9d1a7d06ac58ec5b76cceddbca6318db8351afc5f28c5471
MD5 5b089fd96985ecae8da10c4a47bcb751
SHA1 61293d11c44d7dbb09d714b55d92fbca6b1cf375
SHA512 e3126199c2cd12612ba82597251f363abd0df435dd806d9352466af7ddf46e90646a4700cac7e53238d68fcd9b350ae8d905128a5922d6c9ed3ef830e10d6ba2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDapf:A3k03kB56r2
TLSH
T16B156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 877KB
SHA256 c0a580359b9ae9a1a6d84b5ac8a8c2737ff3270ea330bbf463da023394d6bfcb
MD5 d3cfa8723e1c5234cc2bde2942bdfe64
SHA1 4f2a98805a4e17bfecc6a83da231256d5e5070a2
SHA512 0fc43bde44be0ee32938f7695350f8a19216519143a6d6e04b344ba71d142ccf7b17300a77b97878beb82e131c0a52ef06d6c6140448bb7a4ed537ece78c048c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaSK:A3k03kB56rW
TLSH
T100156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 877KB
SHA256 590d3bea43e63eedaa9a2d8c3fde6d18390d111c5eee252e794e172306443441
MD5 69fd3004cabb618910d6d092e80481df
SHA1 5f97de91082da6f00a899c8aedbdf7d52d1b2439
SHA512 a07afe9e2ac3a4399837c2de65b7782e7b89b2072806c9b6921ead59467235f2e5bd7ea595e74d6ca9a6b674713e8b6d58d6ca3863ef4af684454268e928b13c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDa3k:A3k03kB56rL
TLSH
T14C156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 877KB
SHA256 b540c4e00fbb034bb54a371bafae7388cad21adf324323cfee0ab9621eed8c8e
MD5 521da88dfbe8bae1d585d7343d936e42
SHA1 9aebb94aa6a55b30857643a9caaa49eb1cbd8b2f
SHA512 ca5c3b36ea76200435a764a018f853dd197a726e30cd33be83f64aa3d303f9107bcd3f820c2e92ce8ba738fe34404bcd17ce6cb2cbba07ac4350e7218667a573
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaA0:A3k03kB56ra
TLSH
T12B156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 877KB
SHA256 2bf6acd4d91984667ca11542fd22c796a6b999988849261053fbcf98791a169f
MD5 2fc8a75f079528e7fd65572696e3cae5
SHA1 b23e1c11b06aeac7354cd4316f12137a49ff9f0f
SHA512 c798210979d0c97d6f33ca046c83b8008c6dd26fdd798d21a4f544f914c8c0a9520c1ddcb229d8a7cd078a5721a236a322fcacb4bfcc7f75d816bceb5c733821
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDabg:A3k03kB56rj
TLSH
T1D5156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 877KB
SHA256 3bd01e1492e29305911d8d9f91a6a1a36e7260d33ca0ef5954eee354e12d6344
MD5 378cb806daeebd775feba51a8f5036c0
SHA1 3f3ac234704221cc4be5f4f63cf1250921b8971b
SHA512 b9ec319f39112f937ce823d56a7e333d9781c5338052dee4219504b47328cdc8f5d18087603ed442e1238f7d2a586e12663632879955c3b51ed3d42a5f064602
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaWr:A3k03kB56r1
TLSH
T13E156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 877KB
SHA256 c917a7f03f66b67b1fba33277522112e0bbf60735da9c58b1224ccb712925353
MD5 4d460ded82fb2e262342ccc89dac91df
SHA1 e355313bdfb6b7a44080a12251904da0e4f7b3a9
SHA512 76f920f728855d2ba8505872ca9ed506116ea2d991a14bf82ea6ece479a491ec67484b81e0427be20ae645ce098df43c5c6e148650f767e81bfbf799ea93304b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDa8n:A3k03kB56rn
TLSH
T103156A13E6850FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 877KB
SHA256 e2dbf5d080e2246d05f619d98edecbcdd36a0f9faa149b2b3e46b4ff0b4412a8
MD5 468317c595363ec47efa138ff9a08b93
SHA1 79ce25c24d738166a789add8691c10b2bbcd8fe6
SHA512 cde0841cd08ffd382cdc1f106cda555fdc68b6185f63c7d5ff103ec9d4f2b04e02448c85a664062d9e2dab22eaf2f6018544c254008c201d61f9d68fae078e8c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDa6x:A3k03kB56r9
TLSH
T1C1156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 877KB
SHA256 aa352123af0f86fd37dae22233c0db3cfbf6b4e1e7b6ea03bb973f3a1ca684df
MD5 eecb208805f2b2cc77b1f7057bd0d7cc
SHA1 c021e7e93f27d58864dec3a0b773ad8b0be42159
SHA512 a7191669bcf74b682cffa0d6c5b9ffbbc5fabfb9f11a148be16ac47a2034e8d07247d76bde3be7265dcfcb40ec3921b33f6d69a94144daf3f9adb7422ad99a88
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDa8A:A3k03kB56ri
TLSH
T1C6156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 877KB
SHA256 bfc40970c480dd4245078cdd64dcf25dab8bff4e90cbf29a48532b0a1df793a4
MD5 b26160abe2388f1c1b81f63d127fea3f
SHA1 21c842bbcbf1d75dbe8b0682ff78954dbb2ffda9
SHA512 556628779668a78e81167693deb660ae8e55e56d9ead6f60e2c11b94c3678de14480fec46b66bdccaaf44e9fdb7111ad25db52929b02103e69b40e443533dfba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDal9Q:A3k03kB56r/
TLSH
T1C3156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 877KB
SHA256 f5e7b25dd7a5a76208c42896168cb09bdabb8f87eaa82d3a037fa42ad8ab4a9d
MD5 a838a5113729a630463fec23e14c3b93
SHA1 1a2a6b5b54b67bfe3993fa2c92844c260c8e006e
SHA512 1d5a79003e351984130463b6d4dc306ded33007275eb736adad9a60eb1414d1869a86916db6a3035839a21f9d80a5d691d08fe0e1f18551683eaaa34d99580a0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaQ4:A3k03kB56rA
TLSH
T19D156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 877KB
SHA256 276544d42b9299ad8b358c4e077d829db544cdebb1e408d50e3a77083d8140cc
MD5 918226db3d1c177ae55d508686a86238
SHA1 36a7911b50d0169043da61ca247a4ca7d9c472d5
SHA512 88084d754b7659366bbaf953e83e7f136f6e0b01d65a5f98fb8b75b52716737162aa21216caf33a43abe57d2d6936da73b61389c354effe617bf6a7e18135525
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaTu:A3k03kB56rh
TLSH
T137156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 877KB
SHA256 ae89758a120465b3baaddaa5f6a69236cd882891beab3aa18eed6d53fd532659
MD5 c2b2007cbc60289551c206d6e7282f3d
SHA1 c3a80d4529e38a4003f165af6b3b4b14b0ccf9d1
SHA512 53701fd1e225311bf94ad5d3d735a24fee7475c10e0deb20cee6f2c3800341e485386d8ba0ee04f91dce632634eb35cf545bb39cd3db946f21d7a10cba120a86
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaOj:A3k03kB56rL
TLSH
T1ED156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 877KB
SHA256 5667964764bed8601370194756331a3412a465e3452dc5eb951924fd69ef3435
MD5 2dc27fbc7c5d1c47d5d48a37e6ff367c
SHA1 88801f5fb708a6fcd359684a8c51be0cda5820cd
SHA512 edbb631593f42ad2a6f801494a27ee8ef3eaad1ba0d6c58b4ca0102ce447dc20a431caca9e28c387449e412a34f915d62f8d33b878bea5d24a6e5a3eec28e2d2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDa7g:A3k03kB56rD
TLSH
T198156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 877KB
SHA256 2464001add8b8cabfe15c863afa7a62fbdbc6ed8d745fd13bc036c81bd85a819
MD5 fdaca6532dd3f6bbaef965d67a8a4524
SHA1 8c4adc351390522aa1c5e118a7851be997cc8321
SHA512 d3e15303db0e8ac2da465b40b8d5fdf99de421895f3e79843c743d3804dff013627446f5ceee371d30c303df23057ddca0ac5d20c003e5d4260e5093f778a991
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDamI:A3k03kB56rK
TLSH
T1C5156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 877KB
SHA256 73fca89b6163955d451b79d8f69a0b33b9eced4a6267ae56015040f34f657130
MD5 dcaf61f79012f406e13178d9f379ab43
SHA1 518f6d2f4a90963477dc6e491486a6f58dbc82b0
SHA512 584c4ef63f0c18339075781dcd2d971e5e0cc939124c3f87af288224dae933fec3d94f4443cea5b3318369a4d1ae2917e64596edd31440aceb0fe74aa5993c7c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaUo:A3k03kB56rY
TLSH
T11A156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 877KB
SHA256 7c129f3953a26f88c23f63210543a9b3f7dffee2daae05f31b8a8340b29a3eb5
MD5 fc64aa1e13e85e6a55ff7326d0e39ce1
SHA1 6fe337b3e5109cfd088372b1423a0443ecdc048b
SHA512 55bf8e1d41e4172003afeb7cdda52b5900589070d9319ba267efcca4349a6c5a25ca2fb85e39c6e55bce2d686b0dd74998ff9fc2b74e1988692c1d16cdb0b601
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDa3+:A3k03kB56rl
TLSH
T1F7156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 877KB
SHA256 32286ba2786e12377d8962bd3294d0fa8143c4dda6e4ee201cb2833a13ee751a
MD5 ec65313e5b90cad394a607176a913a1b
SHA1 5212115fdb894557b554d8a70015f71c35396934
SHA512 9e85027ad728fa60ed0b25b10b78ae8b00f37b423aae7bc69f117712e31079cbb844e831c818c701cd4a44dc38606f6f0c46cdd84eaa7f9159f5d4d6d69297ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaNQ:A3k03kB56rt
TLSH
T1C1156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 877KB
SHA256 6da6d807c626310fbc05ab884ef0d5da9bf5a78362e56adf4f8e1f4b99cce259
MD5 b40501695b4283791c2a0a9f3784be46
SHA1 b3e6e7ed8079425707aed927086d96bc42c8abe2
SHA512 b53fe59a45b7df96ebcfbf65c18487bfd5e98775c6e49733ef2cd64ac18053965d50406b4530fc0bb1bd9d79a9d1ec0aa295d36596f4e29281df72700370dd95
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaCX:A3k03kB56rZ
TLSH
T1A2156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 877KB
SHA256 6da3f96c83cf152a4bab53f749170e3a8e4a889353aa9039a943ced84276e7b2
MD5 116157480bfc764665733ec30736f38f
SHA1 5388a6983d32c3d23c9458ffef2a4ac943adb5c4
SHA512 daa635f285afe3b9409f00e86398c23de0acadce22d48bafb47f93b659a905542733112ef92b11f3b9602013b4a69062c6d01bd5499e23b57d34600e72b25484
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDakL:A3k03kB56rT
TLSH
T1D5156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 877KB
SHA256 abb0699554be721a15c608ffad343077683ac28a1dd244669c35e0ce56875f57
MD5 6d72a13f04c8658a2d8ea6801e253c2b
SHA1 cc031c12a67edb799f435ed6bebb3b6a6a27cb35
SHA512 1ce72ef843d6138d067d80d2a56b7f72ceabe38e12ccd25974b8467e2cc21a0cd91cd65b4060eb63e5ab1b7b8019d09668d8b8fac0064035186f13097b1c798f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDaAM:A3k03kB56re
TLSH
T147156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 877KB
SHA256 a208ac700084cf2363faf9262be78420ca23fd2d745782cdef41404ad8561589
MD5 876df7d006ca70d16f8201e07c9890fc
SHA1 20c8a13a857a10b99f260b4e5873fdf24075b13b
SHA512 868e699a10baf0f48ac7bb4086054ba3c06779e190c87fb772f96dae74490efc84a212c5e267fc11f84ad1baf9f4b638cc9bf5adc278fdcb2a5957bac37277f3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxhZDahh:A3k03kB56rw
TLSH
T147156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1932-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1932-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2248-252-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads