678a649b4547e56cba17ad433457bb3ac05b9cef09f95cbd78ec61c3c6dff936

Analysis

max time kernel
90s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 934KB
Sample261024-kaa7pas1hz
SHA256 678a649b4547e56cba17ad433457bb3ac05b9cef09f95cbd78ec61c3c6dff936
MD5 75877ae167529e276098f2048ebc7043
SHA1 88d6d11d1f0cc8e6f53c9f090c133eaf79ce9372
SHA512 278e79a95fe13e29bad540ec8ef2e491d87291eb5557ec349a4dec804c41506d1edec5604529b6d28387c9b507368b3188b865ce027ea5fe4516d4d0015da74c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Eah:A3k03kHRJx
TLSH
T1B515AF03EB9500E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/4668-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001100000001c497-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001d00000001c4ba-10.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a4-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4668-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5948-221-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-295.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-470.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-702.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-782.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-820.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-978.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1039.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1058.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1096.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1097.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1396.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001100000001c497-5.dat	aspack_v212_v242
behavioral2/files/0x001d00000001c4ba-10.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a4-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-240.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-295.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-470.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-702.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-782.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-820.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-978.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1039.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1058.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1096.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1097.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1210.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1319.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1338.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1363.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1396.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5948	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4668	2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5948	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_75877ae167529e276098f2048ebc7043_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4668

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 934KB
SHA256 678a649b4547e56cba17ad433457bb3ac05b9cef09f95cbd78ec61c3c6dff936
MD5 75877ae167529e276098f2048ebc7043
SHA1 88d6d11d1f0cc8e6f53c9f090c133eaf79ce9372
SHA512 278e79a95fe13e29bad540ec8ef2e491d87291eb5557ec349a4dec804c41506d1edec5604529b6d28387c9b507368b3188b865ce027ea5fe4516d4d0015da74c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Eah:A3k03kHRJx
TLSH
T1B515AF03EB9500E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.4MB
SHA256 7ba57f8c61521d73973c59371a967f07df99543349ff91fe42e29d4ad64464b8
MD5 b1c5adb583b6a6bd2e29345e4a41c374
SHA1 2600f1b3a697885603f335b044c9f742e96b19e4
SHA512 03472439261776dcada4381653ed3cf3dbf2db07ca5afab49b7f96eed0078f07a16a4d01434379492ef48feb544b3b83009df3a5cfd8e6205149e1c3f6e841fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Ea80Le5ji0hmxNrM:A3k03kHRJMPji0Aj
TLSH
T168658C17F6A402B5D027C1B9C6D6A66AEE7138421B3086CF1358C7283F67BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 949KB
SHA256 fa79fabc65040a98782344ba0c8810e6be4545d810f1b408b7f78f453cdf97be
MD5 b84770ba653fdc44c95b87893bb42828
SHA1 0c26a1e6880c9273b4238fb15a3a57dc3b3ce80a
SHA512 d8dfe1b6ad200d3b723ff70aef41dd0eb5d9948b9c0f93e75d5ada4eabdafad397c3f662e0af7fabb717b40283267736750e954c2943e1b7577291d04ac67c98
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Ea2a:A3k03kHRJ
TLSH
T12E25AF03EB9400E5E10AC1749AE59A23EB75BC56176097DF2318D6152F72BC0BF3E3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 958KB
SHA256 f3c568d65852c21b6745b56008b39dfa649dd8f32fead6d8c75f5273d464bb3c
MD5 231b9442c144009d7d3dd352d93dc541
SHA1 116d6de6c2701dae5ef216f62dcd483da24892b3
SHA512 32099b420dba2eb86cbe46133379d73d8d8738a3bb6dc0268f328f74c033f8954f193d1fce84c6f154248d5f7745932558e5a406e7ce1eeba113b780f438c291
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaX6:A3k03kHRJ6
TLSH
T1D325AF13EB9500E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 958KB
SHA256 cab1c890090d6cb395d797f086bc77b0480c8f040bb7b331f725ab2f49eaca03
MD5 622150c39dc7140cdceba668c24bde18
SHA1 70a24b02b2979bb343ba4901749f3d24bbdf7935
SHA512 b78aaf27b7dacb32237f325cec5a9a3ba0caf4f61adfab5b183512609640ef7f632dc4b9dc90eed5b9b81979f507157b124dd9f1f4bc6a24a103fb7bb6fe47c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Eaho:A3k03kHRJO
TLSH
T16825AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 958KB
SHA256 cd2c1e24a66a03dc79ef371a1c6bb5e6179e1dbd5d8c36421eda674b7ced9123
MD5 5e04f428619cef9d899f6aeceb591256
SHA1 0e8c76435ad825c34ba6312effb79234230ed4b9
SHA512 ab2ff8d5705675562b32f72f4476a71e46086c3667f6503ce7dffb4fbabe3b93178612c2085dc7adb052cf51309267558c7949dc4fbcb66627b11e4a155f74a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Eaxu:A3k03kHRJo
TLSH
T1CA25AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 958KB
SHA256 43d6be30c6b488c1a42e5c3d22f0a2988413a2143e8e08811042508c2adaba7a
MD5 e8f32f30d57fbe9778622db95069bf07
SHA1 ff3191f2081329a76e4cc4777dcd021d03081460
SHA512 8bc6239f776fbef1f373900e19250b01fd331cc607c723b2a97cfec7180e7d6382b329a7f1eca71fb9a4225c4cf1f67bbde21a58808f914e8f386f6978c08460
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Ea39:A3k03kHRJ9
TLSH
T17B25AF03EB9500E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 958KB
SHA256 63018da0bdbb06666c160fc2df9ad5490a439f13311b1e65a9e1659916cf7b76
MD5 9e7521739ef9a8c1b6e35b7cb1acbac2
SHA1 212cd878cf37e512affda35d7dbe9455a0f37910
SHA512 1133e12c68915990427568175303b78a563bfa765c7b4a4062dee88ef366b3c06dd4b42edeaceef0532afc5b166561b2694c7b8512cbfde6dc7f981689077280
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaTc:A3k03kHRJo
TLSH
T17725AF13EB9500E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 958KB
SHA256 f8617757b3437e8d00e8fa5cb47f996aa3edaecacfc297da58a1f4a1131286f2
MD5 587ed9f40949183ae22f288d0ca74b70
SHA1 0b267412c6b2ed39e739d4921fd72cb2ea89088d
SHA512 9d96060124927da044395dfcf5e7db6857f11f4ae0ab1b312d39a2c49c98864856294cf682119599dc402b560827e25f584bd87846e8758312002aa19a3f236d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Easp:A3k03kHRJ+
TLSH
T18625AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 958KB
SHA256 69338ea047d4335017d5363e18dfd44520bedd6d30d0976c8a95b2f787675b1a
MD5 5e8c10d51dfa1d014b8e2faba76c4440
SHA1 601bdfcd020453ae7caf8f1625b329c7dfdd5948
SHA512 a5b01dc43a4561acfce76450a9529364bad238bfc9bf4273acfbc128119cee756e484d141a6d04b7f10530238899193d4139446fcd850cb14f17c5ee3f510e1c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaDN:A3k03kHRJx
TLSH
T13925AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 958KB
SHA256 66da961a5a124775b528c3093225eb567c14b2b55fd57753e12a95847c9d0248
MD5 96a2d9648a33d61961b41468d521ee7a
SHA1 6a130d353ecf5e3425631a81a1df11384487cb02
SHA512 64da71b467abb6f1ace1dad63bdfa234a2b960d50f5954ce8ebd9552cdf3461d733b61eae6e91c53e7803f09f891d65659532d8b9f724faae6cfa0ca53d10aaa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaxF:A3k03kHRJD
TLSH
T17E25AF03EB9500E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 958KB
SHA256 35bd26d569445b1568e118e6fa200fc898cbd70ce893385eb36e1714b1e3d19f
MD5 26fedd322ffa1ac218adf9ecde655867
SHA1 4556d9b888f9ef79a35c07d8a8b53a50a397f53b
SHA512 c136bd243c198ed94a4df77122f0fc1fce0dd450353cf7ea5876b029c0a53636d96638232ee2975a6dd73c869c6842fbf0a21be5d5badcc613f25582b4556afb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaaC:A3k03kHRJ/
TLSH
T1A225AF13EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 958KB
SHA256 bf97088c7564bfbc1bf8a2672726ca43cbb5e21f7f4e79421a31ab460ca315db
MD5 f41dcba8a6a4ddfd6607a9df0d07a6e3
SHA1 e0aa24c3a44e7d89840feca8d90bebcc3eef57dd
SHA512 d3595695f07dab7e43de911f8c3fe7b5259ca211f17a4dfa4e995d6690a31978930c04fe36ab19cb183f34d2bf78a861418152f67c820530a5cf726c57614e14
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaVw:A3k03kHRJa
TLSH
T1CC25AF03EB9500E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 958KB
SHA256 928c23afc8aed409715c178606b3bdc616e1d54509462866db6ca99588a4ec52
MD5 5f2f982d5a07147247112a3acf07dfab
SHA1 86d2435f941109e4d832bf187eb847294e81d39d
SHA512 a19a4ea2ddfaf6dd195454b49743c3c666c70c398a212307c4a219484531b1da3ef908bd586146a07fe639377a424c2e0f23d011f50510cb8d28c0e08d45ec7a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EakT:A3k03kHRJK
TLSH
T1CB25AF13EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 958KB
SHA256 ff68923c5099006a0b027e41eb30c799e51b0527e781ea2a36255bd7732871ef
MD5 d48a6fa59e83e59a60862bf3d5c85ec6
SHA1 767737c1ffa7377f9e7bc694cabf1df6810a35fb
SHA512 0f89c8562526f80fb3b41d54ad1046b57b2545f656e5761c6d48ad1594594c6daac757ae783ee569c456aeb672857fc119fa1999f6341afbbd089c72bff5c43d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaIu:A3k03kHRJF
TLSH
T1CD25AF03EB9500E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 958KB
SHA256 35d5204d4cd1c93a3ea4716851ff419a639fff96de91bfa93d4b5dc6680bb991
MD5 72c6cbb41ada7846b6d90d2ba67d979f
SHA1 8f32c7d8ae2aea40344f5540793a75e5e0f8328d
SHA512 82c4eee128b048db9153c6ab7d8c10a8fbd84d25ded37fb2d37305714e87daf4607706db331713e9866f5ba9417cea4cb1bc389d8edfbf10d7dcc1b08f52a590
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Ea2b:A3k03kHRJk
TLSH
T1F125AF13EB9500E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 958KB
SHA256 35d0990edf3db10b415c4f433abc9b5aca7ccf77436630b5bb6b0f54b7e9a41e
MD5 63aaf1d71cef39ed58a7208740c66d8a
SHA1 6766faf0b80f69f1498c8115f0a82f832ba7a0ef
SHA512 b1004c85d400dfb5a7ccbaf5352ccdb602916500f72ecf0555c9cbc1f3b26f96436762ae0774456c5b11c6134ad609956a31911b861a64adfdf3021f7daa3cf4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaAf:A3k03kHRJ0
TLSH
T1FE25AF13EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 958KB
SHA256 03e2075bb9d101f981c9169748c7331e64a7d8580abfd767db9a09980cfc4f79
MD5 d683ad5e40d0f20ea94f7b1a1a1f53d2
SHA1 67dbbca17aca100a1c8b4d444f8b18503726befc
SHA512 4a692a5435b18914bc25b4c07274fbdbe20c6d1b981d2e4116f6d40a30db13aadd5ca1fb1f6454301b9cb6f5b185ece25e9f9d3a03e656c6501fd80b4672bfcf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Ea9K:A3k03kHRJk
TLSH
T17625AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 958KB
SHA256 01cb664747bce69bd53cca66048f20c1572aad2620ca3996cab6f2ac846a0a60
MD5 01bc1de58715d2862f12cb28f20e54de
SHA1 ce914ca019ea783d727f1069564145eab528bd3e
SHA512 4f8d53957f6c42ccb46926b2dc78e5bc23254283b27197d3ef7103885d5fa2255f829b392dd505629f9d387703fdea95753dad4ad4f8d022a233f67f594f676c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaOk:A3k03kHRJ9
TLSH
T1D025AF03EB9500E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 958KB
SHA256 2a9c5ab32f16a80224a610d20a63cda662904b40292c762f3ceda9c894219107
MD5 a86fd37ea041941a2da04a242a1423ef
SHA1 22d32781829f4408ad955403a1260137997854b9
SHA512 7a0fb504e4f2514d0fd5ce657a7205a4ce97a8ffcd2a305c34ae4bee2a0f9f1b7fee5834280f21ca18789aa3bd47fb4d2e60c24beb4e516ee8b15af5544bd23f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Eab0:A3k03kHRJA
TLSH
T12625AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 958KB
SHA256 922fdc2ca9526f980e1b2b0084ffbc3d5f497e402eb3721c23f99aaec49522c2
MD5 5f9cc39a25e8c49ce5f4f093377108b9
SHA1 91c7ea66c7e0fdb77867b16263d710e2758ceb2f
SHA512 78675b7c9a40e0cd8dced6e7b8b92e594bfecfc8dacbfd3982c2f05fca4edc7942be1ee2caf68295d52b0b69f9f49eedf93750a088faa7a3b22c00ce25c09fa4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Eaqg:A3k03kHRJ1
TLSH
T17C25AF13EB9500E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 958KB
SHA256 7a280cdb6000dc96fad45774d1461a1a43fe185fa86961c5def6fde67aa95b75
MD5 6b7cbf6bf1ba367b484febd4bbf348bc
SHA1 6bd3ae50076e025a8e44612199575179d687e434
SHA512 d348294be6fdf2e236964555df0944cab737000d76967061f4b06987f04fbdbbf8c440d751779b332ad4bb2804547467e1200fbfb2282216692ebbacc120019e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Earr:A3k03kHRJ3
TLSH
T16525AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 958KB
SHA256 d25da4da23ef676cad4aedc2e2c0592d009432efd5069ec0d3fdadf3ebafca75
MD5 ca8be444788b17bcf9e90bdcee89e2ca
SHA1 735c9cfc90a7f123a4e81df282c25cce1e11a1ae
SHA512 10f2a61c0f0ea8a5706bc78044887ba67170fa77fe852fa2ef8dfecad9d232b7d46f7b8b935f8569c9c2469f08458befd9c470e116ebe2d99d2197b829f3991c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaNn:A3k03kHRJB
TLSH
T1EE25AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 958KB
SHA256 ae094b07ede787de66b0dafcc4e6a57670fbfe5839f819d20405d2083da6e2d9
MD5 f2cc9bb099a8291171fe6a69ca07d8a4
SHA1 7504f4403833835fb8690f3a9aa72de30094c9f8
SHA512 de8b18157a812ac7359922cb7cd4bb8b48e4b99793ab6c3deb05b7d29f5f8d735c7e94a885d6224fe06881e5c464b241fc570b3741e1bda0b971f9b118657e44
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Eapx:A3k03kHRJv
TLSH
T16B25AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 958KB
SHA256 39dd556165e03f4c2431115e7cda3e00a79a42d8f101faeab1fc3a66488b1f8d
MD5 843c1ee666ae49716b7ef0c4233e6fe5
SHA1 7c8889e284f0d1b0ee83400251c86ed6b10055d8
SHA512 ec85e074dbf2479ce5648cf78d74f97b5b469cd3eecebb1e25286f0a8603cf94574be099eb893173685b7cb0f1f3636b6e24adefbd3a312d0766af800c1500f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EanA:A3k03kHRJw
TLSH
T1D725AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 958KB
SHA256 13cbc0738344c753a9925c35b53348ba34b8fa597246ffd757e7de705eeb1ea7
MD5 849e47661e12e487a444b7c4d17e2763
SHA1 2f32e57c4ceccca60cf4a17f9ecb7a65d41edc3d
SHA512 5063fd7e6aff3e594e1eb43befdc87e74313bcce614b04fa780f81b113a53c50681e27a232db691795e146628c6aca069a3df5c45ac0161515db72a8f97e368f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Ea49Q:A3k03kHRJJ
TLSH
T13025AF13EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 958KB
SHA256 1faf2deb0ac42c27062e7e63cfff870861165a4e31c8152601106879d581e955
MD5 794d102b232a4267844815d2f2d1b51b
SHA1 f5fdabaea1746e7e781cd31b669b764be8860ec9
SHA512 05460702c5f3d20d8f0bb1acf80a3b4123dd6f6d00d050b3b03c285b3488b2090c56ced367e76e313de493bc05153b639a3a97df9a22f5925e311670dbae54a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Eap4:A3k03kHRJe
TLSH
T1B725AF03EB9500E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BC0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 958KB
SHA256 99f957faf114f2686c3a3d97b43aebe806fa23d90f7c0cecda6b6e4b5ff475de
MD5 c73938252914d8b958d49192e9b61b9b
SHA1 62f6302b88dfd7475a91455c9680dea1acd1516d
SHA512 258b575f164979600ff18f01914a0e0f921a803725f9b5497e95c55c79a7a70063a5ca05715eb2ae42d5ecbb0b396b7daf8744a20ad009ce41154684f002ae6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Ea8u:A3k03kHRJ/
TLSH
T1D625AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 958KB
SHA256 4bc8031e0cf84ed1bbeb60d9a313f091884fba35ca94b405af042940bc99a4e7
MD5 3ca73defd179858dd86111edacbbc714
SHA1 cec0e2c2fa18a13a928e7fd4f48e2498f23650df
SHA512 602c8c928edba57cca8b251b1f831d4718c79d2647d0a7edd2f329b0e1d03576f304056f6f9ae3ceb53aeaa6ae20a47efb12e3dacc01296bc1100730780b036a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Eatj:A3k03kHRJh
TLSH
T15D25AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 958KB
SHA256 7c25edf8c18a69bf8e37a18c385ded894e7d58342d38e6a2105619f2ecf56623
MD5 4ff222f4ae6056044a352f4c5a511dcc
SHA1 d0997c21a26c0423f7ca6d390e4c320aea1e7c0a
SHA512 fa1781c0a4a0ecf42eee4c435bf80d32e9881f742012e358c93b9f9a28f5e76a2fe6673bc16c501796b6bb7914435f1167157933f84e5f7ad7a0756cb5d39a19
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Ea0g:A3k03kHRJl
TLSH
T13B25AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 958KB
SHA256 5ea5e01700c474035d7710e2471616f5f788ce11a5dc4ab6f06df617904bd428
MD5 f2f304f5bdede17a450f6bd04aefb2f4
SHA1 7b147d5180cea4c0cce2cac5e2dde34125769ad0
SHA512 1f5f7fc22af8d054583b2b03c3837b076152129f1032ff219baba25f4551e9bc3ffdc58c48dfb1c5e96b6e6c410755d11f293d4754776649e61016844cf92be1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EarI:A3k03kHRJM
TLSH
T12C25AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 958KB
SHA256 6bbfa8d5784b0d05f7c5d49139c18eefbc85353e8f035233d13b09bced2c4d3f
MD5 6068dab00190e919ea8be3b853d4d35e
SHA1 d1223088f3ab932f1a0f4cab87c79017aa392cac
SHA512 2a9c3be4550efee966ff22a40a23fbd2257ecc46344053ba7acf83786955dd14c7ecae2cd239a77470e32feb5c60d1f93186310d6b966721c45d1ffabd6779a1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaBo:A3k03kHRJO
TLSH
T17525AF13EB9500E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 958KB
SHA256 578dfae8c4cfbe1821ddd4c2bd08132fe91d2d16be5a7c54a3dfdf10e77ed28b
MD5 09797db36a78bd533585f56d8728429b
SHA1 637504309fc679737778022cc41a0eb3bf7a4584
SHA512 2f04aaec4b8675b9d77ca64d8884a65bff53e76c8e84994953993ba69a16706443527b62ddf175068a341c41415fce67ff9f607f1fdf412418f4331c09d460e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaS+:A3k03kHRJb
TLSH
T19625AF13EB9500E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 958KB
SHA256 d6a84f921918de3812b3006fdaea62b52658a78b8c21c71bb6724c26acf2f733
MD5 b57f7a18b84f036ca7775f10900be55c
SHA1 2ebacf238c484816c22afb947976d9b15e3b0f74
SHA512 03290c9b6db27ff591886c3c646b3fec28bc0e44b084a794bd94d9c60905098abc94be094b1efbe4d37f8d5814df579c554bcda4450fad320596ad45888fe0d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EaSQ:A3k03kHRJf
TLSH
T1AB25AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 958KB
SHA256 e92aeffa9d067f7ef4e25502cc62b9ee4835a39ad07a5d9d8fd91e65974a2439
MD5 803fefae5ef8d90f7e7a0a0a10b09d35
SHA1 87c0db06a9ab3ff317c672234537c98178576758
SHA512 30ea5eab352c5d231bdaa9bc47a39d84354ddb7a729e81487840d6b28dd0ac4f7c477ae0d7196f3d53a22d96fa8f1d4e45d3c9fdeafee9dd42849149d9488da6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EazX:A3k03kHRJz
TLSH
T1F625AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 958KB
SHA256 d35703e09a4906e593b678a52dbee44c5ec52d3d3ce4592ed941e59f2ac463fb
MD5 c6e1254254b9048a7c5b3244afd6f508
SHA1 5a8c401347eacd984673ee272124274674372c75
SHA512 263eeb0ba95b7c58993630d6d08bc913614f4f9a6ffbb5820ea56692659bdc317095f68e29475d91d4f2778e9ee29b172e302c1cc123fc8455adeb872d5a2374
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EahL:A3k03kHRJ9
TLSH
T13F25AF03EB9500E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 958KB
SHA256 b951e25aa3c55a17f109d280788ac0323aa58d786e4435c4627d42637fbf69be
MD5 969607f7d5294d8cc24a0244adfe9de7
SHA1 bfb0c6938c25068ce8bdacc09af0305bb53113a9
SHA512 f73604bc10f6e5c41dfa20ea3c46f3ce3a1d7f32c06cea8f32f1072b2f8d1938ac5ff8789c220f2d5f6103979b9502567cd7db7f084a79cc81ab9af000ce06ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6EavM:A3k03kHRJE
TLSH
T15E25AF03EB9504E5E10AC1749AE59A23EB75BC56176093DF2318C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 958KB
SHA256 2e6fe5e1e202833fa1063a22c4a357d249be9bf28053ae7a1189a06eb2a3d736
MD5 9403be78263f09878d4466d636172140
SHA1 4525eefcd74fbd89c804eb6ed73917d44ae5ba5a
SHA512 37b7f4698695890bec045efeeaef3fa1b2902e8ecc812455f331fbec89c4ead3b16a68a7b42e2691a96af15a067e4463a35dbda4b2375b70020842277cc32be3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRag6Ea4h:A3k03kHRJ+
TLSH
T1F425AF03EB9500E5E10AC1749AE59A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4668-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4668-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5948-221-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads