edecffbe7b34f976664524bd010a1d225f7f83a4999ea1f2d711854b24d5b84e

Analysis

max time kernel
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 20:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 924KB
Sample260709-zds91aav2y
SHA256 edecffbe7b34f976664524bd010a1d225f7f83a4999ea1f2d711854b24d5b84e
MD5 2ae3dc07cbc9f6e4fb5c400324cdf258
SHA1 628f49664dbcf766b65ff07da2ba0888bbbedbba
SHA512 d37c7931fb09e135d60f5db6d513a0777cbd68aef0c0e01d24f072fdbb677cb6628a0fbd7b6062a4ab2bbc3f2f9928faaaf86d43c3d154b952e1ae0a4485a5df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr9:A3k03kHRJp
TLSH
T11B15AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/6000-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c481-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b311-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6000-27-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b316-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2316-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c95-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188d3-204.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00050000000188d1-211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019853-242.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-249.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-280.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-300.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-483.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-715.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-746.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-808.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-863.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-942.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-961.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1016.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1053.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1090.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1158.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1191.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1332.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c481-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b311-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b316-40.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c95-60.dat	aspack_v212_v242
behavioral2/files/0x00040000000188d3-204.dat	aspack_v212_v242
behavioral2/files/0x00050000000188d1-211.dat	aspack_v212_v242
behavioral2/files/0x0004000000019853-242.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-249.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-280.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-300.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-483.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-508.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-599.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-636.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-715.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-746.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-795.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-808.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-863.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-942.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-961.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1016.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1053.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1090.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1158.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1191.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1229.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1332.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1351.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1376.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1383.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1390.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2316	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe

Drops file in Windows directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6000	2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2316	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_2ae3dc07cbc9f6e4fb5c400324cdf258_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6000

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 edecffbe7b34f976664524bd010a1d225f7f83a4999ea1f2d711854b24d5b84e
MD5 2ae3dc07cbc9f6e4fb5c400324cdf258
SHA1 628f49664dbcf766b65ff07da2ba0888bbbedbba
SHA512 d37c7931fb09e135d60f5db6d513a0777cbd68aef0c0e01d24f072fdbb677cb6628a0fbd7b6062a4ab2bbc3f2f9928faaaf86d43c3d154b952e1ae0a4485a5df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr9:A3k03kHRJp
TLSH
T11B15AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 7e053b8fee10db3a039256ad764b408a4322d9c79f1a46e0a1ed2df3b6485ac6
MD5 3d8ff9077d6abfd2b25c6805bad9ec43
SHA1 5bea2ab8919a038c722824e255f729c57d3c9fa5
SHA512 07f0925fedd33488d23acd8fab1008b18c9d86ce7dad9ede034f7c8666a9a3d3d4a2cc76d276a5b1fc9d51f207d868e22505f4e79c28443928ad398b84190238
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprJ0Le5ji0hmxNrM:A3k03kHRJVPji0Aj
TLSH
T185657C17F6A402B5D067C0B9C5E69A5AFA713842173086CF1399C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 938KB
SHA256 4de939400ac8cbc605b50c9de1e85a882c71d98027c1d2345f6fbaa2e98b8006
MD5 11efa0df337f1b44da1e010af1656e88
SHA1 b18f72377df1b57ca0bfc414eae29bfc2accfc3a
SHA512 a10ab4c941f17ad62a71198a37f5fc0b643c5d92b1a7bd1250f65e8022665a531ef24ce7a3aabf2729cd303742cfe34d5de8c61e2118e02ad542796742bdc15e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprba:A3k03kHRJ
TLSH
T1EC15AE03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 971KB
SHA256 27f96163b26f780d50d8a54ef13cd7833cae436d9e78c9105e8efba30cd414b4
MD5 c8ebf35d1461da85a10b07a10efc513e
SHA1 5c23642cfaf524787a966c9b544dc162ea0c1950
SHA512 c63d85d95459b6cc4b72eb3c8063bb94e8b3a044e4b1db1ef5e375f64950da9dee71817aed6ea92220d198a5b643911d8c94a10253db422ca352085529c3f7e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr4b:A3k03kHRJ0b
TLSH
T128259E03E79400E9E10AC1749AE69A23FB75BC52176093DF2358D6152F63BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 947KB
SHA256 563c78b28791e5983ef4eebdc5490765ded392ea98dbd68a5d4f1f493214fc51
MD5 ecae97bb712c444b590195963a4eaaee
SHA1 750e65e8584f9c0972f9d5895315bf95883117bb
SHA512 46468df828aa0a97699ace051807c4846189777b9fba196adbccfa2ecc4ea80a927ec3f300299d0f99e927f9135a664ac489c01a8fa295aa405c91807719f219
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprjZ:A3k03kHRJ5
TLSH
T1FD25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 947KB
SHA256 6174df171c0244f8fe5abb90f0e6cfc5a3c400c76b4cacdf7071bf78716e3ee3
MD5 949112d0ac4ef8d1ae490c333b096e13
SHA1 658e2b0631828accb9d1cb72f52a7d87bbe0d20e
SHA512 d91b53a25516be57d1cc536fac1cea8534526c29ada5e731be4ee7248e55cc78fbb813f30ec205e6e7eabda80e9696d45156e1e7fd749d5da075b7f71e4c8f26
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprY1:A3k03kHRJG
TLSH
T10C25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 947KB
SHA256 cd302296d2944e68a049cc0156a48fe49e9a89e079c287a4e5c847a969816e56
MD5 d7bd2d2b6c2359d77c9512d947953b18
SHA1 1ebadc140583800500dfbb832052797d65cdbacf
SHA512 7560343490016d030ad6414e2dce0c3c44e0642264dd76305612d5bef7dff6445445078ec8ab2c786cdfc32cedd0c687c1415958e8e4204da6f5dc31e41d28b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprCo:A3k03kHRJN
TLSH
T13B25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 947KB
SHA256 635953762cc4e7139259306753926130d9c5368cecc959a3f299ddc8024493bb
MD5 c9dfc54466c99599707383bf92e0eaf8
SHA1 67c06054fae95658af3713598a73f854166f71d3
SHA512 6974331a6d03b539163c8709a0050fb26e206a99d0b64671eb1810fbc1acc19905bc09534f1ba49c4306027e71c8f360412c0209fc0470070e61b56d348ead17
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr2u:A3k03kHRJ/
TLSH
T1D625AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 947KB
SHA256 9ea085ef8f53be3b8bcb4618edbe30222740da646249642f38ad0cbbc6f7c22f
MD5 42d88f0be45bb2edd84d62abb4e1e849
SHA1 82e51643485cc5498ec708f3cb8513babb7491f9
SHA512 7a811404991e69f5deb041ce98a3f7b78dcc952de399f01f2e5433c8e9c09fe7b9ee089406a4eb9f68e9963891116419ff9cad8531afc62cb25077d8615394b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprq9:A3k03kHRJ+
TLSH
T1C125AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 947KB
SHA256 d1c635a964b42118a8704c53a2a9adc19494a7fb18bd48463216fe2ed885eaa3
MD5 102ceadc4897b39cd644d229b8e2be57
SHA1 a9855c2d3567e1d7bc7f99d0fd9877ba22746af0
SHA512 b7f429ed61dc5cbba33c49dd34e711978f74ea0d9678a3e088219a8d8d5e4b740eb17a02fcc94bf0b7ce99f27528bec9544915f1e5e3e64074b2496f21061614
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprqc:A3k03kHRJT
TLSH
T14925AE03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 947KB
SHA256 a57d92e1929458dd883b698b2ea27811af515779bb725f793548468e0090aa00
MD5 a1e71afcd363a2191b98664627f2a22b
SHA1 daad9ba552a93aeb3ec7c1be5d0cd3fc624f18fd
SHA512 bb05ba6c01e9cca57000d19f95eca01923ca803a005866c6d5a2106aecf57e4435276ce4c581b5210bb1f2dc52cf17593c585cea3b21ca06bc72e524b6934009
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprjp:A3k03kHRJx
TLSH
T16025AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 947KB
SHA256 5ce178631fb9ec5e5bf1d2de0ac0f3b0a0f2c4614b4275a035c90cd8504c5f32
MD5 843e1bf317542ffea4d66ac1450cbb62
SHA1 3a40a718ab6da33297ee8cff6a14a1de1e006d22
SHA512 99afe0ffc03e54391dacbc90aa985fbe59a22bbac24eaa306fa65fece7b12a03fb10b64eb24a452587ac2401649467b56619ce06634176f10e1138b4ad9c1c08
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprEN:A3k03kHRJq
TLSH
T1F325AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 947KB
SHA256 19bdf0403c59e7d2c8de9ea0d6aa997f4aa8ae6c994f6ed7ae53036886370150
MD5 a82362c68a1d815f760fccc51af56229
SHA1 44f67070cff2163003e5db9177913a97edaf39b7
SHA512 03abeded76aa0fd2ade2361ac8a1182b2bb7fe201429f42910b54c7594e7b8881dab0e5a7d0040832774d2dbc6673857844e84d0fc62d7bb8a412b500b92aed1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprsF:A3k03kHRJw
TLSH
T14825AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 947KB
SHA256 0a6f38100e036918bceba94c77bc35994382cfb85a74bb9fc4a18ab8b9e4f59b
MD5 4ed8761e508a2982de26a8d5efbe9198
SHA1 f6fed367aa30b218b430fad4e841fdeaa15f6476
SHA512 dd52d3d78a9d5b6ac883704abffc8c0837f7b76f46f766e9e7520efd4328d5290883c1b2281145e255474c2d85ccb7dd4f726a95ee5e354f24f338aef9c1bd8c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprZC:A3k03kHRJE
TLSH
T11125AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 947KB
SHA256 4e2f6325e616f7ca6f3c47bc5c35e2a7d295326a5dbe9ca12506ac2a739901d3
MD5 f3c0e30f9d329f4b3829a9dde8ff7880
SHA1 33b862984a81762f62f8ec14e8a2f28d1b5991a2
SHA512 beb3b8bbdd7165859cf6786785bab46793be0a0777d8a5b4ea5759cc56a9aaa8578c13bbea2893d93208e261c57b402b0faafee1de44f384c05a7e58db330b2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapraw:A3k03kHRJZ
TLSH
T11625AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 947KB
SHA256 a1a4d8b3cd3d18b7c633f8a9459564c72719a5c26f6e317456016b2a2860b5dd
MD5 de98d64256f502a7512aae823c19ea16
SHA1 2712ca63b39875d14af378b35118af21fcf0fe99
SHA512 19879f7cb784900b3ede880c9699e9319f91197b78050bf3c8f15848eaa302579caf745854c5126625ee962424b9e863f09e00e7f8d569d9d5968b80b9eb8132
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprhT:A3k03kHRJN
TLSH
T12225AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 947KB
SHA256 32910e514b512ee368af3c2dcd1af3e66e5fa7a91839c81e37400a49bbabc119
MD5 93123468211fae05a6bbe052a244371a
SHA1 a7e69bd6953b3d6c2ca9551d99484f090323e844
SHA512 0e9216dffaa9d60b1d0cc0269e1734e87d1f545d84a2951fc148e414a73ddabf1e00ef43f70b5c32f750097f36c6c09797113930e62eae7c25d4b748dedac730
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprPu:A3k03kHRJS
TLSH
T1B725AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 947KB
SHA256 0b6923bfdb6214872318ed4b2dc6b4ef0499071cb3f68029e8954cc5689e0705
MD5 91a22be4c73cec000261fb1a44c11b71
SHA1 b43313c877849b023b07ffcc6d6164d8e06d3c0c
SHA512 3e799943fce144585101ff5a189b17a6b72c3c85107ee3bd72d0ee0cff11706dab98967b0d26190ca71209d7fc4da6e9f67e84aa9ca03498b2e839e6b2a51dab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprzb:A3k03kHRJD
TLSH
T16125AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 947KB
SHA256 666d57d76ddd332dac8ea75853d839b2dfe6f6fd208309e523dcb310c2030920
MD5 506f89744e73fc1dc3989e33071e1099
SHA1 1a15d313ad97e25795b40b1b41a2d65a5e50a1c4
SHA512 0a57ef21c6254920ab12d7940d6fe0cbe65ec3314394621a3758f192262b210971ec0e863cc0cf022134c5adf1745a3befed1fe4496554fae7348356bb61e22f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprHf:A3k03kHRJ7
TLSH
T17325AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 947KB
SHA256 f9640258cdcf4ba20a0381a62e38688b288cd18916517461bfcc9a3d6f7cac53
MD5 9914a5d78731a0c0cab119a4efec0ba6
SHA1 dc0c4f99f0499d810b74dfb3462a0339949c29a5
SHA512 8c5d4c2694e8c8b2379728bab2561fa8279b93989b63e20090be2c1c92bcb9b8186ecf537321bc4baef1b8d274359171bc6ef03cb4e3ea77a448dfd1a38ff325
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprwK:A3k03kHRJr
TLSH
T1F925AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 947KB
SHA256 9011b47e6079ee0c0afd9d78957dd4c91619cc1cdbc7bce87745754079fd55ff
MD5 766ba4b7f3d544432330ef234c5de26e
SHA1 2075a7207c1ae06c363e2cced84ffe38f187b901
SHA512 9677437360e3bf27c417e410b16cec9648bb195be6cdc28243838f3a4ae0c9a151be6e9b4bcdf15a9b708d6f84561b4cb8a1b06552abfdbc9b93d3596b595543
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprtk:A3k03kHRJm
TLSH
T15725AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 947KB
SHA256 d4e06f12ee88cbcb3f4e81fbab2928f66151dcccfdc9f7dd3eda0ecd752616fa
MD5 ac80de7f3061857cb87c38521ceefd1d
SHA1 2168f33686fc01199594864228ccef224641cfcc
SHA512 f364067e5c83ab521c4aa0b342946997b4778d530e47b0921e7734d2c6c5a98f9350fe028980abb52bc85e86600f5391806f3d36f4b104034c12c6b799a960c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapry0:A3k03kHRJb
TLSH
T1D525AE03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 947KB
SHA256 6d21cc3cb91c72a7bb371f8e0c41abeeecd0922b22d8c1c85d3e0fa4eeee1fa3
MD5 153a09b67c8fa5dd421e3c40813b24d2
SHA1 0708912942f5bd963b3e6daeb9af03b2b6b2beb4
SHA512 203fc47c56b89bfdb5cf9c086b9054a3f3bbd1169a0061c1d83ca4e7bd39ef4899c0b3a96c02845ccc5742dbabfdec53a2e7b68e4c26f24f3c7676c99113fd4b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprBg:A3k03kHRJu
TLSH
T16A25AE03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 947KB
SHA256 ffb3c2d2ef762efc3e304bacb3e7bca8887add0792ab095deb591828325add2e
MD5 97bf1824ba2c7fbd4a921d170027b4ad
SHA1 418b6668c754f47a896e62c094bbcc3a80a389f6
SHA512 69d7f6c5f1fb587b6a27af7701eed5594604d454e40440840c9a1b6e31469b469bfd61f855e571e25840a77ee7f50fb6313d80d7557e0e68f9ef808dc0b9efd5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapror:A3k03kHRJw
TLSH
T16725AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 947KB
SHA256 634eeca39338ca21204040bfc7effdd7f64e50d3f24baa5f17341602bddbd36c
MD5 c02369ed05d1d3bd10801650a6458e57
SHA1 1c38178a4e0c545c3d82c8cbf4ed915e70f775bd
SHA512 3aa2db7af7b6539a9984aca4fc0e89eec6c1e8a1556baa87b19cb56896914d7eb354ac8eda90cf8dcf0e03f558b4f39b96a15b93977c820e5fc176375ba76e50
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprGn:A3k03kHRJi
TLSH
T14425AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 947KB
SHA256 0b3e42ef32d6a21a04ba18d670cc34221634bf8fcce2adeb5037eede91fbbf38
MD5 692d8e0cfb35a71fd411b0489b03ab36
SHA1 681e4c61e6e8a9305f502d23f266af39fa3e6003
SHA512 483078f2de88fb01a83abeadc508d9bce22b0a072a3d05006ebe02b29aab3a24ab322573d21380ce6e91fd952e06d08b6c711be8dddb47c175bca6acea112f07
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprMx:A3k03kHRJQ
TLSH
T1DC25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 947KB
SHA256 b16d531ab4b9cacfa06ae07f7c14b05ce8e0ea23390ea91b9b356dbe0c037178
MD5 b1c67c7ce39a347899d3056ac06a3977
SHA1 2f0e0b956088cc4c642cf664c5b7dc21d1fec012
SHA512 ab9042c239edeca5e51c7c91de3a82c7a926e4973663e548ad9072b43c4fcb1a016811d4d29b1511796cd64a93a2844a51d067fd5bbe4783e08d1f85061356ec
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprGA:A3k03kHRJz
TLSH
T1DA25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 947KB
SHA256 218bb607a98f22752a9d73bf59e20bf93bf5b20190bd846840bd8f26ac42f5a4
MD5 30852d11754870823b9904b7bc1eed13
SHA1 967443306ac5e1578070bbe70976a072302c7acf
SHA512 cf9c8294604995ff49934182534f3807746858ce066ad16515ac0795e4dc6ea517fe4b82dd6f71d04e5d1228f2eac02433dcbad70450013b08324fb62a0e5ea4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprf9Q:A3k03kHRJe
TLSH
T1EB25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 947KB
SHA256 aabe4418e06710ba37829e01929eeb5464a73dcccc0a0b3e3c8e740fa5093ff3
MD5 62c0d4ac82e01235138230151f46bdbc
SHA1 8162d7e6d53ee1d85c5ad6afea7f2f886726ab38
SHA512 6b2626d4e1b0fd04a69b00396e9eb6f594ce25a0b99b0a8128ec85a97cb9dd8d1ee57d003b2d2a70ef62b6738a391e06a8438f2146b12ba8ed4588436599fba6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprW4:A3k03kHRJd
TLSH
T14B25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 947KB
SHA256 cd852eb6e8b657529cfd92b3b4afaacd96091c68ef4cfec70236c84321968a10
MD5 d7841cc2173af1919b7633c11051c7ce
SHA1 0255933c28a53ef0567f98bacd7158468f020715
SHA512 7c3a280283df13e9508ebd9de193bbf0ad524feb1a6040e22979f5fb1e3000cf6290c814cf47b91f88a9abf6158a541bad3ff90ca4a285a65e780db8c39d32e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprFu:A3k03kHRJ4
TLSH
T1DA25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 947KB
SHA256 ca1dab60f8863ed78ba2820719e4dd5df78a3246dfb67f2e61def4bde394a0f7
MD5 1e4de0f32c9653117935da99ced7318d
SHA1 82dc72491d18f74b924b463fa2f23964a0ee9d00
SHA512 2fe7801efe1fedf4ffafef63b3a552954d079661ce6e75608fb228282daa2dd41ebdb0df9d82eebb9362cfd05ddaa5de22fa6d14c519e96d077424ff6567d3ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprYj:A3k03kHRJS
TLSH
T16725AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 947KB
SHA256 d107a44b72d195c4318e60bc10e3e5a1b3effb513bb1bfc6c657e9765035b837
MD5 67d961f227c07b615211a343a2de16ee
SHA1 5b1a867934e3097d2c02e2a7dfc9a75c82f9783b
SHA512 4dd890dd6269c5b71196693efc7d893e00c20ea3501255a35b7688aab39a6b1a057054224d20044dd0ca27f8218414f6752cefa3940d3bb560725fc0c134088b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprpg:A3k03kHRJW
TLSH
T1FA25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 947KB
SHA256 ea33a7086aeb4f04754b7d2f96baf0e95cdd50fd9b485f4b72af05dcf9734d77
MD5 a0a7c1a323d8cb33adfc26fcb2054d8e
SHA1 69d80445f877023f12ce4707327603bff3acb364
SHA512 09ba5e90958bc0909f65688fd2959340d50d0b20a5cccb228ba3d823b44e810e8ad31a169cabb7566b5ea61fb8a200d11a965ec3cafb2cd29badad27dd41951a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprwI:A3k03kHRJ/
TLSH
T17B25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 947KB
SHA256 943ec50da1db6642b8865f442fdd07b67763e278fe0ce5c0b4d13e8baec7f205
MD5 b537550766fc5540477c52c715440748
SHA1 1e6ce502b5c6814851e04ecd17777445e74a8519
SHA512 b0ed0d356146209d5a8a5bab078682049319c399bf30cfe8ed873abb7dd80285cef1ae3a55cd84e32e815e439141127ec8b8d2aaff0e47fafc2de70e915674eb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapryo:A3k03kHRJp
TLSH
T14925AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 947KB
SHA256 204a642aeaad7a063d1b4fd25db0b78c40eb8277c66593a5531a57ee235eaf67
MD5 0df183fe8f362dc9810b96222def2656
SHA1 ec38f0d79ad97bfa5d74c5dd9500b7273912deb5
SHA512 76b04811612aa56e0e13d34426ef524cc7740ba188d7e635c0fb5fe010ccbba8f90b2d0f86a897515cc83c633813dbd66ca0c1c9473423907046da3c654f6f21
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprp+:A3k03kHRJM
TLSH
T11225AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 947KB
SHA256 8c10f8e1906c62f6598c00ec8794b19ec6457b157b6de3a8a9d2c16bf0ef453e
MD5 fd7bf56e75632ae4c88e4233721b43f6
SHA1 adc836eb2fdf67c19d52ce1751a9c6c2749d9190
SHA512 0cd81da4f3e19c96fba1c02a676316315e9326218cacf7b8cec9e48d809b9c25d8909216d8e014dff02ce3d7bb72c4f777af2c2616885f9575f7932b32bf47bc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprXQ:A3k03kHRJk
TLSH
T17B25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 947KB
SHA256 5d1faed62822a9a04822681172fbc973b20628541c848cf88776643e43db58f1
MD5 bb81578149cdc50bb983a02ca4d18626
SHA1 d80c83bc0af6535420c018041d8f9447ea0c24df
SHA512 724013e683f5a69ee2c3552ab417cf81bdfd918e1be4fe0ed0e2cf1931ec22fc7b9ecc6ba719c3e8076fecba82075a64b6971ebbbe48de974f3fe70be74eeff7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprsX:A3k03kHRJE
TLSH
T18525AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 947KB
SHA256 c047f5bde168ab98082cf82151af4d4ad15662b52f493f9c542b0f8076c39dc2
MD5 4df74c985d6c72e3f433b68c61b92226
SHA1 d89d9c4bbbe40680e6068878c92353c18ed46b4a
SHA512 ac2b243a3bdfd31ad310d67a003f55eff07c59bef85376bc9a6f10c0f9b5c0b854a60dfbc676efe7db2d7d25853281e508723f2a2cb189f5ce43707004c29d41
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprKL:A3k03kHRJe
TLSH
T12425AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 947KB
SHA256 7ecb60459a4dfa73728e9e17c68c90be516a23627359f0847e72e9acfa71508a
MD5 0372d59d3bca255b258d8c2c0efb7b5b
SHA1 2abb6d9b0648a515bb8f5e11d9c419c45348565c
SHA512 3fea7df12c596bc8396daa208711d26e5154937b439a10e59e7c4a50c2bde2b1384fbde1dc82a1ce2de2ce3efa1d7bfc73fe7a57459bd9188a863afd303e6b7d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapruM:A3k03kHRJr
TLSH
T18825AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 947KB
SHA256 b714339e532f4395d135c2c81b5aa114e3ff2ad7b78f3f8894a7e2434357f562
MD5 b7742a982302099ab9a0936691da6c9c
SHA1 7a6e2afc34bc7318268a4b8e0768147dce4ca057
SHA512 1f259dc4a61705cc6bda626579cb91abae6e7594c6347470535148d381305a171a17ae2bafcfe75b9856103d59b3e9aaa304131a7e2f3a45e4687601df741afc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWapr3h:A3k03kHRJl
TLSH
T13425AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2316-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6000-27-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6000-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads