f8fe63065f8f84a01a19b67b1528f963be06b1b1c611e23af1252a8e8ac90087

Analysis

max time kernel
101s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 886KB
Sample260905-e6vnbattgx
SHA256 f8fe63065f8f84a01a19b67b1528f963be06b1b1c611e23af1252a8e8ac90087
MD5 87b875b4367e0af6f26fad19a1ec0d35
SHA1 82797ba58b611f2380e167ce9e48b790c1537848
SHA512 ccdfbce414def3cf9cb593f1110edf57b34f1c8c003a4baf12c0b5e199cfb0bf55075023822e5f7072bac225ab571df543f6e56a52d55b27dbb3e27919393730
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrf:A3k03kHRJKl
TLSH
T1B515AE17E79500F8D11AC1388AA69A22FB757C62173097DF1354C6262F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2944-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5d4-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2944-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4116-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb5-59.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001babd-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-419.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-511.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-602.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-724.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-744.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-868.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-983.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1039.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1064.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1107.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1213.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1361.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019929-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5d4-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb5-59.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-220.dat	aspack_v212_v242
behavioral2/files/0x000400000001babd-262.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-419.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-492.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-511.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-602.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-627.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-724.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-744.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-794.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-843.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-868.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-887.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-894.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-907.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-926.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-951.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-983.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1039.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1064.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1107.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1138.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1175.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1182.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1213.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1322.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1335.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1361.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1375.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1382.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019929-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4116	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe

Drops file in Windows directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2944	2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4116	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_87b875b4367e0af6f26fad19a1ec0d35_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2944

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 886KB
SHA256 f8fe63065f8f84a01a19b67b1528f963be06b1b1c611e23af1252a8e8ac90087
MD5 87b875b4367e0af6f26fad19a1ec0d35
SHA1 82797ba58b611f2380e167ce9e48b790c1537848
SHA512 ccdfbce414def3cf9cb593f1110edf57b34f1c8c003a4baf12c0b5e199cfb0bf55075023822e5f7072bac225ab571df543f6e56a52d55b27dbb3e27919393730
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrf:A3k03kHRJKl
TLSH
T1B515AE17E79500F8D11AC1388AA69A22FB757C62173097DF1354C6262F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 95370859f9e2c604ef91331afa7090e7209a7a5b16b2cd1bd6760fe2d6f24e16
MD5 20d7ef326e6909a40ad29a8e8a4d8ef3
SHA1 55448ba1343c1613bbd9502b464c5bf10015d142
SHA512 577cf2f4a24833b60ed268457a9f495cfb313f2e4913f5d2d29cf085ded6fa3fde1cef15a91e2b31b11092fdff36585761716dc965782f1e33cc1eee26eb3258
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrW0Le5ji0hmxNrM:A3k03kHRJK0Pji0Aj
TLSH
T11B657B17F6A402B5D067C079C9D2AA5AFB71384217308ACB1394C7293F67BE19E3A770
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 934KB
SHA256 e3ff31be776c2f80cab56ab4dee21f5f3d325653dae2b57c5ada01b6c939dfa2
MD5 b4c2f3a7c70d010ad3e81e97a9c5a5a2
SHA1 9318cdfe04628a9946feaeef0781726cb9540f35
SHA512 3d6c9edf460a3e25ed1fb90bc1bd8f291013552cbdc69feab36d7eba85f08caa4e1f0a67143ecac0d390dec8d31f60c9891a4707dc06f39838af1fd317361d78
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrLb:A3k03kHRJKdb
TLSH
T1D715AE03E79500F8D15AC1389AA69A22FB75BC62173097DF1358C6162F63BD0AF3E764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 910KB
SHA256 71e608ac8f375ddb60d4014818ee103ab5c358066bc45f3c41808cf8912090f5
MD5 44c8fa0e32ccd50ab59774177a7d3360
SHA1 5f7b429e91bf441b4c6189825d404f53e83134f2
SHA512 4bba8454605857dc0565142f56a9d9a4ae528afc9be9f41aeaefbc79243a34c87d8c9cef6fbf41b91c3780c659ca22ba51ee1565d2c20580322196cd9067f485
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXr56:A3k03kHRJKi
TLSH
T15C15AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 910KB
SHA256 151bd14a8e81ebcc12b40c0fe6569619d186d18bd0a6f2d3e3f4a105591c44c8
MD5 bd60469a324b4dc4e07496f5af95cae5
SHA1 e9615932a9b4318bd5af0547340bf3f96e6f8eee
SHA512 20bce0b3679a76d1394f00800de6c78d22344065d263b78a4ebc3ea23dbb0a455e0633f5cf7c312677665d3a89179e121112c4e9fff7ecb26515eca523a9b462
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXr3N:A3k03kHRJKL
TLSH
T19D15AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 910KB
SHA256 f428e1bdceaacd36ee43d6d31c6f17558077747938878f5075f2b326b0e95644
MD5 eead281761ef0e6c2c2704f52c33da1a
SHA1 d55f60966d0dd02dc5af2580216f396c03d34e19
SHA512 bd0f9baefe5275d9ec4dcceafbd4f50803ab58dfdfb16a6190df05403ca9f1c60485151365af5d4a6dc2bc066b0d96df04069a3a4f8336053c2bed3a052fbc71
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrNf:A3k03kHRJKP
TLSH
T13D15AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6162F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 910KB
SHA256 0440feb6953847c74121815136ea3090cc71131bd9209c046ef3c22b6eaed2bb
MD5 cac48700ca01b1b8dc9d8dc0442420a6
SHA1 b75c49f823c7bff3c5d732a5da23718ad1ef50ab
SHA512 29795a8daf106a9239f3eb6cc056357dc2b5b698f9b257eac037d5bdd33ec4e6acb7981c6bad73e8772bf930b6209749e350ae8fe796cd8db8d509512e818e8b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrPo:A3k03kHRJKG
TLSH
T1D215AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 910KB
SHA256 72177c83916ab18d3f4148aa34dd746d3500830b27090bb4ced7d168397e77e3
MD5 d77edaf785ad94191efe07903868e75e
SHA1 b759b60d4b4b7a83aa3073a584b4d8c98c5a5cb6
SHA512 73363d808a184590e2cd7f177596aff573f5d2e8556a78290227b254fee901ad4c6688ae62875ad596de22cade660ab2722be802ab5c439fb399d35d5d2dfb3b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrzu:A3k03kHRJKQ
TLSH
T1D015AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 910KB
SHA256 f22563e5dfbc6accc73cb910e6396056810325597533713f6a8213c4c59292d4
MD5 9a79867413971fbdd75fc50507f1f862
SHA1 db2138b9aaa47b1bf43815ad68f2f75cfe25667a
SHA512 e188bd751ce2e39ebc1e05c0cae923973b096cd20f435af17c7c722fef72fddf81aa8f42fac53f7baeed5649ce7695e3a82a5ff4e3e6080f8647f467da1c13d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrh9:A3k03kHRJKl
TLSH
T1FD15AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 910KB
SHA256 f335817bbfdad3ac28bc634e8d0846371d315d3c59beb6f6e60ab77ba3d5153b
MD5 5b2c1e92352265651b4805ef189646a1
SHA1 f491ffab8d8966b56c8340124bb7dafe9d6e00b9
SHA512 9e8e67204f33613a47a5eb0869e0f8ba1a2b5536a38f081503110ceb7114dde7653f274345d1041bf56bb9613b84fa2cd6ded872019aab33c5c2f22ccd98fed6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrdc:A3k03kHRJKg
TLSH
T1AD15AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6252F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 910KB
SHA256 0e2731460d95040a97dec969058c8c6edcdd1da01aa470c610ee4900428d1610
MD5 1439f7d3a8712a8ec0cbe9ba47d541b3
SHA1 da29ddb46a8719f807afdc785b6e7197df6e8d52
SHA512 cb8a50bfeec37ca1ba312c07edf453619c92844a14c3bf61a49a05f185a0d95d71fda85e69546fd2bd4eab737c1087aaeabe2521220b3b2854489c60a681169f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrmp:A3k03kHRJK2
TLSH
T1BA15AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 910KB
SHA256 08bf00f7b80a15f5125279977ac6e0ccaaf2d160d8f1eea182bf25ad43c124b6
MD5 6de3c97a6404ad26c60962abd0468021
SHA1 1b7f0c9d2271de05983cd30af73851a14d047260
SHA512 66dcf23a13eb1fe7f9f13ac0a1ce70bd2e243aca356074e99da9ca7274770e40dba9e41b48ac8e2060f4e7eccc710247bfd6d32da1ddda1877b814576e57e99e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrJN:A3k03kHRJK5
TLSH
T16A15AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 910KB
SHA256 ce734d5a17ee69b2d67d0fa11afaef42ee91adb6c0c718ec2b8c1cad27200d48
MD5 7c70e6b88e029e4eb25c2642a307e5a4
SHA1 8e8c2b6629e6c709bc4e6032eabaacff83f018c5
SHA512 62ddc7d08403354caf42da65c7526d07f35160ac6c3412ee220a695d7b3c54a3f6c1ffede79d172cc618212ccb7c42c48f741d5f44b290a3e87fc3b2796421c5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrrF:A3k03kHRJKr
TLSH
T17915AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 910KB
SHA256 a7e3995a5d59c34a9015fc999a8f6f60fa7ac6e4fc4ce1f3291aa8109a2c91cf
MD5 945799af2f03e34cd0bd5b9baded7e3c
SHA1 69e994f5160108683a054d71d38568b9ac6a3258
SHA512 5eca013d990f2939840ff31ffd24c68827dbfda97ab593b280cb63f59fd631e435739c6d8c9d617754f243ee4e07877609dfcbef0d5ba9cc23a3d389658a08c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrkC:A3k03kHRJKH
TLSH
T19415AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6162F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 910KB
SHA256 ebff24feb57bf2494ce67b0f29e5cf8ad75777454d36f02f77bcf98e64058965
MD5 15a4916184802588c13db57272078bc5
SHA1 9759696024bd79d039687e0e0483bca984cd3692
SHA512 b1154ff5bd8fef0bbb9f5a1b5e6c209ff1dd7720e6832ca2924a54ebc14ba778e9c728df75be816928e5ae97619c2b0e6af3c4e821818438c4df838f39f56de5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrfw:A3k03kHRJKi
TLSH
T16C15AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6252F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 910KB
SHA256 9ba0e44a5577314fcafa0feb49009f189e5a587474d053ba8efdc44a5086a7d6
MD5 b93b4513e4cfa78eb8a73d2d8ac4fbad
SHA1 97294b5a8ae1b8d9712e40907ea260cc39cb58f1
SHA512 4c9369bc263b8a0762d86fb2e9457041870f3cb9213fa4177f0572576a2e9baa9b92bb6ac527978e8c021133f2c84d093b08559017db640b7dd8833a6379a5e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrOT:A3k03kHRJKS
TLSH
T14C15AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6152F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 910KB
SHA256 bbb7e2f5dec31c26f42644779e9fd440d9ee9fd021a4f5e3aab2faefe2753ef0
MD5 a516ebad51bf926332472ff6c181f194
SHA1 a2ca0125eb5444b8ffe5d74ee6af83bb95214799
SHA512 9d69b4a5e0e6aebadc6878b4d87eb98159a5d6b78b11fb9fdd697d2c9e686dfd2c87f1caf53e2fd8acf23e9420ed29cb50ada26abca2a25eb5fce6189363cf4e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrWu:A3k03kHRJKd
TLSH
T14215AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 910KB
SHA256 669513152cccdd6a33a43254f16fcdb353bb4cdf933dbf897950e43322fb0639
MD5 0beb719e9fd8193dfc40f86c1d3d541b
SHA1 645f414290a078d6cc4ca1ec116a0b6c7a58faff
SHA512 82976d8d15b1712b793a0608c961c852fa14fbbefabaef43eeb9149a7d508ee9b5b7536a283f7da0213244c0678fece242eaba84d3e596e6d1bb12c7446063b8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrAb:A3k03kHRJKs
TLSH
T1FE15AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 910KB
SHA256 f6760722c2716bc82636f5b461c78e18a10dfc2078c9dff30a42e682e2cf6789
MD5 56814fa27ed63b6cdc6ee8a1e5796dc7
SHA1 edf2b43199db66f2bbe1c38c1f248bebbc2be6f5
SHA512 db031e78383b8b3a786cdf7be8ec972f848cf49aced42a3980de4ba33d85007a09f77ade9d2950effdc13502182299488c6510d92039defbe894f8f9c2ca2790
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXruf:A3k03kHRJKs
TLSH
T12A15AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6152F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 910KB
SHA256 cd81e38ce1dfec0e5b6b05f9efb6db4a52beec6411c50b405bdb659c10e31ccf
MD5 9f5a10d7df3f650c211a521792f73379
SHA1 2cc00ceda2eefeb9f60694265071a915ebc5b9f9
SHA512 5f1c2e416f3e6cabebfd71726156263d064bcf35bd4b8714018697c62bda6f587147402ee916b22854ed567a6e5c47baafdaf2c538445c0271a66e98404a77c5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrrK:A3k03kHRJKc
TLSH
T1A215AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6152F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 910KB
SHA256 a6bf15dd0560c48e65748157a60ffe43d5f7e0bf49cec7222fd5c11ba2711bbd
MD5 55fe60b847abed1d8fe34ef5bd873b8e
SHA1 31555b26b6e2562bb1407d97053574484ece22e9
SHA512 c4ab2c23bea74122dd8bd63d9fc6c556f4dab2ff3e0ed0de8ae93695ecc02ac4b012cf23be2c75b70e1b65a1de2488ca864e2f27aafa10ecdf1b65812c679f3e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXr8k:A3k03kHRJKl
TLSH
T17715AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6252F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 910KB
SHA256 15e7a674f9258778cb05ae629c64c6fefb3e91eed8b82f7850e3bbd783811042
MD5 eb5d6a794111654ebd7285e964b1f54e
SHA1 723aa1f4c196b624c51b7a9ef2e400a0c64de958
SHA512 5125c9e329ac95b39625a11ba187a41195aaa8213ee8e180698247aa244acc1019a46d485beae500700b212a0418cc494a1d0f30a0becafccbccff8e5b4ec841
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrV0:A3k03kHRJKY
TLSH
T12D15AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6262F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 910KB
SHA256 ca67877e35e137690bb8257cac2d1540da2331ca09d40138fb6c9b327e18d5fc
MD5 a292aff2b6c3de21ab1d2acd7d749ff4
SHA1 b7552623a5179b891edc75493362d25199d778c6
SHA512 329b1a3c173f059077d56e620ec2ccd5b857d25f13999f806f36f52351fe822e63923d512fdae4b622354a7970812a3e14b7088dce48dc9850001cb614803b8d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrYg:A3k03kHRJK9
TLSH
T18315AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6262F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 910KB
SHA256 7568fae1cdef123ce4071daf6eddbffefc8096e7fd2479280774e77dfa54b7a1
MD5 c956525b4ecfcccf0b6d8215c616e3ab
SHA1 64816ec6a42c77f0fcd286becf900ecbc35e1eda
SHA512 7c80b76de7bfff2d32b2c676988c672a6ce86ac393bc5071d4c0ae231dea7c73d585713948d4711824f8b05ebf4b0484ce54b1ba9b8e9f7b04eb2dddeb845be2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrNr:A3k03kHRJK/
TLSH
T1AB15AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6252F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 910KB
SHA256 603855e0d21f8e657e0d767d826310efe401e5299ba39ed112c3847faee84106
MD5 8f9ce94b2eeffd58572a5c28a0f88b8d
SHA1 e5440e48820e500c5072d6ed15ce652b00916fe8
SHA512 38ac505c9bb1507ed5cc18d8c046b43180608f8f9e8854f9254a3239f1c081b2475816d4777c9130f0f9e519a1db4bcfb3db78926f0d84568dbdb72e1d442a9e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrXn:A3k03kHRJK5
TLSH
T16715AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6252F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 910KB
SHA256 066f3df6f13d8822873c7cad903bad29a93af88e9d841a9ce4673a0ccaa02287
MD5 a738a7eb5b27fec2773db2386cdc3658
SHA1 081c26e2dbd8d9a7a7c04b11315aa9dd1c9dab1d
SHA512 d59e28835fa6147f59a461bd2e9a5c0cf29457e3453384837f16c9f1930be34a43c2bee7750c507686bebf0c9557ef5490aeb869c89a5317f40a94cab4ead3a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrTx:A3k03kHRJKX
TLSH
T14315AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 910KB
SHA256 efd35c87b888f69ee2bb8aa46db625a27380050b2224923fb7a82513a77dc0d6
MD5 a32ee1b35e1753e69db9bd09b3075ffd
SHA1 903123ad483262ea2d4e1d00e8df68749b9db3c5
SHA512 06a9191ef078eaf855d09e23d923028e3b8ffa6c60f339b3f7de513c6a04796c72273c9c3d09e72ef934b5f4bf66d1450883122c383db8176d22a003d22f3843
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrRA:A3k03kHRJKY
TLSH
T14615AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6162F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 910KB
SHA256 0278dc04e66b171485478589e9987ae76c2ea80a567848c9a85d7a01f946633f
MD5 fca777f86bf3ae5a8311cb9561de999d
SHA1 570cf07d7141d8ade09b6637c08e42898167b7d5
SHA512 835eb527c8c66de07f7538e3174e9fee2b3c8176119872f7e9ddff36e750a14eec8672acada9f967216280d8fbcca2f7f10858f318bc2696ae7987cc1a838dcd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrK9Q:A3k03kHRJKB
TLSH
T15615AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 910KB
SHA256 52cbe8ef8860d62897ea1994f95f2bf9bb0915b04a2c70b02df8c9966e185337
MD5 cd17d2841a82f64a5ace3f6877727ad9
SHA1 fecd55d227c17d4a2af98765c8b82a5aded601f2
SHA512 63731684d65a6e2e1078b141f91b214d32b68edff6704301642cf37c49d6903f713ddb8cc55965202a8e86c693c9b2b1bc2556549d7c51a0c311120811a064f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrf4:A3k03kHRJKm
TLSH
T1FE15AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6262F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 910KB
SHA256 c60830cec5b633ee97291afa832a28c951d4ece8dd33fee494c20476d1bf90bf
MD5 3eec63d4cee9379803eb0d8372e97312
SHA1 11c83b95c98801edffa3887756f3fd73b5cffbcc
SHA512 73640b1054605a60f948607f63a1e0556f2959596639f5e71022a35a0f5231667d9affa973ac963475c61c1fb186f0f66c985b39de1f9697488f6868a8763fbe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrOu:A3k03kHRJK3
TLSH
T11115AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6262F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 910KB
SHA256 566e6ea9c025038a4da1ecfd9d01acad7338d7f0cf0d6c204c59c2e57f45b41d
MD5 2160dc17ee6ec5e70d6427b266926f5c
SHA1 2dfa8f9b92d86b87a5007317710c9d71317f8214
SHA512 d593c11d4771c6dd3c0f37fadeb413d967fe30273fec82d9dfbb9d1873a2e36ad256c11cf3af7ca39cd0345894695b0001a08868e85a78d87ded865ac86264b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXr/j:A3k03kHRJK5
TLSH
T1C715AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6252F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 910KB
SHA256 bf1ce390be2e7e72338ebc2127caf8a7faa899a4abc878e4e73dd2dcf8ac33cd
MD5 02c1390883996a757799258426e327a2
SHA1 ae8730bcd2710cca089cb62a29e4d53f0b222b47
SHA512 ad258f12844449df095c6e53ecdec5cd832b8b35505f8ac3794365707d1f9fc6f4e415591c59d63f6879b03c27265e8b4a1d1b5e6d7caa163ae18f1085bb7b30
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrqg:A3k03kHRJKN
TLSH
T1FC15AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6252F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 910KB
SHA256 e23b7845d6eaa2ad36d54c08b19b03d1e3ed48c55418ed7e5ece89514d41dfb8
MD5 e41556a095d7c14ad7fa600e7bea4767
SHA1 4ff07c04047ac68b7bc0b03fc0d4444ff6d7ad16
SHA512 a3be44685f82a4d4204e42ad783820fcd69faeff9455c74fa450e7316675509b27144720b371be11183dd568b104bce9fc331ef6258a58cf254a3f852ac297f4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXr1I:A3k03kHRJKE
TLSH
T18915AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6262F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 910KB
SHA256 6dfefcfafc8dc06763f0d7f339378d9e057866f1134fcff5831881e315ede2ce
MD5 00bbab7ecf9363f82c952ab1052cb662
SHA1 5009002bdc5f858c4b49f8f587d3695612d81451
SHA512 b6b66f76580e42c86607fe5ddd90b89f4786f95de9d03241af105660f62dde3ce91a523f59c194ae917f42b35ef08b63ce4a0e3acafd568a1634375ab98b9846
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrno:A3k03kHRJK2
TLSH
T1C315AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6162F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 910KB
SHA256 989ca2b27b3c1d28576b5c183f22edf086b6f538e126c2cc3b51cb3018a0fcc3
MD5 19b71f8475db0d096ccf5ac2909ae2db
SHA1 2e1c5202d16308626dc762a41d6edaa02c56c0a5
SHA512 6956c6bfca0af057789dad2a771577f41898bb7ce8f2d92616df3f0d6831094b6778e0dd7b4dd3efd58c014e8decd64b749be4cb23dd133e24edbb34ca88c0ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrM+:A3k03kHRJKj
TLSH
T18415AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6262F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 910KB
SHA256 f331fbd0abedaa90b1a7dc6fb6c5461e7a77774fccf6e15ea0df8afe6984ec76
MD5 c1ff7d67a45d8629970ddbcc7d31d031
SHA1 74409796b460cd42339c5c355294ed30d1ab8056
SHA512 3cb44230c92a39465d9f0215dab54eca118598217b5da66f49a080e2d8ae2012acc7df16b06cec61f8cfe181a0b36571268fb08653107878de51fa42f05fe514
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrUQ:A3k03kHRJK3
TLSH
T18E15AE07E79500F8D11AC1389AA65A22FB75BC62173097DF2358C6162F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 910KB
SHA256 85a285c06f0375962390a4633790b5d70a525e906f36c419674665f3c791119c
MD5 e7e3a5e0e55bc56b4cf51d51e6de14e2
SHA1 efe7f180a17444ea2cbb18e2c773a8dfb1b3c60a
SHA512 6e90db9405e2183b408fcdba32465d6c75d580dadf4ae8c801b1926acfcc10b4353067921715981ecea3555af27e4a55b26b32aca31a53a01451b7b7a71f291f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrNX:A3k03kHRJKr
TLSH
T17215AE07E79500F8D11AC1389A965A22FB75BC62173097DF2358C6252F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 910KB
SHA256 80e4c5d2be909aa997336832fe073c6a3407b4f9f9bf02629e0f217ab056a4cd
MD5 d10159b82e17086651be779deb66cc93
SHA1 cf31783b0ad190d04234c935d7e71f6817b897d4
SHA512 319e0b8fc085049b489aa29a0c7fb9bb23e6ae41a46e9196700015ce677ccb381385512b154e96dc4b1606d9845f5466823d84046d97cad63bb8fa601f4a2f2a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrvL:A3k03kHRJKl
TLSH
T1D415AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6252F63BD0AF3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 910KB
SHA256 62824c9b1f9aa90f1b033e5ca97a9715a867ddfd5a0ca1cd8be255a1570ac65d
MD5 07b262cc2fd4d04def5aa2d8eb2633fe
SHA1 f8d1e76d9321fc3f6224047fd317f7d70b92ff48
SHA512 fd71b761766e7daac359de9a7e0b54ab5dfda1640d5647c5153fcacbf50fbf07396069d585ac284cddfcde2d96319970308419b80aa1abc29959712f82b728c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrlM:A3k03kHRJKc
TLSH
T11115AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6262F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 910KB
SHA256 628a2673c33499818918d46ebf4b3d1840574b7ff6109e8b10bdc5b68d00a406
MD5 0ba43c6806f59a9160f1633339c500c1
SHA1 072fb73dab31e177fcac4ac2250b59e406d3ceb7
SHA512 a546c7c9e651567e263fb6a4337487c6ea46e526092970cc64ecf65be2c59768412c952cad125ab839795f0f51fb44e9f983eab83e25795f94f1faa5886d703b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ7zyuacXrWh:A3k03kHRJKW
TLSH
T13D15AE07E79500F8D11AC1389AA65A22FB757C62173097DF2358C6262F63BD06F3E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2944-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2944-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4116-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads