5b8df62506db458edef482aab562cf69fb7f301d765eea3a6189532f0e41fed2

Analysis

max time kernel
101s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 924KB
Sample260712-mrr8msas2x
SHA256 5b8df62506db458edef482aab562cf69fb7f301d765eea3a6189532f0e41fed2
MD5 fd3312cd5aef62fef6f9c805ae34ad60
SHA1 dc1d3e487de4ea413f8eb424ed79672837cd1a8b
SHA512 95ae55a1e159ee78d40cdf06a9113ea8dd49cbe6f57007db8e52973e533c86bf7ad89cfd445091ff6a0b72cdbc3ddde000d7ced9d74b12cb6c3da595ad7cd5e3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxC:A3k03kB56r7
TLSH
T169157B03E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/1076-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c507-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1076-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5096-41-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c96-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-443.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-577.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-677.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-775.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-800.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-874.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-913.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1008.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1051.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1082.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1131.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1150.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1374.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1381.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c507-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-40.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c96-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-225.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-443.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-577.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-677.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-732.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-775.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-800.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-855.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-874.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-913.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1008.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1051.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1082.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1131.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1150.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1182.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1219.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1329.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1343.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1374.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1381.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5096	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\dotnet\dotnet.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$	patcher.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1076	2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5096	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_fd3312cd5aef62fef6f9c805ae34ad60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1076

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 5b8df62506db458edef482aab562cf69fb7f301d765eea3a6189532f0e41fed2
MD5 fd3312cd5aef62fef6f9c805ae34ad60
SHA1 dc1d3e487de4ea413f8eb424ed79672837cd1a8b
SHA512 95ae55a1e159ee78d40cdf06a9113ea8dd49cbe6f57007db8e52973e533c86bf7ad89cfd445091ff6a0b72cdbc3ddde000d7ced9d74b12cb6c3da595ad7cd5e3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxC:A3k03kB56r7
TLSH
T169157B03E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 aebdf05b5b86b309fa233eb91d2308f9d4b5c3eddde1dc52ed50e5e667fed14b
MD5 29c37d7f8a9dd2f2d7148cfdbed820b8
SHA1 50b2b8eda264bc7c658b718757edc1c81027c331
SHA512 9fb010f8ea1c1b65be526669d189b918bb28e95aff2175653b4b9afc66b28418792fbfa2e7628e8ca53cb4cbbab242a4f8a99355ecbba211c4eca4af77280191
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxC0Le5ji0hmxNrM:A3k03kB56rnPji0Aj
TLSH
T17E655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 939KB
SHA256 b6ea82dfa887118c935d1f0dc1efd2c4f4e28279a6e82539c75e70ff49111c65
MD5 d4066488d2f912e3c69f4f0894262988
SHA1 85a699c8e57245fa3379382fe3f9520440288e70
SHA512 97769b66165c8e95ba0039c217427d5d125fb9059031b5565900e12aa4118d0fcd007b79165eff8e3fe4c5f26750d4334d7340914591dd9ce2d31a27101c2a54
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxMa:A3k03kB56r
TLSH
T105157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 972KB
SHA256 b1a3e46cf477450dfb4ccea533c5e5fffce7e74b6ce212d99700bc1ca5ca8061
MD5 30637a710508b7081fa70106bf01c0f4
SHA1 25d0ec8e55dd07477a326976a18eccbd28336e3f
SHA512 e285b5c84ea2500f37c17fcc83777ab9d33cd3b3bfad3f623160b5474c1e13fea094fa80b61e581473b63fa509173167351b432eb471232a5251203c4d3de97c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxnb:A3k03kB56rqb
TLSH
T156258C03E6940FA5D10FC1749AA58662EA777C425F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 948KB
SHA256 dd0b01edfa3b4b7b0fa861f1665c81a67b5dce6d33c3d172580438d4c79ee1a3
MD5 72b73fddb64d874796f352b45da0fd11
SHA1 b8739212094459b090fceaddca9dec5b779e261b
SHA512 58a4b10d963c2548ec9e133d666b8a10aeaf07a50060b4724faa879c86ce7f4279282c6a3e73a38bdb17322f14e184696414646b637af1bdf98046a363c17142
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxl6:A3k03kB56rv
TLSH
T134257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 948KB
SHA256 8ac87addb8af9ba4b3122b9873b2b2858908827779b082f8558525d0b3bd8b3b
MD5 fc76ac1b06c858ac04ebbcc9028cc913
SHA1 8506d22896f65900ffd6f55514d009fb905633c7
SHA512 3ef8a3cae5631be04e7a28ff3fd2f11d5dc20539310350297fc1748f2d9f1e7c6a9492f3c3bf7590f3274f9b41f89066aa6837d48dd55aaca6082e76d04ebbd1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYx7N:A3k03kB56rS
TLSH
T116257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 948KB
SHA256 c65b850d8cea0e5b9c95284db0bccafe287c5f6f4e8f49cb9ee722dbb2bde1a1
MD5 7e38dda02625cc34f5952cf22de82105
SHA1 65ba0a61f7d91589b397b38b29c387895f39512a
SHA512 800f4bbd6b2c52c33235cf889631b574e126d8a5a777cc7c42fccb7fe862f9148de374b317f14d35039fb5e133962fe52c23936c0f4ebd08fb937e30fb66ba3f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxZf:A3k03kB56ru
TLSH
T18B257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 948KB
SHA256 5b1612c6bea06c3ddeff89645f439595200cc32a07cbfd745bb860e050f1c688
MD5 75281db4a184a1695a7501a2b127cf20
SHA1 9a3b75a75f662f70d286c100237388a047af3b90
SHA512 ca33e81977f5963522298b97e98a6cc2ef912e8458d4f580829ba4a292f0cfe1ae383ac494059ee6fcb2dfb7895cb3e9edbebe21485b58d4edaf6920a4aec837
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxbo:A3k03kB56rP
TLSH
T1E7257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 948KB
SHA256 104ce7bc19eafaff9ca4ea73b3d73b8e36fc3894e23f6cf2e5a61f2bea258ab0
MD5 636b3f31d21e5526e590104951ff91b9
SHA1 9ec31d7ee93633a5d38595c2b84d6269a3a00cf8
SHA512 83ed73298deffd8e2f96dc20501c9ae0880aed8c466b9a109f47d0fe7cd0e2cfecbe27ba2c01c905d024996fc61806e18070e66991134c0d2b8c8974d4bcf687
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxPu:A3k03kB56rB
TLSH
T105257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 948KB
SHA256 ec6f4d36683b9223b403963394fa2ff710f4aceae317b3123ca749328cdc9b64
MD5 0de06d833a8db6853d06f01416fe6ed3
SHA1 3eaee72f9c231ffb43b3fa8d6c278063e2d258de
SHA512 b6df01cb291725f228079078e01809d8bdc678348ad26010424544ad5e39cf481a61c0441a2a07990399176223a922abf93257bd9108ac3ab0af323791312c63
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxd9:A3k03kB56r8
TLSH
T1C4257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 948KB
SHA256 5c2e011ccd867b1bd8c330740b4b8cb42b9ca282df618705752c061f3a5170a2
MD5 ff692d97f077790a5f0868c0dc7df773
SHA1 a0bf5567f79048d09536ee403469447f4071e81d
SHA512 47934bc69c79b9ae48553eb8912bb4a44ff3370990652cfe4bffcf163765ac7c209505fac4fa6a8230e326e48c205a19e1754ce4e907e1758a86a433facace91
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYx5c:A3k03kB56r1
TLSH
T12D257B03E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 948KB
SHA256 a0c1b7e40da896d3d45b9fc69a772bde7c9e7bf265b38ac489a8f0ce03856916
MD5 8175e67fbea4fe9cea8323beb14d5c09
SHA1 9964915905601b1a2846df9ada50b20685833e82
SHA512 c10fb29d739acaf8531265db82bf9fdc40ef1f3339dcfada65713b8f4eea0cf786b9eaccbeb4001c6bc0d05c031ac6af44a908a74fcc8d159e858ab11688d69c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxyp:A3k03kB56r7
TLSH
T171257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 948KB
SHA256 ac6fdcd2b1c8995016e329f4a69070ac5407d90aeb69693be30c03137e0716ac
MD5 c6a3817b8a32c98e3ed725634b4669e9
SHA1 0044a3452602f056d77c1032cfb91dd999066dbd
SHA512 4046af6669f8cc2566cfe856db3e89cb1fdb4dc71d2d24cc60d5cd75477f2708c0112e3324389df4a2b46924ff3054633240695047dc9f173207bad13cb42d87
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxFN:A3k03kB56rA
TLSH
T188257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 948KB
SHA256 182464ad7fcd70ab9c737b08a1c326bd6988ce7775b618a4c1dabb095ddbd236
MD5 89edc6a4bddd73a7ef839338bba4a9f5
SHA1 4011527552e2aade5c6d096726bf4ccba749c7d8
SHA512 910561d50b7ac79b7569c085c6aa53f34dde5c7af5783a0c85f392beabbe0fdf19cd4355d635a7ee902d3f0d2a5ec2b8e4167a011511936fa50562ea7ac36d11
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxXF:A3k03kB56r2
TLSH
T17F257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 948KB
SHA256 b739f989b236436f9c84b85842a75f0e8c0232fb45c4388dbb107bd4be567628
MD5 542e0c06a22f7f3e1cf2df2108bc66bd
SHA1 fbbb38f45f6a4f5f193a5c1a8cad50612fcb1ac6
SHA512 5b338ad35e187ec75109ca0797ba14e218afdeb8299defab696b3cf4f81e9ba209998ed7abc9179eea1fdeda2b0ce8f9f5dc6dbdefae633685a815dab51a0f4f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxoC:A3k03kB56ry
TLSH
T140257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 948KB
SHA256 424ea236d715ff6a229a4b8fcc677ba3b20f7d821fa4a4ebacab984f5903590f
MD5 e7db6a14db98cbd75df50345e59ccefd
SHA1 e62e14804d9b60f4230e3e3a7578fc3234355953
SHA512 75aea68752a41b8c83eddf8408269b8b2559721a2a2dca225aeecc0c7f09c50657e191e29bff50087548623078f3436792febe8588d716766eaa4a481fc7c2fe
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYx7w:A3k03kB56rH
TLSH
T1FA257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 948KB
SHA256 6005a79022216ec1aba01fe104cb6116f6a9fe35b023ff542daf6e3b41d2222c
MD5 e395b7e4f156e5c03fb19aa6f42e4fe5
SHA1 7f70b16088ce790bed773c727668b19d077856f2
SHA512 615b957ccdfaf370eb5d0dcc5f6b37d951b9936b7e853e4f82e4b9e54e75bcc496ce68713164d2f6f3c27668ba5887174a3c88f0d743e11d42bde1b1968f7d35
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxCT:A3k03kB56rD
TLSH
T17E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 948KB
SHA256 e9de617304c31886c09a2ae69c179fdb9704fe65eab73c4a589ff017157133be
MD5 40f765e8ccb7693e411361fdae4c97a5
SHA1 0472dd7c857ae55d59a1182a34969442be1c32f8
SHA512 f2a051f2b96957d65c626dc18adf179550f785cc7ce087cb291fe4071a1e677ad5749901e021aa1fdc942404feefb488ae3ba5ff5459b5017b13568f511cee69
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxSu:A3k03kB56r0
TLSH
T19B257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 948KB
SHA256 ddd50074a8c44d18cb2ddc19dda75cbbe6df5e9488ab2ac68064d64bdca9549b
MD5 cb30cb98ed3d726ca9d2d1a9c0d4466f
SHA1 0b908de9ead672bc6dd9d3b8c9ec0114ddef0306
SHA512 c8e9b44cd98880935bd3e166ced0b76bf103e182c70ff1dea29a3a01ff14e47780076686e0f7f28e7e5ea15b1fa1683549aca19088cf55fa3e24eb89b88faa4d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxMb:A3k03kB56rd
TLSH
T1AE257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 948KB
SHA256 583a83de784d3d33ca8c8ffe7eb2b278276467c319b675653fc3a74a7bfa401b
MD5 4c7c67cff5460df0519a4e53b54ec3c3
SHA1 c1714d0f9713075752d0f8f03346dd24886a468b
SHA512 54109d0f0054a82be62a921ca4e41198a9e1d5fb05bccf496925e546b96c8e5f2804a5b5b6518185e1bb2af78863824aa098bf8909f3ad6eae84f9f6f88cf186
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxyf:A3k03kB56rN
TLSH
T10A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 948KB
SHA256 dc0a44eaee569cfb8f20755f38722b14a144a23a2220d5fbab0e4d999534bda3
MD5 ec3bc9d4bdf109fae8f403ac0d513e4a
SHA1 9589d8f6f72aff2b0d7f22aa2b4a6bc68a7bf11b
SHA512 58ab6e9cc2873adfb49a2c3aaca26ed667ac4bc8cefa74f7a5472166753e2857284c2c432ed5d00063a5ccd52776408e62200894b45266662a72808137e4559c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxfK:A3k03kB56rF
TLSH
T1C1257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 948KB
SHA256 3aba7c1f95a3b69e30ee7dabb862f84424b74aa040e9c674445d759a5c474826
MD5 9a2bce84cd0b1749a2b4d450d0c6d341
SHA1 596cc259d4f87240c27585443b348b7d76ebe299
SHA512 5243b69313cb5aca98494737cf0c8056985d05c37653f37c3335e8c92a0aec9e03b7bc6a61110aa802dd981386e9e3342074d2b2988f47f66772fb7e1131e4e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYx4k:A3k03kB56rs
TLSH
T152257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 948KB
SHA256 84f9f7940d5c83d93f11f5a8cf003a9a931e0884eca29365f961576b55583820
MD5 d558afffd1597f70250fdfc1f784784f
SHA1 6597e40443b241945232dcb314e05548ae0fd8d2
SHA512 39d7f857687c82b5c3a7f1e73fd007a3d3cbdad6c9004e6e2e7c7b17f052e4c73a9177412c4f171f7c66f64a4a8ffb0d7ae68e95f34bbeeee75fd7ca0c88c140
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYx50:A3k03kB56rF
TLSH
T132257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 948KB
SHA256 d90d5f768164cc3e29c8d2630c7a74c1f4ed4e36de809e08cc5b6cca713777ed
MD5 7386619d83d2f13b9f7581180f46d314
SHA1 065f14954d5869c949cb41474244478dc7537597
SHA512 1fd2ff0e4214e0767f0c9796eb7fc04494bede29bcb5cd5c0ea3716ea649c11bd506eb999c3f42592e9709c8b46a4b1c1d536e74e2ec08c765bbfe6663cec5e7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxsg:A3k03kB56rk
TLSH
T13A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 948KB
SHA256 4c6e9b38b544decd48824b3af11a05f53c032f47919e67e7316a8305fee31d20
MD5 1f6dcfe2360cf422b826fa0c5fa3570f
SHA1 1adaf52dcde534039b23f9bf11fa1b19fbad702f
SHA512 7cd4405e8b637ffd26198209eea42018e8fe01bd424d62d02c681c723ee012c52398ce9f105ab49a5f5326296d2c7dba53e71292e41fbd02153bb99a336e4772
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxJr:A3k03kB56r2
TLSH
T1E3257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 948KB
SHA256 3d1d9ecc7832740caafcd355ecc0166d987aa74233e6a937c77b436b2a0e6cdf
MD5 7169f743b81079c7062bd9dec278700e
SHA1 f5bf79407b95852f1d3c41d7064ee3bf714a945c
SHA512 fbbde4e94a07e7d94500e9089c669d090fd5afdd2b651c906662a1c93aa6a9f3354f74fc76fc51f2a58d8772930c86de79083ab541b9816aec7630f8abf0812e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxrn:A3k03kB56rw
TLSH
T1FA257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 948KB
SHA256 339b73aec1d63078a9acf581925404816c5e37a50e44fa92729da1f9afc12403
MD5 e8e28a9c57134c4d87f2a6c601beeb7b
SHA1 0cc67084128c7170051455de9bd8bb006a7d76fd
SHA512 69ade1914a53a2c0df34d33cbe314a9d50fbcd0e850a9df9d6c279f03b024e1805754a03de274efe2f6c70eba0b6ea41bc72e211f2b08985537ff90244881fe5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYx3x:A3k03kB56rW
TLSH
T10D257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 948KB
SHA256 fdd185a70e27e42b930ee9f11b19be358ac7346fe136006c492f54bf83170676
MD5 2016f2e32bf718391d669955624c54ff
SHA1 5f6360c19515dbe198173fcdf55ba2d772bf6bd9
SHA512 44d4c3588e2ff578c76ecddfa84eb44cd89b23bd786bbfa9fdccadfd142096ccfd2ca7a1c1e952873a2d8b04c211bea8c576c939c378dfe67e200f744e8023da
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxtA:A3k03kB56rN
TLSH
T196257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 948KB
SHA256 7a2857f91bec6198b95fdc4dd36917f19eeb3c67fd02a66eb108b10a51393f33
MD5 22b34bef53b4f769e5ea2cec7dbc94fa
SHA1 25f3111f20762bd42bd2b5f1d2ab7fe342638704
SHA512 97e23afd7f01d66084a68133de0ae853507939838f7e9b9a03420bec315cff9dda524a578d7503b7890164a4653a30efaec2bc3b7477e0122e552c8cd41e54bd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxm9Q:A3k03kB56rc
TLSH
T188257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 948KB
SHA256 e0e2cf10831a9ef8fcd4d54101aee5cd5c7131e20c2aa3b4e2baa2b512565b54
MD5 bf98f96ca720a9a6d7c451322c32508d
SHA1 0eccbf5bc91e06ed0b710b0b03cf844ac3de90cd
SHA512 0d3a60a742d34cdb0d7d5c4f76cb293acf0062c20c1a013950a77110f0039af8810649f0baeafb52692ca7584814e6a5cb4bfb65252a041a8ad68d7fdd81a513
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxD4:A3k03kB56r3
TLSH
T19B257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 948KB
SHA256 e597018dc590e9729b636285365fd6e546638a94e3f8f215b7ae5bea74e273bc
MD5 8c5072d5d22c35804a0c30d356b1cca4
SHA1 c82f563d8fdb9d328b2668433db26137a5fbfe88
SHA512 65609e6fad5e79e9d811ddc0a24cb54e8652c37178deb74b18c24b255d4c2bff1054b6be432c8e839bb5fb59f8fa77f426d4a61f2e5bd9d90fd1c7476ae60e5f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxqu:A3k03kB56r6
TLSH
T1F5257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 948KB
SHA256 e994755e4ae3efc790a28bd51ae30ad2ef8c7e42b31d6252c6717c27b2c7c17d
MD5 e180628dc4da8e5f621071e0f652c533
SHA1 0d0911eb581d9028520bbacb743a81e2440ac287
SHA512 1284e8e21ecbdf80abf127073de9575f184072c44d6d2191571b071fefeec20ac6f5d81f5629e278e6a76f8db621e5d2d396a0e5a68cfc593f5c56579d3a8c77
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYx7j:A3k03kB56rU
TLSH
T154257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 948KB
SHA256 3a7756e52dedb3e07946607a92e9f7d5e160c7355c5be60bd0486619eee679fb
MD5 1df91997b81b08566224a55221d9e251
SHA1 a138ba1e01e8d55ec64deac5fda554f3f0f73da4
SHA512 9faea7e367f5c75994bd7205cd5a13f33282c2d89ee5dfea40d88fa1c46b1ae460e4f19c169dc3dbb604572b0c264a478da24f69c4f8147b3704092fd1971e88
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxGg:A3k03kB56rc
TLSH
T1F1257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 948KB
SHA256 a3d4ff6e9b907ac4a890171aee6a095537953f4dc769e8f158d947ff19192e34
MD5 97f124340330ecd7fbf1a7de20d92427
SHA1 7011e3f134d2a1f20287c6aa3f25d385a33d87fd
SHA512 af31a32af828344b6fc1bcec81f14db9118267aea1cdeaeda4f3d90df33699f23bd4d67ad6e540c3cb472925762f43e0af10eb0d203e0d7a90ce3e22bc319e56
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxpI:A3k03kB56r1
TLSH
T130257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 948KB
SHA256 1bcfb3eface9c23ea3e64f097618763a7d1db43dde1fcfc8c32830235e7271c4
MD5 3fca5eb3868d8e363ca4d7360442e760
SHA1 01c270577bb69be7fd872e37784eb8ecfc603892
SHA512 8d572fb5fbcd71bb64bd76717fa0615a9a3811ca7e285be3b025875e99dddd48e2ece79c7aefd5d319c07c1d348a5e3df0cd4a0c1c2860f41dfa679c9184d2c3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxLo:A3k03kB56rj
TLSH
T1A8257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 948KB
SHA256 8983b33a0b0561e0c32ba6a1315d55eb715893d028d5e7e67e51a1e5f5bed1cc
MD5 11236126263971330a2cd6be8000dead
SHA1 b1bf1afa0b36d545ceb571221a1c7cf2ca7d5b27
SHA512 afe90f99ff7566afde24bdffc596bf0d56dc85c9f26cfcf0c32ca61647302e8d08e1fc909d41b5229cae39d04484323896b9af04938687d0baf53409b9006445
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxw+:A3k03kB56rm
TLSH
T161257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 948KB
SHA256 86963a147c32b44e97e2146864547802772f3bfe86bd1730c403cb13bdac0b7c
MD5 d99e0faf24182e9fb14c64feadb43ba2
SHA1 5d4f747cd2983c37e7807a7f82fe62b670b5d758
SHA512 34c24b5f3e9211331ba96294f4dbc10552b371747a9ca3dc1c652001dbfd34d43f204d6cd7a60aaef89881324a56e60d58389a2470ae0586608ef0c601e0dd1a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxIQ:A3k03kB56ri
TLSH
T100257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 948KB
SHA256 1baa499a2d463a02954374615779a334a686fdffc61e48f4cbb69a5ed62952d0
MD5 cf7c7832124c0a4dcdb894dddfb5ebd2
SHA1 0e6f4ac5cd123ba926c36f1d483e7aa279876f67
SHA512 b103c220cf5bcf061b5dd54f1501924f91811a7122696a4f671c470201816e527a8d17f039bd857d8fdad4de68fe4b0511f8d93a4dc17a106b755531d98e69aa
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxBX:A3k03kB56ry
TLSH
T170257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 948KB
SHA256 dbac1a6e2f3efeded655f340c58304675e1c51c304642024d07bb2577744beff
MD5 4c65f4c57c0111427e41a4a7c52b692f
SHA1 c38e9d071b7fc4440196d0b92d84c7882992aef3
SHA512 dae2c360258a62e03a08dda6bd4348f66a41512ff04ac7819882e143ca646d7c4421a4c9bab4280b2391dc8c06b0115daa90a2fec15ea2e041db252c1efc7d16
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYx7L:A3k03kB56rc
TLSH
T123257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 948KB
SHA256 997eaf3b2cd88466165adafadebbfbc8bf4ab1094acc95685144532e19828219
MD5 ba23f0e917ae23af3b06633b8715de29
SHA1 68b153d8d05376ebd854876994b31d96d599ce4a
SHA512 b6725c92998ce65f5b099bf28a39d0354b1d65bb1fb5ceb1a94e2ea250c971db48e3834ff13505a08c970044791cde1350f28e5e3f4e95ff380ab75a35662285
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxBM:A3k03kB56rt
TLSH
T1EB257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 948KB
SHA256 685200bf0f0e2664c50a8bf0215d1b50aa45c5600a8d349ab564e5e7aaa1c58c
MD5 fff1a5424fe47ceafaf3e2bbb8b71870
SHA1 520d8cc7902adc15b28f6d01eccae7dcc2c05020
SHA512 bbaae4c3abe200be4893871b612f6dc6251f0b421e755322862c2888526b7a51282fdcad3454943d9bd5402b179d4a8b38590273907c94cc7755ada9ee841696
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+gYxqh:A3k03kB56rH
TLSH
T12F257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1076-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5096-41-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads