2b87a8d28e7c27a2481f986fc9008dc94b2c59916d3da7888e958e457fae7f0d

Analysis

max time kernel
94s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 20:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 947KB
Sample260710-y76lrabs4y
SHA256 2b87a8d28e7c27a2481f986fc9008dc94b2c59916d3da7888e958e457fae7f0d
MD5 55acb3ce0ec8b180f752d1043cc77bf3
SHA1 169984a2c611ffb60d47560b475874bbd86f9dfc
SHA512 51e490ce766391ba52f8c94d003dfc54e1eb21687987501fc4dc1f4b840539f756a883f0f3f2a74831f384febbc262aca95f5d3f73f14b5c090dcba4a9c2edd0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeM:A3k03kB56rV
TLSH
T1DC257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5192-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00060000000187dc-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000a000000019cc9-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5192-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2828-89-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-704.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-986.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1241.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1351.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x00060000000187dc-5.dat	aspack_v212_v242
behavioral2/files/0x000a000000019cc9-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-39.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-704.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-986.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1078.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1127.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1146.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1171.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1179.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1241.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1326.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1351.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1377.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1390.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2828	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5192	2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2828	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_55acb3ce0ec8b180f752d1043cc77bf3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5192

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 947KB
SHA256 2b87a8d28e7c27a2481f986fc9008dc94b2c59916d3da7888e958e457fae7f0d
MD5 55acb3ce0ec8b180f752d1043cc77bf3
SHA1 169984a2c611ffb60d47560b475874bbd86f9dfc
SHA512 51e490ce766391ba52f8c94d003dfc54e1eb21687987501fc4dc1f4b840539f756a883f0f3f2a74831f384febbc262aca95f5d3f73f14b5c090dcba4a9c2edd0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeM:A3k03kB56rV
TLSH
T1DC257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 d90bdbb1acbf0a0bd8dca22edad034b69f4df7491805b05de553eca042d2ee91
MD5 5505c7527fa99b68e3b31dfee12c9c60
SHA1 1fd54f7ea102cf2dcceadf1fbbb4d9454dcbfc12
SHA512 6cb3de9253197f77e316437aef6b790e9aa50d7f615a24ef2a6ca000b0a801f25ee33f390c1ecb9496450d522d5136c2acec9e6ec926c7a222bcc1610e81cc9e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeU0Le5ji0hmxNrM:A3k03kB56rRPji0Aj
TLSH
T15E655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 f9eb5c8c9db0563861759b6ce34bdd499ec9c24af74bee3ee6d12428584dd72e
MD5 a560455cb6bc7943804015d5be95c3d2
SHA1 5c151b80d1309fec97113e0f4bcfde5a962225ca
SHA512 18e20010617b65fb65cbd063bf6a02f4ac6089c88e364c15ceabf8649d444ba79ff2cfcc0fde22f4996248d279faf54474fc370dfb231e5a3b91d24f874fd14b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeea:A3k03kB56r
TLSH
T1FF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 bf5965589557ad40d56fb97531da0e58355d459a1ee47e54459ef443033d42f9
MD5 86d054f5a5bab0c7a868fbe9c26b58c6
SHA1 147da35b8524d0e0cf7fe0b3d9eed529bce14196
SHA512 d68c29cb8b5fb2ce833076dfedc8347ae60a26dadd35053888dda21b79b7e4c9b40495b2a4015ca6330faa63d339701827cc93cce2758851a767e93c73280b5a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjef6:A3k03kB56rd
TLSH
T1CD257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 971KB
SHA256 aff8f7d6918baf1e4660f6d80b67fd91e4677dab811b7a51e1662ddfc83ec2b5
MD5 17badff2dbbcd63994988ad142fff4f6
SHA1 b0563609dc9e9e9183aab7afe8317b426a9e5442
SHA512 096665cffde0ff5f462bd6b3616c7aaa701463c56af7450fe734f79efde950fa17a92e7b1fbbf22f6060120e9248b1ffced1626b7d012048717ef011ff752d9f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeBN:A3k03kB56r8
TLSH
T19A257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 971KB
SHA256 aa4dd301d7202579ab079b47cbd24f2ad7401867e3de59f2728e89d66a86b54d
MD5 8dc32043f61d1685142c85f0d967a9b3
SHA1 9676839206dab727ade9a00b82249a843104d0f2
SHA512 c3e65da760505ba68fed6b9193e92f02c238d367192c7c268e2794bb62acedafe8e57f307409fc392391b755b3756e143510280f968a8f62fba7793451c2b910
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgje3f:A3k03kB56r8
TLSH
T15F257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 971KB
SHA256 b3fc751a86a7277a4b31ac8c8548f831c2b6258f938f3d6899a67458e15ae33e
MD5 568d516752af4dbbdb986521690efd19
SHA1 782dd8fb4192064baa1b23e3e727aac1a8dc57cc
SHA512 6d640a21015a5ab42b52588f8ce922dcbbb8d716f7b3ce5c9c7b32752a291bc2fbcf0110f0cb3674a5021abd26eaa83903c20b1acf5aa76d80fcefd356188b8f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgje5o:A3k03kB56rx
TLSH
T1A6257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 df71ee78b98b673bd0181395c5ea6ebf3b5900db2c5e8f3f1319b2b6c8910ec1
MD5 b97d9f513337e9f5028a33b523907f14
SHA1 c9975182ed4c770f7f0edd6cc20abde4035ce783
SHA512 03f42efb08b6c9b03308e1806665663119a26ccb46b3ce6ff5dceeebb8c4793bc3507028f91d9ba35ab91fabea60fa0131979ff988d5864ca3bdd179e7859c10
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjepu:A3k03kB56rj
TLSH
T117257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 8ad7ea5966d2b49b1b7592174e6feab321c26011668e47771dfdf8b60ad82055
MD5 374f8ae586760b93d61901ea1a41cfec
SHA1 e46e9bbcdb58b3b1f5e5d0030f00389c8bf8f33a
SHA512 f7ea50fbcb2f4137ea16ca19d982cbb83ee7a80beafdbd9e14a6e15a0844e8169751203c617715021b0d015bad0d32564edcc0e5894de08e6ffb9d67b15a4651
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeP9:A3k03kB56rC
TLSH
T1D1257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 3c8af8a30d386effd585d99e27aa30a3a02813e0484203f15bf133a07ce18758
MD5 5621f0221f55577ffbcc713361f7aa40
SHA1 7c8243881ce8a9f2e6d975c6be7f6c462ea4adb5
SHA512 164c32110765f5e5e19ae4fab4f2a138a00f9565d146f74bc4cd439d7eb77e640ae71188b27ed8d26b378cd858f7e1337f28db20a0014bd0ac59e89cbeba7417
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjerc:A3k03kB56rv
TLSH
T1E7257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 0963a27c3c312c1f617d3661657a1125546f6c0ce62e1f8b5575f334187c0ad4
MD5 3bc7cba887a6e7d5e91106ad94580dbd
SHA1 64bf25cb8bea7623014b91801b7957b1789f6521
SHA512 d08d5359be612900597f0c2cd1af2274149026c053bd36da54d45059e0294093adce3ce32ca9caf3fafff7486dbdead1df440be70123defac2229131eab1fad9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeUp:A3k03kB56rl
TLSH
T126257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 5e08a3f9a824c3c8cac3d1e1e465dd4f3af8d5071ae82cabeb1efb4f15721c35
MD5 7c4dc5b2a7742912696dfa43e4b529a7
SHA1 ffaa2a25526ffe8c9c30f95ce86fe4da97d17209
SHA512 2f792b3fb0c1bb7f515f5d7b45216781370f27784ae373c770304c5e766eea6c55e6a64314fc1735e3256b137dbce5f87f229e3573429c80bdcc9366a127be2c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjebN:A3k03kB56re
TLSH
T186257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 f5a95c888c231235d79abaa0efc548ab204f94dfb81d00d0bd165ac191e81f60
MD5 8c4e76d6c675c2f45c8bcdcf71328910
SHA1 1e82c4c8d4c905b32f06ba688edc5653121ce149
SHA512 9ce492a300599b8530f7de587a48ee387343d83637cbaad5f31d061f1048e36f333a1714420d5a58067a3716935970e9493a8fbc097a68d7994522a785caa5d1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjepF:A3k03kB56rc
TLSH
T109257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 18ea898cc619dd66d9f7556b2b4324d9415a048977a8538c29abd81a34109d73
MD5 1b9455cb8d738c83b861eea6dbca281c
SHA1 3e7ad5bcfd70390900df7ca0e555bb44eba95d77
SHA512 63a7b14b73a9d547f8935b44bcba77fe3cba9295761dba72e6d51d456a31868aa5c137bb0a4dfec5102db2e2787c0b67df3d4fb5d670869b06c1e94314fcce19
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeCC:A3k03kB56ro
TLSH
T10F257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 d0e6842ec5177e5bb4284ad7f404272133b3ec81be1a01b8106233d90676712b
MD5 9cb1dcd5c2e06d1e41ba58421014433d
SHA1 1f12ca5c86ec6052afb8a0cdb72aef0543230371
SHA512 4e2ba197a5c70a726be96ad07d7aa4635a3cc2c7009992cf4a5cbda2563eaea45dad7c610f28e4336c6fa571926e68411c4cb6f2e8608b4eb5e35849d31b2b59
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjedw:A3k03kB56rF
TLSH
T1FB257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 b4b37eefb03388e5057ac8e52add5b2037d5ad737cac4674c02936df8ec26704
MD5 73263ffc1cee76cb34d8e30f9fab1fab
SHA1 12555b6c9a1d1bc89be390e224e9e5db8eb9ff59
SHA512 b32bb30faeddc5e4418df61651456c4a3242a1b2ab29b5c69e2c95f731753426420c15e0de9f0e75718e802f0311907c511d66d77458e31c26a6d536e0734c40
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeMT:A3k03kB56r5
TLSH
T17F257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 8d767348ec4a635aebe355c9bf9bdbdb2e1c8af79ae61d26c87b955957c7e46e
MD5 e501ab3e0ebff230c54b49b17b362eed
SHA1 f234f40fcef1c49f282b39c0b5f50c34c83f36cf
SHA512 4724708f471b062708a9414247b913f6d43664a61f5b3bf4218447d979a33b3a76fa95308702ffb313d6a559fbf2ac9b36842f0eaa229d96105ee617ca35d54a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjegu:A3k03kB56r+
TLSH
T120257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 2f67f7b3ba4e443c14de9e269a610d3f4bb7bdbf383c294dcbc76d414575e576
MD5 2ca3c7d001c79bf9b771102c622b5c52
SHA1 d327972f2c415dc64a8bac82c36965f98864d95f
SHA512 7211a9ade3872147e38cfc864790cdaa7c59cad06bdfe1408d214986f3697e34459c53a9396214b24651a11c1d2b3380a04fb76d1e3059c43090dc4057a25342
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgje+b:A3k03kB56r/
TLSH
T141257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 62053da5958579919b06ee9af2b47634635ef91962372cc8ea5e31ce6e5596e2
MD5 bc1a66e17cd6dac649db298168bb84a7
SHA1 744d196b75e3c9395c009dad850d0d2440d08cde
SHA512 dfddfcf288322c943cbb3be0ccdcc110c547489975fb6fb5a144ab13bcb9f5a473ae8cf5612757a91fe6a3563d3352ec76253fd7327932323e422770338a6463
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeof:A3k03kB56r3
TLSH
T1B9257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 7ea6f9e6af0d640a1ca320a8485cc6431a82a3edbbec8f4136c7fd74fb2f2672
MD5 1d9e437961531f297d9b478ba53ad74f
SHA1 32f2989123707d268f642a1e24df2246fff56e47
SHA512 ecb94364c37c5e4fdfe76f29f3fc486419214134eb0d6f81f240f81dff64fa3ed41b3a3790a519bbfa7eb392f04250c1260d6dab1b20c868ff6b62ede5813853
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeFK:A3k03kB56r3
TLSH
T1FE257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 d8946dcbc96c48b8a1680dcfba11a01176ab1ee60b3c79dcb460f7690a7f9f41
MD5 3b402e760a03ca1713985fb68251bc1d
SHA1 97dbf069fd9845e259a315026f652c3eeae6eb05
SHA512 adb6c04255dc093da34b0b3a82757639203d9ca36b82116200d7fac95543302c25bf5d453cca07e6a9a07d441b52b6c7bedba5edaaec9548bdd83d092e31ffb4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeGk:A3k03kB56rS
TLSH
T17D257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 4d5d1c01309da5b55ac408d4916a4e90f99c72b19bbf6bf56b5b606718e72b61
MD5 2a93edf330917fd02c468b483a6fe5aa
SHA1 850c029b3fc745b0b9a0621c0399dfba5b4df2d5
SHA512 20c65a3529b70f65addab77630c97e228ad4f014b423b11eb07d948210a61fd384ed361ca27b01b5b3cfd209a6f5e2cbccd4a74ff9d2d0e7b8b46b6c44e16bbe
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeD0:A3k03kB56rX
TLSH
T134257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 1b595f3c0115e522a517413ede362e19b5e86218d72d378528b550ec3502234d
MD5 48d453dc52cc0b2127d77b5d237a6241
SHA1 130bbe7e5ca19564b334f41f63e1eb44a93becbe
SHA512 1d10cc66f5cfb10074b7d2f9f59d510d19c5db3caa200810a0bb6dbd4e3c26a5d9702594893316f2f5b7a5d2cda93e4857978df167d43656ceef6bf54356bb0a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeSg:A3k03kB56rq
TLSH
T19A257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 2e6306890adbb16bae8dc561eeed5366919d3667c2fcd59b5ed3a1c0b90e4bad
MD5 39a3af44e83a8a334bc99d9b31618a3c
SHA1 8e4faeab78010b85121f3a1612fc1f9800d6ef9a
SHA512 a9f0cfc1deba27cef153a3dde5cded3abd5d6bed9aea69cb989ce8e266b5ef0e7ee90766869b7d52ca4ae1d2e8f6b78e833d29cbe56664bdf6c08c0d15169eaa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjezr:A3k03kB56r0
TLSH
T173257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 f299a64d52985d7cf560752f7119f5bff7607568ed2497b0ca0b1f63567087fe
MD5 d8a29d00d56313256f5a5b6faf2bf2b3
SHA1 1af309741b70a4d5dd37908c241bc1b93a55eea8
SHA512 a92071fcf454a6d9edb586a22fad9a1ea2ee9f705d0b08b9424092d4cbadd135cd9cd3bb03d508c7a5e63abf9b1c11f9c087e20cf74de2827a285f5ab1e8d806
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeVn:A3k03kB56ru
TLSH
T15C257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 97f860af2ce8867ff990f657fddc7c3af072e9f469d22d87ac712235f1c0d469
MD5 617bb54da72cc0e8bcd7497bfb4160e1
SHA1 ac7ccac6acb05b5b9a91d917206cf72452e76cfd
SHA512 df19a1eb144305b7d362b3d37c2a21988707b553fbb9c523443b93f590f9ca8c762dfbaf7060ef858a393be2d6fc194a88c94eb05b38223e9b3e48f6327183e8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjehx:A3k03kB56r0
TLSH
T17F257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 3c4117e9117866e782589453ab56b70672676325b1a81c0fbfc70c55c474fe61
MD5 738e0e7238d6a81ce596d4b5c97b0b7a
SHA1 b9cef358748501bb2f55522534852b5433b1d116
SHA512 2eefeccbeedefc67a714f9ad43eddf6fb59b8d21445775fb015884edd661bd5901012ac0d2bbe4deee806ba4b4afdf227d1926915bbd9e90ea7e6c6434dce255
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjePA:A3k03kB56rf
TLSH
T1AE257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 65f6d107a72a34d8c76bbe6d67595ba00b2953a7195a240341747b439c4aa301
MD5 e63af4f2aec8d8453f896806ec1efef0
SHA1 85f65203d21bf1b82423da9518d99a5e419e6004
SHA512 bda527b454f166eeb8585cb45d994c136d9aaf5e0cc6534794592b96a73152924e0832ff1f4bf2f1e7687e9fdd1ff0d21752daf6e91f4c4ae15d9fcef4f93dc8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeA9Q:A3k03kB56ry
TLSH
T1A0257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 9b2dd7e27ff577fabd89cb7817b5a68c54e4c2b868203ad70c10b13a1469057d
MD5 112b28a380374f2f767fa03a28047b3a
SHA1 6196ebdd4f20942f920a82dbba7e65deb783a25b
SHA512 eaadb2bb56450195349d0601938ed4e11d7bb58a7f5329bcacaad96deb2a13f8b68f5a37bb1860ea2646f705101ea4d485e3eac4f72574d9c3541bca25ddd705
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeB4:A3k03kB56rB
TLSH
T147257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 a6376417158235d9ffeb3aa8f1c570a47a6ce23c9d87cc170555308d7d289bde
MD5 f6770a2c195a9b706a708ef81144bbcc
SHA1 7a8ac8207da1509fa5fab3898c478470641e70d5
SHA512 654e7feddef7d75e5967fd9f0fb198517c1cc3d640be60c6d548911aab48bd3ea9e8e5a95a67964aa3f8f8c01ccaf6e47e5805a5dbcbd3c2e02b375ad3e77910
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeku:A3k03kB56rc
TLSH
T117257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 7b6d9e3c905875c67d82bba237b44434576f2bc6007d6576bbbcbe48ca10239b
MD5 7cafeba8859ef468f2c4c304af6543bf
SHA1 2d248f5df4b0fceb304df6987b2c20b80f5836d6
SHA512 da03ecc0424f8af4cd95a73f4f5ded76b1ec58dc73664ea421b53be2e15574d7d0137d95d26905d0c185a4dabd68dcb6321f341ade5772fa5df623010e21c7cb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeVj:A3k03kB56r+
TLSH
T109257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 f46ce7294e1dca7358d781a53124660e5b5263af5a55c41ab496007c38459145
MD5 59442bd2eeffe1001623a2454dfeb1a8
SHA1 ac66f7a4b8eea81fe0518fd70fe58097ce65e933
SHA512 cd1e529a4fab83e4d55746ed325b69fbb93d08a8c9e1644a45776e3a1d555556f6475431221b237a4ca7ccb0897b2edd48726005eb114b4c1e5aba0ce35b56c5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgje8g:A3k03kB56ry
TLSH
T114257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 573d1632d43a84a4ddc51a9ac7d9ca48668d06690eaf42b06f144b75b5c25d46
MD5 e126e33bc7cd2168941aae19131ac2ec
SHA1 fdd690074625abc891c4e642de8ab06ddacf54d7
SHA512 f10d7a7d1f4d718038a29add6e13936bdd25eb353c155122de8cc9bfe6ba96264f17de38598a03a9acf7484b78fb221b3705b36853c6896d977b1f343845c93e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjejI:A3k03kB56rD
TLSH
T1D3257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 cd917a5cdc39cec0302f6b9278b3c787e18ac63797d6f39083ecd642c7df7930
MD5 74f7f19eb9cc4ee35a7806671e582178
SHA1 11da57e7dce38dd2251610423dd7eec1c03fc20e
SHA512 010f29ae22ac0d4b1ab3656f0d17fe6d1b7d70fa79eef34015b8ae98e098bc4d593ec471ebce6775b2e7a990d8f1d64d3a80292a4693273f3dafa2e5e8e515e8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgje5o:A3k03kB56rd
TLSH
T1F8257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 a9c94feb5e56a2415df5add4d8980cdc20c013ad6a751f39e6747e8bd2656dc5
MD5 39b5d41cce031b6d3f7330998a11904a
SHA1 77287442de9dd14a7ac1531f9d986c1983a20f62
SHA512 67cb538bf26ef12feae72893b60b63b89a9950fa2f10845156167d61a3996e782c1c56c2c7e79cb7d8f369da08488fdde4826dea424ef3b95ad2e338821f7857
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeq+:A3k03kB56rY
TLSH
T151257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 44cd127cdf9e81f7006fd0d27b908a08b4bad5e7cdada5ae106d49bde97e6a5e
MD5 f22f3838ad3abe7e8916d51f4b07de86
SHA1 0d8f729fbb29ddfc527f51b6c8ea8cb23700ec2d
SHA512 9e508275b03c88c4fa898f5e7915d6e1cbcce8bde9028df854d607d62553a16ff729bf48e63a624fb5ac91b5ab08de49539f5883e269887e0b5be6918b07d01d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeqQ:A3k03kB56rY
TLSH
T177257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 ffdb7e5b075efc61ff0b1f8309cdcf047d21325210b65096d846aa7dfe94bcec
MD5 c8505f007652319a6fbf7b2fb016cc2b
SHA1 17e5f6f2e5fe2afe8e5f706f72bed6d5ac5965dc
SHA512 e99537fdab8756d7b4b325588c6a90fff77926e85f81321a6602fd7780c3c61d1ec57e750ccf542923a814b5f79017de4aa5fa44b52817656bd9eb06c88d56b3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgje7X:A3k03kB56ro
TLSH
T196257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 0cb51bda1a8ada871beb4ce65cae7f42e24a1b726fcd9886f0217313cf35ee17
MD5 c6906ce56c03cb05fea15c25f24ee0cc
SHA1 6e1609f9d865dba1e98a205a56cc2a8485aa650d
SHA512 b369ac5c6fc9e60ea8e025daa543204549614965f0ba2500b70883af768a48c6d3b8ead01a5f216680767e6d81fdb3af3d1f839bb13d2ccd8e8d5d94ee34924a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjepL:A3k03kB56r6
TLSH
T176257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 bd4a4413093cc57e4ead649071d5a7ccf9b554d0340dd846cbd6cd56168d6738
MD5 72488b0dc11e32580ff59cec8a24b906
SHA1 2598c6420abf8a096416dba61f9b12a236d91769
SHA512 3fef7a1621ef1bf0db81311ac3104c9ad992994e8b8733555ff4815b7dc74a28d0f4799a3a0b2504f2667f1cba04aa28b4f5ed91bdf8a13047d4773e3487cb97
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjeXM:A3k03kB56rX
TLSH
T10D257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 676530e6a84386cf347082adff01fcd23deaf85cc30ff6deb9ce3f88ab02b477
MD5 f0db81d62cfcc88976cd62c5288b64b7
SHA1 954baa1060fa5e9f9d3390890045df17ab65441b
SHA512 13524221e855b0c9ec990fd6e2e8bee85d165feff4efb4d1ee0557c50a852a66d2bebb92ddbe5c6db42688a4f974086b9158e4ff5d439b690a4f37676dd580c5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagscgjegh:A3k03kB56rJ
TLSH
T14E257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2828-89-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5192-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5192-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads