0272dbc2049765a0f5b286caf6cf628c8e920bed3638e040ca3941e9fa2ecf1b

Analysis

max time kernel
93s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 924KB
Sample260712-kklfeagy8s
SHA256 0272dbc2049765a0f5b286caf6cf628c8e920bed3638e040ca3941e9fa2ecf1b
MD5 ada1a43f6c4f88dc555051e65d9ccf4a
SHA1 76a72d7c64ee8105ed51d26ae1c7fb5b5afffd07
SHA512 490ffb44e97762ee2a28e070fcee59bc037a1365e52f0a2814b3f823d94347e9d5535e5174d20814260a24c2a33e523a21f1fc51fc3e43ee11245e559ba3a558
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyC:A3k03kB56r5
TLSH
T153157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/1112-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c622-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1112-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6140-185-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-234.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-690.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1103.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1396.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c622-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-234.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-259.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-446.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-690.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-783.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-929.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-948.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1004.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1048.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1103.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1146.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1171.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1215.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1318.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1337.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1362.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1384.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1396.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6140	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe

Drops file in Windows directory 62 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1112	2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
6140	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_ada1a43f6c4f88dc555051e65d9ccf4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1112

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 0272dbc2049765a0f5b286caf6cf628c8e920bed3638e040ca3941e9fa2ecf1b
MD5 ada1a43f6c4f88dc555051e65d9ccf4a
SHA1 76a72d7c64ee8105ed51d26ae1c7fb5b5afffd07
SHA512 490ffb44e97762ee2a28e070fcee59bc037a1365e52f0a2814b3f823d94347e9d5535e5174d20814260a24c2a33e523a21f1fc51fc3e43ee11245e559ba3a558
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyC:A3k03kB56r5
TLSH
T153157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 65ef389428c76710cea8c0f29127f9c0b8580442fbc82b88e19825c7ee401c37
MD5 6737d84f81e6083e3b87e00995550951
SHA1 fa367271ed93eeedc1096cb04a684642d5833061
SHA512 5bf38fa282002c6a215c26ddf58f78c47331ea15e995d623b0d072ae464e7d6c070a412743b1fe92dbeba0c4b3e79d62a3d5d0486c04c7db4a3466b232897202
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyC0Le5ji0hmxNrM:A3k03kB56rlPji0Aj
TLSH
T1FB655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 939KB
SHA256 17c1d34e092b1c52822a5aba820e2c116dae4c1938713449c1893028a64eb49f
MD5 ffda95f7438b690d42d7211eafa3004f
SHA1 57ebf95e434ad7903985144e01e2342056cc9a67
SHA512 8d8215c08a8cbb1feaaf67f1e7197b6127cc2ecbd7d559dc102b04093128b03d43ab2f9820c489322c49fc942886a7b7228e7d58fff39ec9bd27557148455cb8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyMa:A3k03kB56r
TLSH
T19C157B13E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 948KB
SHA256 35d6f89998388d2b11091c18313f19240194d1c69c68aba61222296f114fa1c1
MD5 356240a0ab5aa4c8746acb276cce3d68
SHA1 b7af0b0242de7c2c08fa9bc542a3bbe27ff637e7
SHA512 421fcabcba2b748f02df15176021b676c63bc7c38449bdb04c3833e590568aaafd29f5c8665cc261be2355d2439ef1e26fac20dd2070f21b7b2775d1a913e48b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyl6:A3k03kB56rh
TLSH
T1EB257B13E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 948KB
SHA256 ff7924e77316788bce044cf219b7c7155f4d78d70956325042c753e626ba5566
MD5 e0d511ad06cdab87f641fe728b7c5d60
SHA1 6e8981eda2db1dff182ae1dde7667dbaca7b588d
SHA512 37f2f3c916a13951b2566c3dbd6031e69647da016a48a5ed77bef2a1b8800dd65919064939249b651271876d66a0c883f11b9bd9e5f6f9d53c296e89264afca5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obybo:A3k03kB56r9
TLSH
T172257B13E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 948KB
SHA256 d39f1895f30dd35781e6eb45806a5e7c85bcf0a904458173ff2368d3ec9afeed
MD5 b64807f4ab543219f1d7ac8089d54d1f
SHA1 be8ee5149bdc02fe38207ea6b12e0a0d14ff3741
SHA512 f07d2ea1fe8e87b3faf744687d6a0add96e721030456922d7aa2f85197cab006ae22e460b1c6a432d59aa888e1dc80c5618fc43c933bb10b661d9136309ad7e2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyPu:A3k03kB56rP
TLSH
T108257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 948KB
SHA256 ed07c461b282da737cacccbd84b0ab9b3874a387421937702bea5eabe2a0a17a
MD5 09f729d9c9630f2d0ca4b6f560b2346b
SHA1 5ecdca1dba2ce4355e6225a8a5cdf470c6925f1c
SHA512 48b91911c81dbc8f7c12c6890a3404c1483e1ab4911f3e904c3d6f057a8fc69c454cad1037c6238d3d94c7d8c66c0d8664cdcf1dbeea10ffae4740484dbd3e91
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyd9:A3k03kB56ru
TLSH
T113257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 948KB
SHA256 a7e51cd4d99f8b211773fcb28b37bd1cf316ecc1b3e4d8884cc253ad5927dcb2
MD5 8fddd0e9e8bfde1be217d40adc565b08
SHA1 847dc4e56f7eac9278a05f3261ed662f6870bfdc
SHA512 9a3cae76aca3a39e941d1c39f915f672d793864cf24f1d677c1c2284b40229dd6ae1d5e23bc4574037e1c6531cc188f27c42593b6cc2efe694a86d33dc2fb302
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oby5c:A3k03kB56rD
TLSH
T162257B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 948KB
SHA256 a4ba2c8de44544b0c475022cd1e455c6fd0b4357daa922afaa28b91eafc0972e
MD5 1fccc965be3fef5c653049d36c3ea531
SHA1 60296c9401eca3cb2bde6b04b8500641084948af
SHA512 520a88c7c952270163a1176cab6aeb5b4160d05e160d3e63f4142294b99040310f8cedbc1b37b3014e10f274ab9b8ded1feed868ca9a3ea01feaffb66e585b8d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyyp:A3k03kB56rB
TLSH
T14E257B03E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 948KB
SHA256 61d2fe246c3020e660546d5c173e79c019eb8dabeb8db33d909898d3b0794d09
MD5 450c51ecba70d1e8fe8fb2834d941295
SHA1 615cea2ec140c878e3279096e6d10d3cae04dc00
SHA512 07127ad9aa77c232ada6a50453aca242d7db8a58a5ee5dfb298435bf84548577d68c14216bcab87848f0146f43d60d4acbf75cf45fd328e2b3df02ee29fc5d2a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyFN:A3k03kB56ra
TLSH
T149257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 948KB
SHA256 f4c52e9a9878846fcf9ec2769c5f44277fc93864f46a22027345af37af2b293e
MD5 098ba8b8074bdef9d3dc1da3a699dc8e
SHA1 d3f8088a2843440151c0acfa17ca0741e6e62ea0
SHA512 64e2e5f1bb608f615cde522af132c23d7ea03ffeb38fd9b9fe5cde18f2133e67b5aac775a5d042b0b07ec7a031480c480c3ab2d89f5f2c520bc93ceb813d5cba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyXF:A3k03kB56rg
TLSH
T1A0257B13E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 948KB
SHA256 76eca123afdb873129cd39801f7a40f2e45c4f965bef8a6822fbf6465d76fbca
MD5 6671aae1d7515520ad23bcad65425858
SHA1 95b30c0cf6fa6258aa170838751ed31211291441
SHA512 f27135d2171afe9d55627c0ab7769d815ec4b196eb9fc2841dd23869732ceb831f37073e1d9ea134aec9424c2c3c17831dcb997fa6959da30d1a0cb551e2b656
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyoC:A3k03kB56r0
TLSH
T118257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 948KB
SHA256 a5f5c1eb6330a9c26d61113109380d229e37fa45dafad6534ee72bc4cca606f6
MD5 31d03d802e3e06528cc5011c02d654ed
SHA1 2c9d7048e1c45eb4e4ffc6a20a191be6a471c38b
SHA512 84eed0551f46c564cab87d308d11edfa32db6b4f9628781a0bb7fce23e032e8c6d238b0e70cfde2bec0c0aed2397010cb4bc9b3a2fab2b72c16468f6e7c3e6b3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oby7w:A3k03kB56rJ
TLSH
T170257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 948KB
SHA256 33c1e9d0d0b276f75880e34283632c677372f70bc7c3cc2f64309bd63d70c872
MD5 5521f5295936ed12cfebb9959a2ebb36
SHA1 1deb2e659566cb463332099e1119c92704f18bda
SHA512 4acce7dda07344fcc4d04bf8f6075a73763152037e7f65b7ab6a250a28db056eadb06eb9d46c855f2914b63eb42bf568a83afff341232c243ec5e52d35f38c3b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyCT:A3k03kB56r9
TLSH
T1D0257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 948KB
SHA256 989b2ab2eec8d9e19b4ca26dd8a13891114f8a7d0dd66cb7238dcc2c1c26c6cd
MD5 900d0141d3d3f827878a57f4908b137f
SHA1 287591ce43caf36f3200464f29d39fcd68b0828b
SHA512 ea9e4a41dd54158757c31dc43eb61e4d0ea0c054004bf935e85e42fee788449743a6a45804bd45a90c3c23ad7623b805fb7f7227c2d4875d8c06bb672fc2900a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obySu:A3k03kB56rC
TLSH
T1FC257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 948KB
SHA256 d03fb24066a73a0473a9583401fb08e46c51551072b5305311a347d66022430c
MD5 9b68925326ab9550209b48fb04a6e618
SHA1 9b492e574b39750509a276da972479bfa5cfa38a
SHA512 08c31e87d6b4d9810bb05f655442dd7e116d5510c2b2373be9b63d2f2f983b0cc5d94ddfbc30d67591d6d9e70c7f6c4a7bf68151a8cda294c396c9458d6f4c56
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyMb:A3k03kB56rz
TLSH
T138257B13E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 948KB
SHA256 de1842420464727dec05597f8b900dd291550cd7ee6362151a8b0cfa0f34b893
MD5 4121d9e642f362a1d02b72b40c319484
SHA1 c5e1d6e4cebc182efb50f23f1619fc3644cb721d
SHA512 8d2e402244f3789f19e4cb9ea5fe746b855168be8960cfdee680a6cf3df13802c62cf5b82ee60cfba9e3c2b6b44a39e04acc5ff1fe1f5890abd2c7ec3f39a38a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyyf:A3k03kB56rr
TLSH
T1AC257B13E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 948KB
SHA256 4a0c696938d054418ccd4cd04b9398c91c432d7ce077bae4dc25c45f680951dd
MD5 a640b7d7f41de3dbec8bc285c66dd76b
SHA1 7f64f151a19bafa47160cca4813c1cda1d2d3ef6
SHA512 1ba92b7d31979ae16e50f7a946161b95ce44afc23c228fa158cecf8d67caab75bf4186a12a055feb0f81c710c4ed36349397fbfbc28ea5d8113136cdbc84a3f3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyfK:A3k03kB56rb
TLSH
T1F3257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 948KB
SHA256 ac9456bea44d24972e2fd8e78999c0b1e81531fb4174494f7678d2ed35ac3ab0
MD5 8e51cb6c067764223dade92d2251fa07
SHA1 03a06eabe6ab6449a55b8dfe8c14f69ebf70764f
SHA512 970fe9381236a6af572e9c2d2233979832cdb29af8c8494ec23d4ed837d69305dab0f51a22f3aa8e0d6d606a2f7b016b892bf5033acf166c9d11103376113f03
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oby4k:A3k03kB56rW
TLSH
T120257B13E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 948KB
SHA256 da70332c8f44dc0e114f29cca7cd03a2482ab686cbf601101ff5846985f3f8c3
MD5 8d70753e03bc3facb8ce7464b179edd0
SHA1 c24190646878d83aa2f00f513ef75206698dce06
SHA512 0aa3f08ec00cac4194ee528d64cebae59ed61b5506c2c3577612a52110871ec486d442595063d58772e832264ee749ada2c599ba916568c7a82ee90202a8aace
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oby50:A3k03kB56rr
TLSH
T15C257B13E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 948KB
SHA256 5a91de7dd449a12562074cb18ab8083b1edf9b46777e8ff85bafbe3cc27678a7
MD5 e5df5b44bdffe256987e78756aeb17d6
SHA1 7ef7825f127b987223dded0a2d807cd46e085aeb
SHA512 af7ee8de48636e56942550c5f50d1a016cf2cce02c710cf33dcc6d0fae7f6d28c0a2164a93f9d21471b63fb4a28bfc627d3dd4004b63ac8d52ff8ae205960c12
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obysg:A3k03kB56re
TLSH
T1BA257B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 948KB
SHA256 63e085d6eb593927ae327dc773793e4cb8056f5104b526d51c8a61e2aa9e1580
MD5 0ed9b288ca655af815ff8d3ff9b0d94e
SHA1 6e57867cbd2ec9ce14040de21ab9d0e6d06d1c2e
SHA512 fdec8ee79fa5be53fc43d486d03a0c947aa3ead3cfb0384ef1a7eea5679bbe6dd561ad6c97154a84747312c25dea13265b296b9d08468ebd3b0fa377bc68afb3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyJr:A3k03kB56rg
TLSH
T1C8257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 948KB
SHA256 efe282510b0e527e57d980df30f0cb76ff43850c385801c751cf0d23c3f4f310
MD5 90ff9162200d22b308f85adc019682f5
SHA1 cb7c795f9455cf20021043fad31ec5ee04612201
SHA512 f301cebbf0a00b3cc6ab394b3b66806d927284c3dbc7e2224aed6502055d792cdfdb80217536214fbec485c381c2b7376ef91872de70be1631832db8a51c2c78
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyrn:A3k03kB56ry
TLSH
T106257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 948KB
SHA256 ee72c0a9c105a09e0fd6930da839755b5fa7faeb3131bd8abbacb98b099dbac9
MD5 af3111bbe1ba0d0b151f0c20a24586f0
SHA1 e568ebb347c9b6a33e9c13df9b669c1cb3c70bf8
SHA512 ce01cd55b5fb472214b2a8f7f9bcc9d324b1e48e5051c9bc259e6d745db674b7e9cf58d8f9c7615fe0621a5905ebd96e5fcca1e1be0f140a8c0eae4200aeb752
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oby3x:A3k03kB56rA
TLSH
T194257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 948KB
SHA256 d813b1b12826444d504494213ef31f5929b0f84f60f4435b36362b66fd976031
MD5 ec88657a83f366ff75a83fd899d26c0c
SHA1 ea28fe3e581c2abc79ee260e08c7356d7a1d5502
SHA512 293a5727c90299832559355627ab60eba6b538d660e4eb58c4b90fad6237884f27ee7945456f473d3b9f414b650df5346324d5e04a029f0b4ecc8b124ca13a60
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obytA:A3k03kB56rj
TLSH
T1B1257B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 948KB
SHA256 ba83e71e370c3ee571933bbf8ec0c3629756dc3892a7b016ac289b8c5d870a89
MD5 32a4ee4a6c162437624ca7c75c7aec23
SHA1 e4d33572c2c5f4e841f056ed1fc5fed4e8947890
SHA512 282cfd122e7ff8ef5994b1050761b57b82b8a99bf07c7e67d632a7229d5c47c2db9c0bb57881c1768c00e896ce6256c20ac0b1600f13ab0369d11d7caf44bbc8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obym9Q:A3k03kB56ru
TLSH
T1E2257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 948KB
SHA256 eb66ed2aad2c84796e1a949f6c203c8eb28063f718ad63315e7b7c67dfdcf7d6
MD5 f747fc6f892ca94311f666aa38c973a0
SHA1 008c0a835c2edd6219ea07350227841452803ae0
SHA512 ec04bd2d7af3e93062f9f2875696e70b6b2005a8a5c14c4622e77a9c417503909f6ab51bb8957e984049857edeed8c0984a35b95f33cea73be3acd0cf8c8ecc3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyD4:A3k03kB56rN
TLSH
T130257B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 948KB
SHA256 8c343614c25d61275737de001dceb9db705ad8018d32881db4c7f2bdacdea338
MD5 c8360127332a43b0ded83467165de528
SHA1 7ae0e1aebc2173e55a4538fe05cda1735ce2f96c
SHA512 53a6a2314e78ffda7e7a67091255c5a302e44bd2b983ad854d1a4c7fb9b96ba077a572658350b2dab04b7d51d5d85d382d2bcdb2e3999e04d015e739dbc2cce4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyqu:A3k03kB56ro
TLSH
T1BD257B03E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 948KB
SHA256 40f4a46bcbc3a79796d8edc2edb8fc09241dc79a11b3cb48fec7a06997405114
MD5 1198b71d72b275ebfe40eae56e5bd947
SHA1 4bccaae7395ea6f90f4c3f5d701f43804a4badf4
SHA512 0de24585c0f840d3ee32fca5ebb32ff1143c59cf216eac827c7b881dac02d77b145efb4df050433dda186e68382bad373af90210993582bb9964a19b1e2f3cdc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oby7j:A3k03kB56ri
TLSH
T15E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 948KB
SHA256 7e623a51bc87ade5ebd4a3c07483858b59cc5fa001f9530f350d01b313bdd70d
MD5 c806d7aacca79d17c64c264cd6de004a
SHA1 687c7cb8bce6176a4e0aaf15ff79e050bfa7b104
SHA512 704e26dccf17d7f0f3606f38e3ff48296e9c280b92de99913d23f05603e60bf314794e3f4d92498e2088f258842ab68cb8c1d6527741d2cab7210c0a06b082d9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyGg:A3k03kB56rm
TLSH
T1CF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 948KB
SHA256 1d33e937044673f26bead32887cffbb809d1c9b9b0955b5511436e39cd75abf7
MD5 c97f4a5144b8667ce722fed8a714cc0a
SHA1 c3b272ab54f487676a6db7b71a5b9b2f7fcb3740
SHA512 6feb5c9b673c4c6ab46c21187e5e6ae817416ea4c9eb47fb061356733341e5873df5862cda61e7e41f7f1dd6219b0852d232aa693012d18011e541b3b332dd4c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obypI:A3k03kB56rv
TLSH
T10D257B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 948KB
SHA256 a22f313809a501478ea698e4421311e8478a07d4e4597c56721f606db89d0068
MD5 87eef6d61ff367e53c0305540da2cd3c
SHA1 9082f614f40953af7f3f3f7ee6f773e525ed669f
SHA512 b34896d0ba2dec42fec4214a5cb83def02328b3b86601f608c39e4f8857afb4de4191ccdbfb330aba57a55cd8af2e122c7705da401457d73960c285f9a2fa033
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyLo:A3k03kB56rZ
TLSH
T1DB257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 948KB
SHA256 fb73de0f18c6f76cbd4d6a7a63a00ca241678af68f60635692aba9bae89a0466
MD5 e08f1f33a91181418be355699437a2fa
SHA1 95f616f87aed2cebef199611475f3d4fb9206977
SHA512 00b8adb9a31eaa61ce47f59871d9d20ec3876d1fe21ecfa4f50f6646a1502093a05da1de978207ae95f26153fc3ece093a6871c9ce4e110f71d2a795144e2c40
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyw+:A3k03kB56rc
TLSH
T128257B13E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 948KB
SHA256 49b402ddf962f4ec4a8d6a73e0f74155ef39cca2535e76892a64d31089c1821c
MD5 e9c71696a3634b26c59f6025889ef2bf
SHA1 d214a25fa08cc9ad50f47188a10a876ba2e61cea
SHA512 d5255aa468c3ffefbb757ff9f8a238abdce25aeeac9a75fbd57788f9c26d43e8fd1edb61c0b83f25eb232370ebb899c9fc96c82ceb67b3a0fe5aea80103ad49c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyIQ:A3k03kB56r0
TLSH
T1F7257B03E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 948KB
SHA256 03d0cec9c6cf726b217fa3a93317ab05221195a870aeecd1c6a8061bcc444271
MD5 88f4c75b4f3af03ce20a0da80047bbdc
SHA1 e912359fbf1312f3bccc29f4997fba5433012483
SHA512 bcc9a756451418810ae54a487e1f4908f773913360680468e0a32a1ac93870e083015f16227e25158836959ca78817ad35bf12bf6d42fcee7efd2ee9cff4ed4f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyBX:A3k03kB56r0
TLSH
T11D257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 948KB
SHA256 31c6eb95cf8ec881aad98bef2a38b7d1a5dfc4a244320b15b4a309bfcda808b9
MD5 0102e9a819ac0248372320ab860ffc95
SHA1 5a3acc3b34e670803d50089d4453ed965856f51b
SHA512 2caca054080344a5b20938ad663834cfc135ba152105887e4cf52a630e302ea26a0bec38585c4e5f2d8c5bc66f56da1cd55c6b46bb16898677032bec964865cf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oby7L:A3k03kB56rO
TLSH
T127257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 948KB
SHA256 1e76477465e018dc106dc4eaf4fc4a1f7f344a7fab2d9c5dbd69e9434eb7c8ec
MD5 518ddce954db5a6741bce62a70d42408
SHA1 2e2737af2e26cde0cd677fcadf4426f77352c176
SHA512 1cbe75e82930beb77c527053a71502864baea93d243f616cd4fdbd9731d23fc75241379b51ef7ce2f3b82f4b4bb19c2f2dca519636a8c8f9dc917567b43db5b8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyBM:A3k03kB56r7
TLSH
T1F4257B13E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 948KB
SHA256 d82dec2712d9d09cb3a633feb03693c941fc4b4004bd239fe10f391ac54a7103
MD5 1280252c145d134e26fb90ad433db934
SHA1 fb8bbd6cf94c007e1ebf685ecb8a8155f928af8c
SHA512 751e999d666ecb0986d7f4d55333dd41689d0e1825f38a986dc8dc170192d13c3ebd2789f0e670d7350f4f3167fbc713e229d7b3b8089dabd89c65afc49a2470
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+obyqh:A3k03kB56r1
TLSH
T16B257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1112-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6140-185-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads