6db8755591e363ccada21154c4ab5adfa9b025341051908cb006878bae77e51f

Analysis

max time kernel
105s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 912KB
Sample260710-v4wetsf16v
SHA256 6db8755591e363ccada21154c4ab5adfa9b025341051908cb006878bae77e51f
MD5 9e9fe822af64b6a747c82a1e2fd13eb9
SHA1 414d900d532a51f0f647559e981807a6ae824884
SHA512 4234db0928eebe5907a5343168466d51988193fbbea09ed2197944c9abc70c90e09de672e13c3dccfba6ef713af24cc9020ecf93d5a1fe4821d4293039333b0d
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+:A3kMB56r
TLSH
T167157C07A6940FE5D11F817499924A62EB737C125F6087CF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/3224-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c5d3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3224-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4224-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5d6-32.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb6-58.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-260.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-490.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-575.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-681.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-730.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-779.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-798.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1181.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c5d3-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c5d6-32.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb6-58.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-223.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-260.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-441.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-490.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-575.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-620.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-681.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-730.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-779.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-798.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-853.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-872.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-885.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-893.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-913.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-932.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-951.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1006.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1049.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1080.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1129.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1148.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1173.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1181.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1219.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1328.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4224	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3224	2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4224	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_9e9fe822af64b6a747c82a1e2fd13eb9_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3224

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 912KB
SHA256 6db8755591e363ccada21154c4ab5adfa9b025341051908cb006878bae77e51f
MD5 9e9fe822af64b6a747c82a1e2fd13eb9
SHA1 414d900d532a51f0f647559e981807a6ae824884
SHA512 4234db0928eebe5907a5343168466d51988193fbbea09ed2197944c9abc70c90e09de672e13c3dccfba6ef713af24cc9020ecf93d5a1fe4821d4293039333b0d
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+:A3kMB56r
TLSH
T167157C07A6940FE5D11F817499924A62EB737C125F6087CF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 945ab0aec49fef870e5f5990a907a3242430efab24e5b3ea63c8c94251912655
MD5 5c9cb1c3468d4c9309487de77950926c
SHA1 0227e8ddd25e0ff4f491bcedfa3a3157c736c36f
SHA512 bf75a4cbc67346a9d1a570141490f561add4c5aa804672b6fbe05c3b4fe3cf11ff8fbfbe3ac77650aa51256d3a3674c03be4017d4823a8816a8b2e269bb43308
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+P0Le5ji0hmxNrM:A3kMB56rdPji0Aj
TLSH
T130655A16F6A44BA5D02BC174C9D2569AEA733C425F308BCB13549F283F237D19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 926KB
SHA256 04a71d13a21544ac0809e0ffc8a456bdc45c8ba413d20fc0a0393c9ade2fb55c
MD5 f1237ab56b58b82628f86ce5b7d6639a
SHA1 d747ba16771ecc5fd34f8311f01a5346e4c9546e
SHA512 bbbec84fdb2dbd5686325a25e7c83faff79c0dfe0103a2e14ccec1438b0a821736749760b24d9960e08c085e9d6b39f29235c286f6d6298f5346f888ac0d2f8b
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+Ra:A3kMB56r
TLSH
T142157C03A6940FE5D11F817499A24666EB737C125F6087CF1364AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 960KB
SHA256 df11b0c4ae6780fd1559ddf58f9cbb910e42220bc4fa7b4b4f0c588bebb82aa6
MD5 ac6ffc8c977c109a0d29a05b96e3c8d6
SHA1 24c99d0a9f41883ca6f2c38c406438aa45160bba
SHA512 4255ecf814e6231e26c6978a2567d1e497e6036a32c9a55ea3362b6979d7047985fef121175f0c4200acc2850f36d3d388b60614cabba51955e26f856cfce964
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+yb:A3kMB56rcb
TLSH
T1BD257C03A6940FE5E11F817499A14662EB77BC125F2087DF1364AE253F327C0AE3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 935KB
SHA256 82ebf00aa553a3a7e541f5a609f73a5f4fdb26afa75eda3f7aaa37ea64c24f8a
MD5 bef367ed3a9f3c8a09c42e74bc6c594c
SHA1 047188762735096ae4f375328f58c6d595624542
SHA512 a0a10c336f05c99ac52be4a35419ab04915fd69ef0fd964acc51db5823825eecb60810aa0e5801014c96bed0ccf40c8bcb06a2c25105eb8ef8a60c0a88ec7cb9
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+o6:A3kMB56r5
TLSH
T1EA157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 935KB
SHA256 6a20b16aa6ddcbd359d56de1164a45732a20143dc211b330760baed8ffb02a27
MD5 8933db13ba45b38a6c84fd6977936426
SHA1 e85e0d298f564c520ef22d543300d29e020ae18f
SHA512 6944c0cd6cbc86997fc500bf6dda0637df4a8d9074b73977fd1d75fac687ea64b4606408629bc8790c62c9bf8aab7126c21816f7998112cbddacd65b5b36249e
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+sN:A3kMB56rg
TLSH
T1E8157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 935KB
SHA256 a39755a502ef874a88092b8053b10b3552df61551ada5c9a4643fcde5f438850
MD5 806ebb1f1dbb832dfb83b9e6b6459464
SHA1 f3929918e25f337908ffe8b5281280e3b150cadb
SHA512 76ec80938055aea18226ec3faaad4bf2f8749a40c39f8dee3faa0cbd424915ce5aa9052a66f4f94c6b6b7003233e763f9a133bc09576890465197e68457e70f0
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+if:A3kMB56r4
TLSH
T1C2157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 935KB
SHA256 23c3fe612b525e52576eb60b4e2850bf3154538fc567f21ea1faa9b90acadee6
MD5 981ae0b1e3e3d91391fce4a6d51b04a6
SHA1 94cdf6f08330ead480ed36344daa6c4dc69c2744
SHA512 8827031ae286cf64a9beaac933a78e3e431d435c367196704f2af143c3f68fc12c8ad47d614d91e259113e97993132b55007252c247eb5b240237cecbc053965
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+8o:A3kMB56rl
TLSH
T19D157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 935KB
SHA256 41794f643f1b92505d4822db5c5d1bf141c7e71949e4615e9bcb25a358080d92
MD5 7fde13b2106b1994880c85db94ce0dab
SHA1 3713babe65d87bf048e450683b4c5706da6cfa24
SHA512 fdf114b0804b022e59da68f2dcfc8f814c44aa3b764385310093bf000f0eb39be2b1852a0ba30d1e69bcf9a1a80120a31e20e9c4143baa5cba77242bca3c7533
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+cu:A3kMB56rH
TLSH
T1B8157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 935KB
SHA256 263add992e2aff9b231c270c998a8fec7116a2a8baf1e5af46428018c1f482f7
MD5 aab9d414d77dde9f3840bf017b5c40e0
SHA1 8700a5a25e6bfec85f4d3c713607f11f30a38a68
SHA512 1c18652c3fe9ceb810e138c7a5376f0e5cfbb40ea997e0baba8a218dd69b6dc68439ca0fcbeba5647a5628c228a9c24dba340582aaeff7d5d4e18be9de41331b
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+g9:A3kMB56rG
TLSH
T171157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 935KB
SHA256 e565c654b712ceb5cc556767cb56b4066350a6b4cd51bc7676cfc8052fe74012
MD5 17f949f93066fbaf6fd67a0925804726
SHA1 eb6fbd3cd3664d9cb590b41205fa1c8abd58ffe5
SHA512 e6aa541b08e938be493e77eb02ce80dd47bb71a0f41a24fa97ff67fd978359e1edb28f5f92293fe7f58152da076dfdf53c0905dc2b06d0a5e25d9cbab4b97ca2
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+oc:A3kMB56rr
TLSH
T10B157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 935KB
SHA256 029dfa8b039d7d5b5907c7375401fc9a6caa5a91b88779bb9a140ecbf626f68a
MD5 e6bd2121191a19c0df0418543f35cbe5
SHA1 679809fba131dca72f0049ad53706c96df8db6db
SHA512 309c4850667dbcebcad10f7107a4bde0641dcad8b9604e0bfbf63db5de949f94ac581089f3d5e8d5e3f44bd476ef8cafe4de91a9d5c969df8aaff9e3a4e9eacc
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+Bp:A3kMB56rJ
TLSH
T1A2157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 935KB
SHA256 3d26273177ac67ef78c4ae328ab38d544d7bdc694b5b1d156cdcedddc8cb1c2d
MD5 a7336cae58c142bca7221164601d5c38
SHA1 619425c7589e272431fb1c461a96284f312679c1
SHA512 1f486513ca433516fb1dfa72ef46f5b99d45a171584bf4a88faa674de1fd92aba60d7479025f092842a07d5a1e8bcc59fe89dfe30898681a06a36025cb0d778d
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+WN:A3kMB56rS
TLSH
T187157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 935KB
SHA256 358ac14bb8925de64dbf89fe0219b7203d08bd848e429c255b6ecaaf22d8bf14
MD5 9694a00cfd41aecf7ed610362c355257
SHA1 838662595c87fce80a0fb5ec08eceae84318502f
SHA512 b7f8f6b8504465071d4ebb64e261e89a98c161840e1c003f7cc6e2863d69e1961fb342b3a7f35a4b1e807498cb2adae5da0f992aebc1cb4ef8a691dbf809c396
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+aF:A3kMB56r4
TLSH
T1B3157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 935KB
SHA256 aca1c72c651ff0eb352e5d15a73679cb976a4ad883f28bd5595709ce84403fdc
MD5 c20178970faf6b646bc53105e7b97700
SHA1 8eaf028b0aed630dcf994bf2aeba3601e399f0f8
SHA512 e82f418408dc793337f733e76001b872e65a98d5bc420159fcfaae3ce4bc38c3f53fcbbeafa53d3b3ef50c67152a5a81269f7c6cd0cffa2ccad7f7b7d2ec5fa5
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+vC:A3kMB56rM
TLSH
T189157C03A6940FE5D11F817499924662EB777C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 935KB
SHA256 34574355d577be715d202235cd0abdac35618f645b30e718d270e64baadd335c
MD5 5de527be956d96bc6f995ddbf482db3e
SHA1 28543190b435f44f4254a24e5329c7b356f393f6
SHA512 b1d3db55db9ee0ff9e2f417adfcc120b769e9ff5c6cbe8be269cc8d9d9daed6c735df6d1a2708e54a2ffae25ccd866175a180c1bfcef2c76169d831e63eca875
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+Qw:A3kMB56rB
TLSH
T13E157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 935KB
SHA256 5aa754bfd17e4e0c009a2c1b3179e2366762a7889d7a6a3b6a16326a4115ec8b
MD5 7eae8e44a7b548e784c356f107fe2d10
SHA1 5dbb2c5d529281a054785ab9187912945aba539e
SHA512 f37dd4e7ba251496798568d328aabaafb6ea194617b13b9da40501ed569c99800a7f3a19d6fecbd398f6027d017b4138def35d362761ad0ae9951234d4b0d104
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+vT:A3kMB56r1
TLSH
T109157C03A6940FE5D11F817499924662EB777C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 935KB
SHA256 40d576efdfaa85f23701dbda18b657d40540855f1fd97269b83586c2f353614b
MD5 7507f6cf71ebd2797d479ff79b4672eb
SHA1 65b1125dc48985104dddd2252b2056e114f2d5b5
SHA512 1e5cb706d47810fd7f1dd55bed360069ab8f6e5940b43843e3d02c3d2e8bac83a6f6482f4769b6fd007b583b893420ac134e774141ea246ab9af236bc692589f
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+pu:A3kMB56rq
TLSH
T157157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 935KB
SHA256 40222221873e872bd85137e2ef8d4b0e4a947394205d80dea79c89746813325c
MD5 1f57b32a8fe021c2e1ae7c502e617e93
SHA1 2eafa197a6fe64f95ee4a10eecb56788ce7e77a4
SHA512 f81b9edb63b1c8d6c8e6cb990dde21b8c7289cb61af53572ff8ed6d4d3bc4d2519959192db0492b47e56d5978f59664cb0e588838891c7bb84fbd079f935d12f
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+hb:A3kMB56rL
TLSH
T132157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 935KB
SHA256 4fb29e9aa51b3bcab203f67a03793e68556bc14557544b2eb6d608923bb5a8e5
MD5 1ade4e787d30c9527e8b98d25c0d3569
SHA1 d58d29cfe6cb80eae81215465a7cec968b3c9d3c
SHA512 879d412587c896d6f50d75af592e0378b9ffff4f0149497d0a39b13986a7c36cd3b436ab241848ab407b9e2d9017255f1afd544b84163b998dff75e2138eb3cf
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+pf:A3kMB56rT
TLSH
T1EB157C03A6940FE5D11F817499914A66EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 935KB
SHA256 647a8d5da975d12bba5242e923c0d42d80d5174609cc5310c533d9d869972299
MD5 6ebd93c58229fe2592919a97e220f6e4
SHA1 f375c71aa7b0f59904701abe0fed765213a74edd
SHA512 a7b13242240411354fb4ab40db3a04f9af8b11de75263f1d007a63729cd3d23b2bda04c8abb2e3ff7caf0c9d613c37f390dc49df0ae0f3c6d69021cfaa0d4384
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+SK:A3kMB56rD
TLSH
T140157C03A6940FE5D11F817499914A66EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 935KB
SHA256 3a3eaa386330ec4a4783d8e08a821ecc788d00fd9b6e495c5054d07645f54241
MD5 0c605e3072a0813e2b6aceb703934fe6
SHA1 06e3980749658675bed8f530df9212ef3afa6dc6
SHA512 2c58c849d7feb9ac686e1e697c21b59f3f4b6140419964fd450b2bf18810e4f3e5b9b6e4649d91dcb683baa19d7a7d39d803255f7fe628965999c3df9250fc57
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+3k:A3kMB56ru
TLSH
T13B157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 935KB
SHA256 761110f971342876305a505889a05ffe44da62fddf9b052d791908a48b973f98
MD5 17887fcdce19c83ebccf55b4368c4c18
SHA1 7bc3407969eccbbe4c12fbf6d297dda7f3f7452f
SHA512 1d04aa4131659bdacd72a6bdf6cdbc76be48505c9c41b228a6f1cca9473bfb01ff74eda4150003ebf6d841a36a279146fd8aad90ea9c44d40ad0e4de9c6ec7d0
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+A0:A3kMB56rz
TLSH
T178157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 935KB
SHA256 71733d9c038b6f2227a0f63a5ca4c015f7bb5e99fde9332bad58453818c6913d
MD5 ec46b848f2a86ed3e720390dd5b8870d
SHA1 8f0b46a912e979f8cac91d0ab24265e134e76846
SHA512 efc8b105343c0388c643a3f568809da228cc9d15cbe39b0c39ba2c7593031334b6564f290ce16c96959eaae0ffdd62163f3b3f7f1df0404c78f18b910b5a27d0
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+bg:A3kMB56r2
TLSH
T174157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 935KB
SHA256 e3bb17400d680c933f10a4c1093c536cc86f15fe95cf6b7a297349025e7e9d95
MD5 ba2132572723079751edbbf723704e17
SHA1 6f9ce1c5c20849a0b153a32f6054ed335206a69f
SHA512 057a60273ab2db85d890f6866e3c511c472448cf3fcf8f77098f571ccd3907b3880aa63016ab5cea9b5556447e3f2ab5f582312bbdf5c22cc79daeea9f75c01a
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+Wr:A3kMB56r4
TLSH
T117157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 935KB
SHA256 fbaf4e982aeb4acf60999a41ab381bfbb6304a5cf89e10f9c38e4c58e174b115
MD5 509796d1e05d11783b2460a47b91a1fe
SHA1 2fdff3a46e0feb8616837c3846f378fe36e83e5a
SHA512 f067abd3f34c2d760eaebf489fcf9699085d7bfb010d088c4fcdd61e5bc7dbddb5ca040bbb1b8342c13b7d94f275ac021f9c31d7594aff55bfab0c837fca1fc5
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+8n:A3kMB56r6
TLSH
T181157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 935KB
SHA256 100ff5d5fceaf7951153ebdcceba8e0a6a0795a268669889d626189cd7defed3
MD5 b9332bddc97c1773639f274224e3d78a
SHA1 28e60b63ec1a68909a1150194e2dfdc967a625df
SHA512 e9849c6c0fd14f924f41c645ff15eb586eb400a83a3e9571ceb951a61eb23d532cc8a589f837c0ecb75b4dcc4bf3ba0327f710f33a96580dc350a793690de7e1
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+6x:A3kMB56r4
TLSH
T1F2157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 935KB
SHA256 7e5229705a0e959444929e637c57c78888a5ab7e414a0a80bde6f896a36e19c1
MD5 084fbd3131aa8447fed153c15df23045
SHA1 3ca959d40526c5544b4ca1f4cc20d7558bdbd915
SHA512 5de8e1d1e19c99efb77c0d86e88f355bbdcd58d69fc1ad6b957ff7d41883c49b1b1594bc60a96423a395bdabce434af26f830f6f599d056907ab747daa8ddac4
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+8A:A3kMB56r7
TLSH
T14E157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 935KB
SHA256 95101b9bdd3cac84faf74c3518bafb161c7f1a570719b090f10cd34a6b65db89
MD5 617baaba8df909572863b69698f57cc6
SHA1 7591a2f81ecc7331670aef11989bb3dc8b11acf1
SHA512 46c10fe1c0eabebc3e73793483daeb2afdfb9986f2b045572ac6a02bf0af97720242df874a845ff6afd392d7bf240fb86242bfea907fc808674b65bfc41e2a7e
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+l9Q:A3kMB56rW
TLSH
T158157C03A6940FE5D11F817499924662EB777C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 935KB
SHA256 429c42a17d83191685a057b5373e071c56d8194aa1dd60078f6f8ae2a5630e21
MD5 e77288ba60e11a45e7b73305b2115c1d
SHA1 ae44827170572b07009cdd5fd6dbcd840f427a80
SHA512 491e3afc7e47951b816ad87659c59684b2faffab0730763f11e89caa82ff57081bc887e1e79ed07d1c01ed2dd205e735b4c5aec86c4aaa8c27ae623f3fb9390d
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+Q4:A3kMB56rF
TLSH
T1CD157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 935KB
SHA256 497cf5b684840cab71385c4d6e1ff855d2aaec5d0f8e7ec26cd5c051afd09e83
MD5 f8277027449d3e3a903e2ae0f26d8053
SHA1 abeb34e34d44bc3a4e44f44254d6f35391225d17
SHA512 44198e3d5354af05b94498a7f832e59f83a7313e392b5bb5b68b1acab4195c76556efad232865d2a55052ae29986639976d2cb26ab146564e94ba80056fcfe5e
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+Tu:A3kMB56rw
TLSH
T1F3157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 935KB
SHA256 e5de05f1bca974304d4a1e917c03c90bd9f7a26bb4cf608312c89f381210b86b
MD5 78decc674d88eae3062db80aa8a3527e
SHA1 7e4ebf04d3a33547316fb2a13fff2acc7fbb2135
SHA512 5496526df957f34920b5d0a9f939edabda34d5a3f2580ff7e6b3a226a7b73f9862a1824e466751179a45cf424b931a1a2b3d4751a7f5840d6065f2ac98339d2f
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+Oj:A3kMB56rq
TLSH
T19A157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 935KB
SHA256 fb2ae9dcf5374564d353df5ca6860bb93b0d762de2460062ea42a3fb16f39bfe
MD5 6dc36c7232c5712a1c109652b396757c
SHA1 2dfd0bfcbe9ffc82248cb2de98ca319d79715551
SHA512 d146dcba470fc07a31a3798afbd9321d83bf0f694bad544c98e21d514339acbca45220b0e4b2e4f0b7c4a8420ed0bd2feb90756b9571e92c41165507e0da5929
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+7g:A3kMB56r+
TLSH
T132157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 935KB
SHA256 1aad0e5d334ab2e6ce9253770358a8f38ec6a92fa7de531c72d2f8d53115afc6
MD5 092836c82aa31efc7a998e0fa8ebc2d0
SHA1 7169e3b454150b01ce6b7e08788637138827c96f
SHA512 e19cdd5e036f1952f8d3f21874ffa800f45dc4706e806d9c6fc8a253febbd2d30cad5b3ecc35d6d540798c2d530821f2257adb073780a8bdfc8b643aad334ce8
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+mI:A3kMB56rX
TLSH
T1CB157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 935KB
SHA256 858cb5da82074afc9fe68fcb939d1fa2fc25eb2760cf8dfce92de9c532779fba
MD5 d6c0a0f874ea1b211d0a8f8fa6ad62f4
SHA1 72cf324aafea45ea91a8303d5da257ab92601328
SHA512 2c4fd4af0e606e85ab614be6434919028c0ef620472e1a1b3668af5cf2a81d683719e0b0e120cfa2f91d7a8d98b44164d7f17f26b71f0b3d75edec50bcc145a3
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+Uo:A3kMB56rR
TLSH
T16F157C03A6940FE5D11F817499A14666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 935KB
SHA256 5924f3a48e25d1cd65d9e18532de34e6d08e9dbec3b8b324e20ed992381f0832
MD5 62507366ea35489581effd70c3aaf529
SHA1 67179fd79785d1a02f47fed6e2df54b9b6d3c0e5
SHA512 bff04208f903c8f7b3bf4d238bdac5b70d2e537d7691d8b5c54260fdffd61a1003e5b9e1278a37966f8955b24cc9a43e1b714772ff86e0c2541e10231d231b66
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+3+:A3kMB56r0
TLSH
T1D8157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 935KB
SHA256 b64dba5b1b1acc8a263b7ae60d794c7b5efbb2f97e1e8d3cadced6b0705d005f
MD5 57c99e8ba9a7514e1eea3b5d4c9cbfde
SHA1 e873673603fae3373294afd812e7427927db4421
SHA512 1b5d911dcfe0d0b34c6be05232179a124012e548e8b499b72b4708c3713998688a8b5f2e82a05b43f4f41c76533589987e28c3e5bed0076d9805ad011e4ed9d5
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+NQ:A3kMB56r8
TLSH
T12A157C03A6940FE5D11F817499914A66EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 935KB
SHA256 38b657622d3d7fdf838833d1f5308a83d88fb4f95b6a149dfd04f08e3a05af73
MD5 1ffccb8761d0671afd2973f83f6b21d5
SHA1 2bec607f60a3e3d2b9893ffb93efa7763189ba0d
SHA512 064da7a703e0b6e257c558728a386f51bcdd01aeb36dde1cd11d8d7f695a5d2a075f06bc54a8691b99cc3e199cb8b03abefd23944cc22efc7cefd012dad85afa
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+CX:A3kMB56rc
TLSH
T110157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 935KB
SHA256 1bc62fb3101ec99c1158512c6bc592a8b129d28ab13447b05c3e43455c4f7968
MD5 afe78871cdeee87cfaac1a8d1a72055f
SHA1 d3709b5afb3281e001e18037cede04157ae5ad89
SHA512 42dbb7e3f102631e21a7b354f8f1cad04d2f1e02604c4840a122fced39df8ae24d35926c8509891116cc96a93dde8d08c7604320f8aefd2524bf9bfb6810f13a
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+kL:A3kMB56rG
TLSH
T1A6157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 935KB
SHA256 e94d053349fd4cb0c249917e4fca00a83e192e338ac965f0f6158f540948f1be
MD5 e186d21b1e700d022ef90d9ee2177388
SHA1 9c0747878f85b121f65c4e886619235f12144501
SHA512 4214ca33812daceb8d4c19605622af830a7a723354b384a1fa798e67f4197b11258e1346b772a4fbb0d0ccefe93189a09c1241338876143e64a9219bb4d10dde
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+AM:A3kMB56rj
TLSH
T169157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 935KB
SHA256 dfaf5930bdcc21f7abc059ceac7974b96c3631713bee5f78fc6f0e5a5fdae2d4
MD5 f8d449ef9b94d2db76b037f8b66e7092
SHA1 11a98703abef4e4340a35a656d9b3e94cec3b618
SHA512 f25be9b55bef99203cb3655d4883d8169ec43bf99ee35494ac2cdcd4eaae03e8034f2baf3d5d5e074b20178d0800659c5bd234910e58d6804e3621394f37c846
SSDEEP 24576:A3mnXoZjzyacNVOI/7PYaiI/MD5TvinrmF+hh:A3kMB56rd
TLSH
T1D1157C03A6940FE5D11F817499924666EB737C125F6087CF1368AE253F327C0AE3A7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3224-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3224-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4224-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads