dcb29d2fd1ed37a4597d44ab7f3d9bc3df3e65de92db0a33b12ae3b405c88081

Analysis

max time kernel
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 901KB
Sample260702-sdnk7adx3l
SHA256 dcb29d2fd1ed37a4597d44ab7f3d9bc3df3e65de92db0a33b12ae3b405c88081
MD5 6270af31122dbddc64ed768d6e1467d4
SHA1 f1c10dec5527b2ccb76af56d96612f3dd77dd3b2
SHA512 b4e820f08b4eef61081d85e6b5eec86ddf3f5354ecbc368ea8d9b1a1ea965e30efd3cbb8dfbb39b7f1fb36599f7a09865f33d6fc68dda8203eae8aa2bde4be1f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3a:A3k03kHRJ
TLSH
T1FF15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/5700-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c593-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2b4-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5700-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5060-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d1-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c92-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000189f8-204.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a04-211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a68-230.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019855-250.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-265.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a65-266.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-285.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-466.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-509.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-631.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-662.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-774.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-811.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-879.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-943.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-962.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1018.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1056.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1093.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1161.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1193.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1230.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1352.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1406.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1407.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1408.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c593-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2b4-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d1-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c92-60.dat	aspack_v212_v242
behavioral2/files/0x00040000000189f8-204.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a04-211.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a68-230.dat	aspack_v212_v242
behavioral2/files/0x0004000000019855-250.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-257.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-265.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a65-266.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-285.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-466.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-509.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-588.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-631.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-662.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-742.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-774.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-811.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-879.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-943.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-962.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1018.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1056.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1093.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1136.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1161.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1186.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1193.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1230.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1333.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1352.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1385.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1406.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1407.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1408.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5060	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5700	2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5060	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_6270af31122dbddc64ed768d6e1467d4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5700

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 901KB
SHA256 dcb29d2fd1ed37a4597d44ab7f3d9bc3df3e65de92db0a33b12ae3b405c88081
MD5 6270af31122dbddc64ed768d6e1467d4
SHA1 f1c10dec5527b2ccb76af56d96612f3dd77dd3b2
SHA512 b4e820f08b4eef61081d85e6b5eec86ddf3f5354ecbc368ea8d9b1a1ea965e30efd3cbb8dfbb39b7f1fb36599f7a09865f33d6fc68dda8203eae8aa2bde4be1f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3a:A3k03kHRJ
TLSH
T1FF15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 95270fddad1056b70fb63e266370ff4fa02659006f7e5ef429241958c3dae8ad
MD5 5647fa2262a843ae16639de89d04b812
SHA1 1956697b978cc919841847b18b235fed3992f62f
SHA512 8d03c90c3d271a062763f2056df911c868c77696ea1b730e1cca531aa471462032f84577a45d42c627e5693b77a7e5e52c78b11c05efe96828286680b9fe0eb8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aP0Le5ji0hmxNrM:A3k03kHRJLPji0Aj
TLSH
T10E658C17F6A402B5D027C0B9C5D6966AFA7138821B3086CF1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 915KB
SHA256 df506f3dcb10030375b8edacfb65974e8c6289b8579b02e6f17a871699e7db19
MD5 cd37bc53d4445ed4506fb08feefc2d6b
SHA1 0291ed853aa3b4fb41e26d8052ad42bc305765f4
SHA512 5450e25986defb97b8553a699a10725558fcc470d1283dc6577d81adddd49424fd8f9149e0b0678e91ab86c43c9715b802826bbba88850523a29d9d0ec8dfdc1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aRa:A3k03kHRJ
TLSH
T1EE15AE13EB9500E9D10AC1749ADA8A23EB757C56176093DF2358C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 948KB
SHA256 38e504bfd1604ed03e24371ece5ec172071284a6bd31f45d0927b20eefccae4a
MD5 ae3f6db19a02cf64443852496f0f025a
SHA1 ca2c19f409a9d72c6069043af932b0dbf3a64188
SHA512 586aa86c59f242cc0ab89ff6ac83880c028a5e0e66fec81298fce1419cf45a378d5d64aa479bfe703e797648e392cdcb61a00f2abb8af0a512fa0b53538a5934
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3ayb:A3k03kHRJub
TLSH
T17125AE13EB9400E9D10AC1749AE58623FB75BD56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 924KB
SHA256 dd629eb5ad6d1bdfac497d6e5b383c6b6929ee26e7c75c4afbae0075bcdbb651
MD5 f905396dd72c7a4c9e2c12ece06ecba6
SHA1 912d9e88322e68e1c34690fc5aba9710be955e90
SHA512 6f2ef0ca23873cc0dc18bfbb4dd6cede251de8753d6567ce1138009c7b494203de22e8bbb3c4ea16b085caf11666f4c5808dcb00d523b7497c649974f47c55e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3apZ:A3k03kHRJv
TLSH
T17715AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 924KB
SHA256 e93bbd0fb0648f131107c2d707b477a662965ffd4dc7681995606f3c01ff7118
MD5 92adf7a42cec8866af586c6be73fa637
SHA1 6b92fb0d477a82ccfde2b6585fe3a16ca8df8ddb
SHA512 0ce8bce41dad47e835a92d9fa08a3ee5f766de029e769a58d993fe33f20ac94060148030eeb27bb95c1e0ed6bf743673580f4be11eeeedba8fa76c8d4e8b555e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aC1:A3k03kHRJo
TLSH
T1AB15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 924KB
SHA256 5ab2657541b9199b6343987e5efe50b7639a40909cf5a6faed237d5f7bfb9fad
MD5 29080d280ca1ec17101f6b6ccbaa78cb
SHA1 7051a5118fb08fae277dea6b1a2760182ee9c2ea
SHA512 78559b3bdb29fb41c137c35af294a766ae5d962dc0b1793c46e4f99149e5d2578897ee970ccdc1b606ffee409676b77fd10f7504275c9b5c810e6a2505ed4227
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3ao6:A3k03kHRJT
TLSH
T1D415AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 924KB
SHA256 59c5d2c51ec35b43d4d95ea8d00c5ebe5e3b90423f57cdaf8d7af287c28f364a
MD5 90c7f4c083e5809834fe32d921e5bfc0
SHA1 858248936ae68e34f8a2ffc9a0594ef1cf31dac4
SHA512 863eeaa3cc3937a169345966949e764039f23a318f080fcb1e70a49dcc4fcd33771be55204d80779f7354c6e070f78a409dd202507562525b906136e67c60b91
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3asN:A3k03kHRJO
TLSH
T18215AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 924KB
SHA256 1a260f22c7fa70e542bbbe3b1a4b404d1389c24a87637a00d1b9214a5af9c8a9
MD5 fa5d6dc5d4cdc36ad5324d3b0e45df34
SHA1 d26ecc393cc5a5f5512681338e04ca4c847b4150
SHA512 ec0aa71a6b8330c7e1112c0c8c6d478217b249614013365fc6c437e57b77ced2f5ca548005143a34ce1fac3e32c50435232a925c27195273e556264aa5356596
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aif:A3k03kHRJC
TLSH
T17815AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 924KB
SHA256 1bec191decb04e9b488e3ad4d5929aad3ba4f03c0d29cc3854560af1aa02054e
MD5 e0e8e3133a41353cf51ec5714ce27352
SHA1 7fe9e77e8e4b1a1477c72c48f00f6773dbed6309
SHA512 30bdf08663395c721403cde6df0d1a0e6c995b3cf398e7ce998707f896245808fe12c9071aef978f233846b05640ceb908594decb39eab40a9d95bf509053ec5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3a8o:A3k03kHRJL
TLSH
T10015AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 924KB
SHA256 33e153fb680cdb50bf12efa1a652ecf51cbd4e250d44e90d7a9b1dc9071d56eb
MD5 db6c0d12488c7c7ca6bf30038b0fb40c
SHA1 6cb532f9cba2c8b4939d002dbf019dc485c0efe2
SHA512 04795458f3c6f773997bf5fea04e01863512c8df173a364bffb2f293e65c9d017821969ac6645093e836507f6fa0575be521748de4c1f28e58bb50b49671571b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3acu:A3k03kHRJt
TLSH
T1FB15AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 924KB
SHA256 77163d7b847cde2ba200c7f21277629d1f456ebaf825d2aec3a2f6ee4163dd84
MD5 91bd65d513837f1f4ab45d18601a64fd
SHA1 eb0f02d83803d9bfa1248f496c22634739cf110b
SHA512 19cd96ead4632b2325966ff002a0d38abe00b017202f277d21d43554ceb36e07e88708cb3328fd3f02742a3e3f6467885e1e60075167357de58589966939d1d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3ag9:A3k03kHRJY
TLSH
T13215AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 924KB
SHA256 751bef2c8a0fab986c42bdd329d8a6c54acc59842594d6f7a3d9ffe8e539aa3b
MD5 bd8d69bcbea4d06925e8b34fd004ed55
SHA1 249b4b91b8b7ad6b392542725eb997eff3125e0d
SHA512 f6a985e74b73241ae5e4eadaaee02889a5d34682e4517f13d98641243463511e8258c467e650ba94287cfeccf810a8b55fcce87effef6b7f1f336eba155bcd44
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aoc:A3k03kHRJZ
TLSH
T16015AE13EB9504E9D10AC1749ADA8A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 924KB
SHA256 16cde9e4b19e8a23bdb8c9e6bfabbb5689d674dd5131d90fe9012eb0f874d27f
MD5 c06cbc5419520e7b31a582df5583acaf
SHA1 2a2fac19bf2da9a190cdc0cfc9ebbf91f16c3fd6
SHA512 31c641e45ba20e416e1f9c88ed16afc751cfc78ebf940e76ee9eb3baa929cfcd42cd839b5b7be0e2797eac028d711cbec911c7062061af27073e41781192249d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aBp:A3k03kHRJX
TLSH
T1CB15AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 924KB
SHA256 091191c457a2314ba8a39f46eca7001e172ba1f70b812cafb1b6d95628b3492b
MD5 adbff61a239903faa6a591d78c56b4f7
SHA1 a82d9528086fa9724b4ffc703cc54ccc5af909f2
SHA512 bfae7e01f8d4b320af183d2f8268333fd6b46352bad7225d00edfdd6ad1b71657a7dd575a65f83a47da23b61f06dcb4ff5c63025a58bba7db814ac10634cf75b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aWN:A3k03kHRJ8
TLSH
T12C15AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 924KB
SHA256 0c1a7103573fac5e9e0354ae1f2dfd77bb2bfe994a32db37f4bc612e5087669b
MD5 26307aedb68166539c3706fddb4546cb
SHA1 cb63559f080dadf06debb405cf8dc053bf63d6b5
SHA512 995abbf06b774b2a1c41afd1495267a888b709f3f38f380a635dbed6448e3148eb05e14fd38b9f2fbbc621d84e717b1413129d068eeb77765758734087951d96
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aaF:A3k03kHRJK
TLSH
T16015AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 924KB
SHA256 ca11a60bbab099a1c1166e68dc7c6510a2603d903c4e188d464c471f85304c17
MD5 2b0c8afaa9df20696328615b860efb03
SHA1 df78300f7a8dcef59426b77f6f64a889f07d677a
SHA512 76767447402289076926295c50604d7e003371c8b51acae7eb800eb7c5d9cc64b58e4ca8715f77a713ab5625595e6cbf9cff5f161de7db23ee44f120181f9011
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3avC:A3k03kHRJe
TLSH
T1E115AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 924KB
SHA256 a28ac669458c1ffe0999ae9368ab69b525bcd2ef666219f9ea8247d25432506b
MD5 ff553ee568e1d9ee02e7060888c9ffaf
SHA1 3d90b382770c77c5811b00528ca079b65e96e16c
SHA512 b59d0ce5d0eef5abfdb6f0d70e966445aaf9fcae43a24c31cca99c3905d098bd16e7682fbd04bc87d1694b8e429f37cffa8d853a2d5574aafd55dabf48104655
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aQw:A3k03kHRJr
TLSH
T12015AE13EB9504E9D10AC1749ADA8A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 924KB
SHA256 d42627cc5fdd8d2d314b05958a766f4610c0eaa9c8000e0d0c9a574c1a136641
MD5 dd36bb785e4ceb822952b327e2b7a49d
SHA1 2a2f3775d8417ffcca88ab72c682f7108ae8b344
SHA512 88a8a0081d385659dc4fa42772d092adfab4fa682b98dd447aa53e37078524b875fca37c76c070e2c24119c7d4664f18e7e9a8c174d0927c48562425c1304810
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3avT:A3k03kHRJX
TLSH
T1C415AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 924KB
SHA256 7c2f6d7f2579113e4a4a1a363c544d863b8626c3b516cec860ecf37711762264
MD5 3da1ad83aaae4e4eb83bbd9c3d7b6190
SHA1 3a62e7f0af275a360e1aeeb6d35fcccc1ecb413f
SHA512 7f53715dc3943e629a43855db1e7519929e409e69687c34415b471e7db7b328fc3d25a9ece74541ccac389e6a089de913bf06e5b710b0353aee4793b7db7bdac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3apu:A3k03kHRJY
TLSH
T18015AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 924KB
SHA256 36ed8b9c144ddedc1dbda159dd617fb4ee2bdb4dd1284af95033d3d425837232
MD5 a516979bf3ecdebe10c67f51457b0af9
SHA1 119b290ae94e8ae0d044daad4831417990d44160
SHA512 c86f32a6df26d2e7dc51f89687a8ff0a0d84298646dfeaacdd6dcc8e9a3e6c3068481d38ae8ddda48a54b970a4aa29238c87ca23258d8736b6d49bc55ce85d55
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3ahb:A3k03kHRJB
TLSH
T14A15AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 924KB
SHA256 864f1a4047b1b239f5dc8fcff7931ebd544d71cdd2a89f8c9e6e703c1d41997b
MD5 7750790b21d0dafb2d8a054a7f316902
SHA1 3c07d1954d74ca34eadce2323a9592e720098d50
SHA512 2ea6a50966481ef8739f00a5073c149e369e3a862715399b7844fc498f6c255afe113cacd6dbe6ca63feddc567783f6763f82ded8dd1bfd87a9dd057163852c0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3apf:A3k03kHRJB
TLSH
T10F15AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 924KB
SHA256 917ec9d8fe94a66876914c76d964c4cbdbe5ba868aa9376ab8458a2496beee5d
MD5 3574d901894e69e7ff87eddb330ca2c9
SHA1 597bb462d51ef86ffdeba3e731e921094f905af2
SHA512 0c60d3061882805ac7fada0fe2a4a9c9a5904a7e9a424484651c0dc676e1cf1f59cee7d376929484bf07e12f4fa42b8c1240046fcf5c783dd254084d60ff2a4d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aSK:A3k03kHRJZ
TLSH
T1A015AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 924KB
SHA256 8f85e691e9a2599b299e03457c2a6985c0cb580aa50f67950a4aadd864c13393
MD5 1d67caec97161547dad89ca49dc74028
SHA1 0699282ce93cef07ecfea83d0be67b0cc075b55a
SHA512 403f8c9589eada040b4fea1d0cf1b55935e92df5bf34e7e5918a9cef6c38f9e7851172d894027d63ea371daf5867b5e8f0269c1aea9bb32750111a8ac2dfda8f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3a3k:A3k03kHRJQ
TLSH
T11115AE13EB9504E9D10AC1749ADA8A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 924KB
SHA256 a24a9ab3b3de55cdde628583a612c7cd1293b1b5b34731a1790d970f473041ff
MD5 82d01471e8f8d01c2e31df754fc9da5b
SHA1 bfd89c904037d2f3c3e943ba538a795a127b6fa8
SHA512 6bb87a3b22222df99e77360740361a9cfcdc18e225e154631850ea6dc56d708eb35aefca908b8e268b030fa28f4f21edd7a505955e4eb2c57436b89fe3567b5f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aA0:A3k03kHRJ5
TLSH
T19315AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 924KB
SHA256 9cda1754bcbbe0c1d060a54d00d70e845bb6349f70ac8ddf656af8b011ffb192
MD5 9616cabbee383c74857f3c4d950847ad
SHA1 f5183d658cf2b1362ca0d89d567e15b0303e0049
SHA512 774640335373edf56344c0e12d1e771cc04059d63db14f56c1120e1534d4eb9e60262a562c82fb56df7349f6dcd0e789cf7f175364f3f7340066736b47918e30
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3abg:A3k03kHRJo
TLSH
T1B115AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 924KB
SHA256 375442003f8498fe86f140b27bf2d9b45849c20cd03280288d28babb78e86163
MD5 d7d1971c8b7486947a71b4ddb2480b1c
SHA1 6c1b1ad9d6d22b682a68f2677e5d6cd93fb82c82
SHA512 cec24e32d31268331b10a6e3595f4af9bcfb065ad2a9f3b6e9ea8267a577396524a81871eaa36a64d28ee1cab79883bb7cf0bd3c478610e17f57824dc24bdf03
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aWr:A3k03kHRJS
TLSH
T1A915AE13EB9504E9D10AC1749ADA8A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 924KB
SHA256 3113352a14fe8693d7b399d21c424b2cc5d8049421a32b470562765c1ed8df51
MD5 8baed967eea45135513a544265532383
SHA1 f60dc12ebae618a5cd9b209d9479367ff20475db
SHA512 80a9aee05f6676f55d62fa4f8fc5e9e1cab34f324d399675ec13c54f1d4b52640470f052274fd1db5a7ba5dbbe70fa36588bd1506cd03ce76cfdaae180dec546
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3a8n:A3k03kHRJE
TLSH
T1C615AE13EB9504E9D10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 924KB
SHA256 73c3c98695b916201b56590e999eb1c6356fa641ae98924b4e714390484cb33b
MD5 9656770376ff637958977119ca2c0228
SHA1 ba50d87211b3492d63cfa8d6044bbae603ccc22f
SHA512 5bff1dcdc9c9c9ec0c32c41ba41e5b8adbb10f7e660bfcd3a587ceeee86201b8d3a21d2baab9417a6568dfdfd286e468b44649d64015e62536b6705b2efe20ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3a6x:A3k03kHRJi
TLSH
T19D15AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 924KB
SHA256 42c36b10eaa89732254b61ca9d3616091cee6e2f36cbfe67cc7cf7972c5b9558
MD5 1ca79ce0078bc3f54ef380d3f026697b
SHA1 f4afb564042bf91a82158cb97b67583d879f895b
SHA512 324083df3c94aa56bd549e189bb41fc5c59a70541f2a16d0599cddd2d6ea6bbabf8f9d888f2db2557c0dd6fc1f09f31486d54ebfea420d50dc429547d21c2895
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3a8A:A3k03kHRJB
TLSH
T17D15AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 924KB
SHA256 93af32e4c4db069a04b8f66e56af2892f247ec9cfe100b99dc183813386835b9
MD5 7f293ff4c97e8ca490701a8a72c0241c
SHA1 fe5a1b48fd2ce6d736df238838b1bbe4b517a76f
SHA512 b50b62f09d790ae12b7d2d6e9fb2f5f3509851c55dcaf5699525d1eb5503a8cbadc156a04270d4580e943fec49bea96b02b48ad5862cc196c47e7286a6e84fe8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3al9Q:A3k03kHRJ4
TLSH
T10615AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 924KB
SHA256 88c908e5882916cedbc726632b3e21ea74b83911c1ba7c417b567db2410b50f6
MD5 0d2592dc7796d4c71599e10112ea606c
SHA1 f9eaa2d770d44fd5fa490f1e881d0745ec1f0956
SHA512 3776a2c1002b6ad6b2893a94d28de5c3dae70881ee875706eada15f95da9e92f00cceedd78fd745b3de0c0f75cac9d70f6785aa4fab550f494fd004182c710f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aQ4:A3k03kHRJD
TLSH
T1F515AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 924KB
SHA256 5ddda9c1055228024376ef2547fd7ddd2ecafd3b298fbb076362fd6e8823980c
MD5 d476f9fd863e03257e9491a83317d2a0
SHA1 e15c4ab0aa96fd4df93bf31868fde9e007c2dd28
SHA512 f4e33b03e85d463c0c20a63f303f334d7af660a23248540f2798cc89d55ea9b3cc304748655ae959d2e1827db6a3bc2a8b3c013f2f637cbfc739f2560ba4448a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aTu:A3k03kHRJm
TLSH
T13315AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 924KB
SHA256 d91cc02c8e642b2d5f77c86fe02798f3178af09c7dff8cd4c110ff6dfc9325ca
MD5 49564606cf155a1f5d81fe2094e500ab
SHA1 46b2883db6fe236ced3755c2a6c1a1378b270a22
SHA512 0fc7b8d5630c1c091ce3c03c20e786ef5ef1ffa645192186f20b64c2a071a6b44f5fdae5a4f913567e38b5896bd19cc5a1b975e2641ef31aefedbc832dfaecf3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aOj:A3k03kHRJY
TLSH
T15115AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 924KB
SHA256 28efa96c63683817f9f8a46c8cb58b923fa6238a4f7dedf93f6ea828528bac4f
MD5 4b9ecc41b4faaa8fb68db5e86b9494f6
SHA1 7ccbd7edc3669b263fb9c98d986d5dd133fdefa7
SHA512 d0df3f017acd13aca4354db874e63dfb2d05b7e060cbf95a5e303a376db929d6fa435b9e910ddce2a1d454746433095e899a3a5aba925d8e373acf249d0b0452
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3a7g:A3k03kHRJg
TLSH
T13815AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 924KB
SHA256 cf457a23cc5e5c56ab1c7e87c11bd831bdaa830a3d2eb0173b4b38c68dec1542
MD5 304d8be46b89fe1f2b3c87f6fa027e28
SHA1 53db9784298f8a0480cd5a595008156ac9d5ae89
SHA512 39a1373f3287f84bddbb65a90345fa0d41394803de223b04bb828210386d09b48b5e56ebdbc8174b4d9b970f0ea0635e84dd572e53b0c439984f69cfef56afd0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3amI:A3k03kHRJh
TLSH
T19A15AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 924KB
SHA256 fc8a9c02f20ca3c01a1c1598cdc963efd132d13e9672ad7c5868caf482ed4f42
MD5 6fc53e45cf3b31241e639ceac721c546
SHA1 97d87fc0ef3743dcdd7bda0be96c906645c22d7c
SHA512 12e171a9e375cbfbfb97730b850558de5273b91d40f50a56ab70c11030e52dd7af0d9b8788208256d539968ed78457d10de3ea096bc35aa0485f508836d0b0cf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aUo:A3k03kHRJ/
TLSH
T14615AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 924KB
SHA256 8fb1e96ee1ed13d12886da534756277a33805401ccb542764a3c191b0fbbcd87
MD5 ddd3ce9f14efaff11f459f3be33dac36
SHA1 4330d9f85b97a9e50362d2aafce23853009f934f
SHA512 6ab813ecfb8c4fbfa802b7d52df0f2515bd411394eb100245b971e1e53d4fe04b7826783f14ff8392c789baf76508a167f8c292aa3079d4f50522b606ee6d5c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3a3+:A3k03kHRJK
TLSH
T1F815AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 924KB
SHA256 76f662b5cf4b9cddefe8e50798f0a4d50003c0eb371547020456ad7403bb1d0f
MD5 fd64f5e81055b6e379aad600999883a7
SHA1 00023e80062fa14a5f8a7cf0a9690242747d89fc
SHA512 447215055a0c6373c3afac2e7e0d35fc756e475ca9fadd48820232779a9f3981ba4713d9722e0372587a2e82d57df37307fa7115beffa440e95e437dc576db4c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aNQ:A3k03kHRJO
TLSH
T15915AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 924KB
SHA256 c75d214cde1429f83fa38875e8e860ae11c104264f55a352debfe68e573fbb03
MD5 526d2ce2558ac630ccfb87353ab4bbb6
SHA1 17447ac401472869e3e1d67a54898f7b702d088c
SHA512 6c55c84239b30efab05ba48c49cb37ea98cfa81debdfc22ca57fa7e68bc66ab088e153ac02335ff3ee91117223639ec432361d337afb8342af4e7252ea435fca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aCX:A3k03kHRJO
TLSH
T11C15AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 924KB
SHA256 fa8e51de2c7ff1b667383b760594c89eb21ecb8b84ce2bb8c8387e2981b9e4eb
MD5 fe2eb49aced708c40a3b3a2bd6875c1e
SHA1 8d8014aad5f661289475510af1205d8bf6edcfcd
SHA512 0859980ee0ac62369c6ab8a8e24ba950df1771a094106bea52e84b0f2c70066980bd436051b5e19affb7fed6519adce3c714dfb5e79fddd5d1252a912b1be6cf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3akL:A3k03kHRJg
TLSH
T16915AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 924KB
SHA256 b0d6efe9671ab9cbce9981d1d6b8929efd81372e3c2adc6d9e71b39154522849
MD5 31c5782004240913839e3e2dd2b4c8ca
SHA1 811e50fd8f8f3e477865e3153566400167773fb8
SHA512 270df1809d63b38bd2f2600f85a2f1f876177a352774aa25e675f0e15b6e33a5d86354057b44a72abb6f533089a63f3c5215f0a663e4a857e75c68c8c2f3a72d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3aAM:A3k03kHRJx
TLSH
T12B15AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 924KB
SHA256 bb668f1cd5dfe39a6adbe724404086021848695f7922b22d4e4ca5e2086669fd
MD5 b6ad6d13993c5f0839c2e8d565319ac4
SHA1 61ccb04cd024df7d1288f57f84a68b09eacd7f49
SHA512 df39afaea4990b5fd695f02dd08b9435e474ced308d157eaf85ce00e72edc3d40e3245292595b86c5886b1671bb316e39000710855056901d5158c1bb1b1d8c5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqE3ahh:A3k03kHRJD
TLSH
T14815AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5060-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5700-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5700-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads