97f3dba161801cae09805fa900e0e9401da821d98833e746be82ea67421cae26

Analysis

max time kernel
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 945KB
Sample260630-e5lc9aew5s
SHA256 97f3dba161801cae09805fa900e0e9401da821d98833e746be82ea67421cae26
MD5 b6b78f897825c951f83d7d4534a64680
SHA1 3447dcb7f58a5d44db7c7af640b7794a3875363c
SHA512 1bd210f26e14761e17e41c7fea9d6720901e288b4c0ed5b0fe40333096f21e25fb72f5c1de3e54f994e514d1a3da8e3687895fec2034cfd8ad192011a2405ea1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8o:A3k03kHRJC
TLSH
T1BF25AE13EB9500E9D10AC1749AE68A22FB757C56177093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/548-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000600000001b7ef-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0006000000016b4e-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/548-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b8-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5008-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-243.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-293.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a4c-468.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-590.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-689.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-738.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-915.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000600000001b7ef-5.dat	aspack_v212_v242
behavioral2/files/0x0006000000016b4e-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b8-40.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-243.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-293.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a4c-468.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-499.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-590.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-689.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-738.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-788.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-801.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-856.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-915.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-1052.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1132.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1151.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1185.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1331.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1344.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5008	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{94CDC4E8-B8E2-48A3-8B99-4B3DE5E797B8}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
548	2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5008	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b6b78f897825c951f83d7d4534a64680_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:548

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 945KB
SHA256 97f3dba161801cae09805fa900e0e9401da821d98833e746be82ea67421cae26
MD5 b6b78f897825c951f83d7d4534a64680
SHA1 3447dcb7f58a5d44db7c7af640b7794a3875363c
SHA512 1bd210f26e14761e17e41c7fea9d6720901e288b4c0ed5b0fe40333096f21e25fb72f5c1de3e54f994e514d1a3da8e3687895fec2034cfd8ad192011a2405ea1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8o:A3k03kHRJC
TLSH
T1BF25AE13EB9500E9D10AC1749AE68A22FB757C56177093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 d8f9b7c0c7860f78f798802aa56168e0d3efbdc76478caed42aeb48d1ca87ae4
MD5 9b8e6b645d8d7788ed42e37fb2c6bedb
SHA1 29a20a9c52fa4ca7832033afa1ad390de0b1e73c
SHA512 e26a2c62845cfc00951f2fbafe473269ed42319ce15446a16f7e0e11bdf91bf540b19932bb5d8d1bed882a75acc0279437ce9d6c0055a91e7f390ba64b5f3124
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8w0Le5ji0hmxNrM:A3k03kHRJCPji0Aj
TLSH
T19B658C17F6A402B5D067C1B8C9D6966AFA7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 960KB
SHA256 2493b4b842baedf69b4a4b8495ba0945c04b87b200fcf12c2daed7e00641988b
MD5 ce999ed3bbafce9d91a652df340d6393
SHA1 22961d521bf57470420d378ebe3be0a2038c8671
SHA512 a313341b4743697545a75c832b9ce72e4df9fe7beeb0013b798ecb49c807acf64002a303a811f5f86573dcc8194a3c2a3f4f66306f19c84cbac2cc3554a6af3c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8Ka:A3k03kHRJ
TLSH
T181259E13EB9500E9D10AC1749AE68A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 969KB
SHA256 34a5ef409bda84886a9c1965a86fddd6de0eea94801d4f99cff9d350eb34148c
MD5 8aa6de68d9a9c8d5c76e85b9fee6eadd
SHA1 e37bb825b841825ec4b161dcf5e61f9b3a4231a7
SHA512 fa415b85a907156e6f141b0987ed4c1565efdf4040a492a3aed1793b91d260d9ad61418b5f9a943e47a534fa6c6c43fbd4104fcef3f7c184a7efb7d4ad26ca7c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij876:A3k03kHRJs
TLSH
T16325AE13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 969KB
SHA256 36389c6d498d54d8bfbb2cff054d871b6255389b5eb015e71a241c83798f0ce4
MD5 3a84ff7be7cad0d7cbedf57649528fcd
SHA1 cbb92c9416f3a629b443b28473e11b2abfe2b33f
SHA512 c19879d339109a995e5aacee6fe4f8a0b8851c45f1eac3ec91245e421113b8267b491fab1f35e8379f0762fcff340ef0cf539945019240da3c0a17e490554742
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij81o:A3k03kHRJk
TLSH
T18125AE13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 969KB
SHA256 bc0b3a8cf92bf4e0548aed95eb51214268b7057d3e87cf00309f0ed9fe369d84
MD5 11bab893f3b96a7a716f37b46a0bb1cb
SHA1 3b4d4c392e69eb75963a6b124a46b7f4b729e481
SHA512 00fe7f9f4e33b0b5fd12e4b259d16b98a981c4d3333816ffc8aabefb29d7dc6af9c206caabbaad8594985afd4b7e7871d482ca7141b00903473be897a874533a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij81u:A3k03kHRJW
TLSH
T18725AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 969KB
SHA256 7777e1396359bf2b0fb6214bce46d59fc3e5a9688a5045942825a65a6e66e697
MD5 a1937d8952c8d53d7ed52253010c3f01
SHA1 6d81a9054741673dfa289abdc857bb1fa30eb4ff
SHA512 d48ed2aa19e4fd33c8ea13e7b031d330f3e8a63b1423dc2d2a8052c79813e8ea6248db9409b96454efaba545d2417a6c41e4c412c606341a7e637da2491d2d98
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8r9:A3k03kHRJ3
TLSH
T13125AE13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 969KB
SHA256 f737c825ca1816b8f22f0a5106020063ecae19e5860816efa64b46f317a61a7c
MD5 fefce2dbe5767fb873c797a1ccfe9d1a
SHA1 b4fd6e828a89a8913af42864b1f2929d12166400
SHA512 a229c1c561d7ba64fb8e23d9b17644d4c38cc24baa75cf9a85f6c57a40494ba5546b95552541a03e63d34b5e21ce70335b5b24d2ec2eb2692e6cf584a0d4e202
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij83c:A3k03kHRJG
TLSH
T12C25AE13EB9504E9D10AC1749AE68A22FB757C56177093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 969KB
SHA256 37f80117365c46c95def538ec574abf2fde7f1ff5fe9fbca9617d30fa78baf7d
MD5 b0a4857521c004a658574c9caa02c83d
SHA1 df1daf3b2313e3d4be5a0c92ee549edcd7348006
SHA512 f3a0cadfa680cf91364a597a71b6296b1f0fe58ef738d5150de3fb85bd54c81fcd8b31cd553e44ea8b2dbe15cd671f0c822792c571f5b929a2d1aabb0b0ba2c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8Ap:A3k03kHRJU
TLSH
T12925AE13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 969KB
SHA256 487603ce50aaa9d065609f45ab1701222df78d2ea9c6ac1abfecca1cba622032
MD5 71a6e1ee3b8f0c07ca1ccb99e4fa77c0
SHA1 eed7d3d592ccd79d40f2b450bae6cc412aac868b
SHA512 2dceece967824648ceb5cc32aaf328fa0b7f1c1bcda90a9a441ce3a594ce76926a8ee82e225ea02f1d4db90d8736ff397be67ab4babe631c2ea1ef0fdd5ba4e3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8HN:A3k03kHRJj
TLSH
T10C25AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 969KB
SHA256 688eb9ca21a5812bc92f82a31f2fb5bdc5c020e2ebd8c2dc1b8c455ff9f6ff8f
MD5 ecdba3bda18b50e71c798507a14bfe0e
SHA1 64c90347d505e43695293c23b58dd88a8172a425
SHA512 7174653199a5d6938ffbde09c27d82b2cdc1bbda74dd88546b75b41260f331f09e65c6be82eb21388fe13eac6e73964848568fc9ff75512258c07e5254141be3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8lF:A3k03kHRJ1
TLSH
T15C259E13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 969KB
SHA256 1fabfa6dabdea04d1c9ef93cda25f41ae25ade55181609ec8e0f1540ee94fbb9
MD5 7c3041c57ff8f4b9d35acc3629214155
SHA1 ebc45690b8f8809357eccc1a1f76b67532c7cb84
SHA512 fb1f4bad4825ff7ebcfb0773864904d3baa6f82342394829932c4900dfd0686f23a32da07c027acba77d6efad06ac849364180bea95cfb0b241bbfe0a6b053ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8GC:A3k03kHRJZ
TLSH
T17125AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 969KB
SHA256 5692be34f486acff65682fd0f36893f980b4c9d88ec027a6a3c53db409e8a48a
MD5 dd5cd0e275a73a1631fed426fbf55f22
SHA1 63a18217aa115c8091a05a1a57260b8891b18896
SHA512 0477eb5a142ed40569bd8874aca78b62fa5fffd246d2257c5722670afe5e46b77772a7467a35034c54c07bb5bcc7a1451eb48a0471b9d9f39c6791be2478071c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8Jw:A3k03kHRJE
TLSH
T10F259E13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 969KB
SHA256 2beff18e5dfd32de3bd2ce31a1ea2a3b020639439af3cb16c886e2744d413ee1
MD5 4f5aaf89fabd3d60809043d3a9c2adf9
SHA1 3ad2378ac2cc5b33f6f56bc95120bdc7560a3466
SHA512 8b657409e28e0b7478ec4967cc979ea4e74120c39464ca1ac29a132201516c20b3eb3e2b0d312487a312bc55e413e13f2be7a480372619001a1fb31194d12a06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8QT:A3k03kHRJs
TLSH
T10325AE13EB9500E9D10AC1749AE68A22FB757C56177093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 969KB
SHA256 be3193e467a5efe88bc3bdb4b20a848e6010d38ffd708a40a97d5ac11865f721
MD5 1e89c77a00438a458f906b43b67d25cb
SHA1 3fd319fbbdc55fc3808ee3b891d5fe9a84694840
SHA512 93ad25712da0e014f234d73b46de56ec197b35d1308232b9c5867b8a55e6ac951e0a37225807a3115edec8a81553782d3dfad4440d2cc3b7436b5e8fecf926ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij88u:A3k03kHRJL
TLSH
T16E259E13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 969KB
SHA256 39a3b7d9f15453c107588b517e0bc0bdd0cb78f66063d8da71d0c252fd94947f
MD5 cfff171d8f51da7690927dc03193a8ff
SHA1 f047c3eee8424ba70de4de365bea77c88867b201
SHA512 d34ffbb1b139eb68d468704a0297962f2a20ceca8b3f8ee82ca223ae19fff201c4baf5894777c9ebe09eb87a9a7a55da6ee312118e03d27b8e4e0633961bb67b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8ab:A3k03kHRJi
TLSH
T16925AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 969KB
SHA256 4b271860f8f9e7b9f7977b2ab3f6c1833f2df0c82c48ca07dc7c4fd83d7f40d8
MD5 bc43473d56b7aeb925a256045b207a3b
SHA1 362a92a666a4a9e2c1aefc814fb7e212bb360591
SHA512 b2a19609b20aa82557933ad06dbc0d8b4ddd98255e695794f6da2213154796ed750e67a93938f59dc55529a26649011b46eb796842020b9a7c11a59c3f1fc54a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8cf:A3k03kHRJC
TLSH
T1B425AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 969KB
SHA256 346d8136420011538125b943f79ad4faee97633cb39340a52fe85b97c87a9ee1
MD5 69b314de3a0ed9bec1b0c4ac28f26fb1
SHA1 5502b7f1b190ea1f424c727b798caa2857498d1e
SHA512 445a74d69e3f4b61c8fe40bb2ef0744412469764abebb40452acb78ecd8d1957bd9a657c985040c3499eeac37245968b6e4e8896956fca0a47545643859edbee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij85K:A3k03kHRJi
TLSH
T13C25AE13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 969KB
SHA256 e98f8c1d20ec7ceaa8de10c4b4facdeeecb2a37397e8fcd7fcf5895ab3fe9b65
MD5 0044f70fe4ea78af27f0fe000842acd1
SHA1 f843a4b45bbc4c79c5dba18cca565fc973633837
SHA512 f2522cf46ac0eb0390c9fcb08e67a1939c8313efec9794a4b0d9e21a1bb32b8757eb4dad53f4572ff8faa90a077e2e21092a1e3e0a9fded27ee7c8507888cfcb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8ik:A3k03kHRJ3
TLSH
T1F125AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 969KB
SHA256 229920b0b744bcbe82109b4efc6c289b935f995f7a4b32e924d0d288ef8b4cbf
MD5 983a03bcaf3bc88a21ea0a4234923ed3
SHA1 33291080a161ea876aa11473f54caf5dade46e69
SHA512 77cb124becf3914c2b88c42aa78651dc479a315b085b51223154dfef6abc5ca3afe64ec519e83fee955158b2b7acc6acaa8bf231d1db55cbe78051748fad1926
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij830:A3k03kHRJW
TLSH
T11B25AE13EB9500E9D10AC1749AE68A22FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 969KB
SHA256 be2b3f77a1356ca43f0c3db45f3116d5d8df86eeaa1f192d1498fe84717e03cb
MD5 30711b036f3025c0fba028eb1fccc3cc
SHA1 929ad483666a8db464ede23ed762332b0c2aecd2
SHA512 16c0749052e496795705c20cc5ec7f219dca4ca2c270880243defd3137b804c77d11fd288b8c8dcfa2e5e2f58fd41228906a9b5669a5ac67bc14d3a3dc5c858b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8mg:A3k03kHRJv
TLSH
T1D7259E13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 969KB
SHA256 8e895fd626911619c7f81e21c95b6d0d868893226c5b01ac708f915832c87f30
MD5 6372c0bcc2aa4616b1b3293ac5c8ca80
SHA1 b4dbc6f55d54b7f56879425123d9e7e62e1ee0e4
SHA512 8a2475fef8f83ee8b0e2f9bfff325fde876a5b44db59b741e214b25c863473103a5c755f52407609f3120662e0a05245ac94598378e044e02cabc0325914d1ee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8vr:A3k03kHRJJ
TLSH
T1F325AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 969KB
SHA256 e56613e5ca56c5685d731ef48357ba878dbffac67c0f8cf3457c9703fdd77db0
MD5 e1c799100d773dc8357fdd0d668ae6da
SHA1 e9592f1a7066850a101f106b8446b1f1633e703a
SHA512 b35b0e7e2aa447cce6e5f036fc68359bb4b1f365f9e9533d49034e155169a7923c4a3c4a1a183aa87253513f724c103ec2aff496700d8821c3a2142e1f1febee
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij85n:A3k03kHRJj
TLSH
T10D259E13EB9500E9D10AC1749AE68A22FB757C56177093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 969KB
SHA256 bae53b5abea09a2199b695907accf27744bea335b63bc14c75fd186c2172dacd
MD5 531848e969678cad7bec48203a11cdab
SHA1 e102e187c6b2dfca7c4ed601972bc1c4fe8e1eaa
SHA512 a5f8d0a24f5360d43a8232af3a3f0c19662a695738a9ce09a5337ef1f3ed563b65bf14d73f71013944d30ecef195895062ba3737093512c159205efa6b39f99f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8Vx:A3k03kHRJB
TLSH
T1DD25AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 969KB
SHA256 8cb8b185172a0e8e48bc34d4d7ca9dac7b181fcdff968a82a7061671377ccce1
MD5 09ce24b05c76b8681ad6f21352866b6b
SHA1 c0bda063adfb0e279f12eed36466f732121a9584
SHA512 1c32d315b8bad1a71acb37250bba156ff4c519e1fbe2e63da3667087237e948765fccd3603f17bb89573d3a7d4ac006d1ace9459329b3ee7ff7d6919f506e1df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8LA:A3k03kHRJu
TLSH
T13225AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 969KB
SHA256 170e9b2d5ac7f487d961722891b49cc6059bf3bd99e62382c67ccafbc3d88e5d
MD5 37f960b564f114a732a257eeb82285b8
SHA1 03a768c1c616e41d387996952d49086d749a6b97
SHA512 2b567829fb3ba93e7c7a600397f3991067af58712869af5779682a42f74bdbca396749087dffd4912228443961055c736e8912f2d6062929aedb7a611e034fa5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8c9Q:A3k03kHRJz
TLSH
T16B25AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 969KB
SHA256 67a396ac934b1b88ecce15132e416284e2b35da5ccee19bc2cdcdbdbe606c3a9
MD5 b8ce36d51f56a0643fe6448e1017e698
SHA1 8354e7c489e5ce6699fc7396da9f0ca27fef451b
SHA512 530ba0ada3477b158dcd45ea61bccc90dcd984e9d138587f0a9bdbef187d12de33121a23ba5cc428e5e0244a466dad32b148ec587f36115ac43a40ebd682c739
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8F4:A3k03kHRJ0
TLSH
T13925AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 969KB
SHA256 49c3ccdbd129d2649ad06eebe4497c07e9613b99169768ba42dde8000c9a3e22
MD5 777db609c7e4db22c1b253fc182005bf
SHA1 8079b2c85bbacb9a443049f4c5bfb5980ca60579
SHA512 ec6244f553c18af23cd6abb2de2324a17f76cc9405f5f18996c01e34bbabc867f8f9e5dce299dcc9950e7e2f1f4436253d4ea8f820e1a538d5b1bc0732d13912
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8Qu:A3k03kHRJl
TLSH
T18025AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 969KB
SHA256 1915b30cd549014e9d0356fe054e0e69746d7b62c7b7fc8a598eee6cfb1ebc70
MD5 ce2ca68ccc130398d4b33d578d25be2d
SHA1 4a9194cf3119efe5370f468786267c10b53705b8
SHA512 0d71fbd5be69302f8adccb7957cf4e5b3c2e22e70a456b31862764b8350fb7695eb22a786453f80a0efc3a0203dc17c5d3d4125bc033d88a888eb819a1df6bf0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8Rj:A3k03kHRJn
TLSH
T1BE25AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 969KB
SHA256 ac78af4f1229bfcf24954974e15c359783d69f597d8a69d9e175065523e4a89b
MD5 29d91b7989d4f6396d037e5f2761ae3d
SHA1 520b2a2ec2eebc5f7fb3d1a21600820204528c91
SHA512 02f81e9a115fb30751839bfd8bac02cdbe21049b1dd217cb4b4707a895dfe6ae44207f8a755131c3e61c8f885a4cfb6ac3fefdaceb632baa9cdd5160e959b073
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij84g:A3k03kHRJP
TLSH
T1F725AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 969KB
SHA256 1149beabe0503a92b53b560eba4c62cb8eb2fccf98159e54349d77bb72576cc0
MD5 e491b5b5bdfd320353ba49f60b900c45
SHA1 f3b6c0dae5cefc3324caddedcec06fd946b9f3ab
SHA512 a12da2a99083787c58c2e1ba22265ee2b7440017eb427691d1ac21a576d2a916715b9050c8d9e4ab57f0a870c54fa90c8a1807d1ed879ab95adb2f2b2e95b419
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8XI:A3k03kHRJe
TLSH
T172259E13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 969KB
SHA256 076a17e06ac391dac5f09bec4ee35ac96ab119d27565a72fe621f697f3461007
MD5 4ff6deee22bad6d12ded37503f7ef3f7
SHA1 895fe5fb2f3f9ded5c6063987d924733c92f7e9f
SHA512 5556a8cdd40409b30e1e9841134583a18120e9de6733e2d1d8bfa05246129a6163b81d732578c501a207a37f4102be438e535a2d51a5c18fe955e6d07a4beb8d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8do:A3k03kHRJc
TLSH
T1A3259E13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 969KB
SHA256 0d1b480c13ee933b85c403c4a1e5cd6dc8fdcfd1690bf9e790b1b4a40c7888e0
MD5 eecfa51a13f6933324f8b49c775611e5
SHA1 957113cf14e7b62d10e1a128be6edb95f245c5e9
SHA512 eebde159e95163924efa10f64b20b14b1b13364d0b249d97448638395e7a7f33d6b49625326473d144d410d399899b0f9a6408a392c4af758d8034356d7ab9d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8O+:A3k03kHRJR
TLSH
T17625AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 969KB
SHA256 2d77758a2ecfb9abac3d264d00372001133d5f49f9970bec1807011439f16920
MD5 4f2b641aa38a9bd9176b0b2b0fd62336
SHA1 0d80e228e5c88dd0e490abbecccd73c2f2ab6b19
SHA512 1ece6e20ec9ef3d0ae19b6b2cddbecb29b24a9b33c7914dd54de1b940078e500e6707bc9b0639b09e0c64485c71fa23f3eec58821f5bdf5bad3ce40e41ef67af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8OQ:A3k03kHRJR
TLSH
T16B25AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 969KB
SHA256 3294c7a9886755a50c8ed577abca9e5d638ebeaf2058fe426e3fd892a55c9893
MD5 ac745c4d87bfbcf885cdb41d41fa0da1
SHA1 f4e3a0a3c458f74a9ad00dfa5a7ca1dc22e29913
SHA512 96629a593ac33202660e63b0d47738ded123aba2001455b5c5087a8be1a5505a199d4ca340c730079df40db426a148d3cc5092d0dd33a1ab69f043703b1dc16e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8vX:A3k03kHRJd
TLSH
T14225AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 969KB
SHA256 943713cb706cb0c2bb8134eed01088a58a3ee29de0bac7a6d4a5902e2def2cb0
MD5 62e224e40684c1db9b31cda81faee4a0
SHA1 4c9e9b016cbd021e0913c9ff045d1ab046cd61a0
SHA512 23ee33328d31bbb48cf9eb7ebc74783d57f8b8fffd7f7e6afc032214af70774db1ad9089bfe15ef8b03ed1c8ecac0a1c31362a24f7bbcef53338e7c0bbf246d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8lL:A3k03kHRJf
TLSH
T19E25AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 969KB
SHA256 c39b3ef892828ad82e508621ba3ca387c49c7467924080dee109a2d499e66eab
MD5 44835098f2f070b724901074e14c440d
SHA1 d95ec3982612a67aedcab845a8142895513916b5
SHA512 0e9e51035f6563ec1d8f82cd3caafbd4be19cf6a188120a6458359b1f911042c4ec866da95de421ae83f807d7defd78ca5be71d0f1db747f1aa0712401b01cf2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8DM:A3k03kHRJq
TLSH
T1BB25AE13EB9500E9D10AC1749AE68A22FB757C56177093DF2358C2152F62BD0BF3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 969KB
SHA256 12c485270dcfb5a427b3beaf393bb8ca5702917767250a25d07e3edc2de8090d
MD5 2796808b245451d1084baba5d9231bd8
SHA1 058581515646bfb5b76f9df7cac76d4873a0c39d
SHA512 2ff2244fc696e53745eb67a762b6115c81b73439fa67ad22d374eb84c5afce0b0e928dcab31cb9e4bdec6a3d2f1adefc9eaafb97faad5c238f82ac2ec4cde7ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI5ij8Eh:A3k03kHRJk
TLSH
T16E25AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/548-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/548-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5008-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads