80e655df65685090de055b42d76d2f98e65ac8eba63e78b9e3028caa515e42a5

Analysis

max time kernel
101s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 22:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Size 831KB
Sample260714-2bm2baey3n
SHA256 80e655df65685090de055b42d76d2f98e65ac8eba63e78b9e3028caa515e42a5
MD5 46176b0e1fef00196883b7b231ee515d
SHA1 2a5025031762a2ced7147f1c02054a0458263ecc
SHA512 440d759f746e1ad6641305da4b70001ef4d948e99f5210e4a2479a6239417b83ef7011a28d06e54465b18e0146d6ac52cba95c67cd73ac4109443794ecad6039
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaoFRa:J/sCv7QExqatgl8beJTTx0yFybaoFRa
TLSH
T14C055B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF0B73A769
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4912-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c582-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-475.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-591.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-622.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-701.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-732.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-781.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-862.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-881.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-901.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-945.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-970.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1001.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1044.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-1081.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1168.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1212.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1315.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1334.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1359.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1387.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4912-1985-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3448-2004-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
3448	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{DAE0785A-A0D2-4C59-964C-79D844ED93C1}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4912	2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
3448	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_46176b0e1fef00196883b7b231ee515d_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4912

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 831KB
SHA256 80e655df65685090de055b42d76d2f98e65ac8eba63e78b9e3028caa515e42a5
MD5 46176b0e1fef00196883b7b231ee515d
SHA1 2a5025031762a2ced7147f1c02054a0458263ecc
SHA512 440d759f746e1ad6641305da4b70001ef4d948e99f5210e4a2479a6239417b83ef7011a28d06e54465b18e0146d6ac52cba95c67cd73ac4109443794ecad6039
SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaoFRa:J/sCv7QExqatgl8beJTTx0yFybaoFRa
TLSH
T14C055B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F32BF0B73A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.3MB
SHA256 7124d79a23f37f4f5db2405dc527a1fc1b3bf4ff0816897ed7cbae3cf9c0c112
MD5 ef0073a31110bc165baea3d7fe8aa11a
SHA1 8fc18f906214cee345b385f08ad4f7571f312605
SHA512 2d4071362aedc0f59fdeebe83590be112479f9d753ed9382fcae82d30a1d2f4d4e2a06c8dcddbe623d66ac2ceb40d92e9e2abd10c445fdbcf8ae7190f1f236d8
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaP0Le5ji0hmxNrM:NDqatgl9TKcPji0Aj
TLSH
T1D5655A53FA648672D0228171C4E75686EA71B4461B3086CB13ADDB7C2F33BF1A63A735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 846KB
SHA256 23342f4461e758eb2b4794fb86451a18abb4a7230713aa07ad6357c585328c9b
MD5 6d0897218618611bbfa09ff6c3a0f483
SHA1 9e3a985397da2885f2a0162d1ae574b4362efa23
SHA512 9b1ea7c7d6796f947ffe0a978b2add37cf4718343b9fb83721f99111468c3f3e8fa59dd7de85a3c361a08950e16661efd5c212b0ec57997269ed84d4d6fa13fd
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaRa:NDqatgl9TK
TLSH
T140054B53BA4485A2D416023054EB4653EB71FC1A1F11968F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 855KB
SHA256 23be7ed708832f1a243103978eba84f14ae65268939f10a9aa36fa414997d662
MD5 5c7af63f9546fb90057a6ea150f41053
SHA1 42d72b7b9541695ba9694872bf47cb2e0713f623
SHA512 8e066a90ab1087e89953e859074595bc5989c7a350067769b4cb9f26ba96cdc27a496d7cfec1ec840357a705c6cfa8baeddc5d2973a861d0a54f86682682a484
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRao6:NDqatgl9TKK
TLSH
T1BE155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 855KB
SHA256 55f099ffdf0fa987426e2337ccdbe27192b8a14272d754a33d667a6d83d83ba1
MD5 2cab4abc984910d0aeeaca721d210e94
SHA1 4c817480ba696c34d0b365babc0a087964304bfc
SHA512 dc2c2435cbdf02b4396d4e3a3548d5c976880d5e1b7790f21c31987bd44718813c28d6b09f9d4b2b5a2ff7bd7f5f08332c8135297e0a25eff72633d9886e5839
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRasN:NDqatgl9TKD
TLSH
T144155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 855KB
SHA256 021639fd45d3eedb4a83f7614f6cd86664754378efd2fb9a8406335df063d937
MD5 0ea43d1e9a2304806ebe4f1d7673bed4
SHA1 3701756331e0132abcc3bf4ae847ca421dc2620f
SHA512 99410b35675f04b3721aab781a6345d0c7549f0f7785912e12ddeb47eccc40a6b15ca0e4dc85f4254dc9762498ad14aec5277279aaf384f2bd02d942c7206e9b
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaif:NDqatgl9TKH
TLSH
T124155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 855KB
SHA256 39453f060e1f6a2ddea841fa21d4e8c506deb1670c21c62c084b5032e83c426d
MD5 60f1866336147652426313d482fa81a3
SHA1 399cc1bd189b4b9f8e0f41d8ab3bf1251c4cd7c4
SHA512 8b75a10b3cece28436eb585a5072a73a71cc46998d17b131c1a56786f4868cbbebaed0852df2b2ace293e67b1d6c59fcc252502b77678047030cc39a1306df27
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRa8o:NDqatgl9TK+
TLSH
T1ED155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 855KB
SHA256 165ad14dbae187e5ac68160c74283f670c71aeade389a04a9b9d78887c662315
MD5 9f3bd98fea93042d52b3863d4fb4aeba
SHA1 f1ec19b3960c6538cbb3d798a6494e685b520cf0
SHA512 2ef392bf8b6d6d7742e2a0f2fab88f0a299bf600fda11b67f7f9c956bf96b3565ea6281672cdcd678547332337c27fdffd5ca5ee50ed1a9d2f37d0a8a97be44d
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRacu:NDqatgl9TK4
TLSH
T1E1155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 855KB
SHA256 b03503ffab962fb45a91c2f7dcf7c7058e0d142cdb5a6413788053f42dd03e86
MD5 5fcb5e56623411055fb99e35308723b7
SHA1 8078ae0cce4d4d5e26f07f4b0a73b709c5bca043
SHA512 357898e67e288c14130ad50e3db406ad19b58b37cd6cc24b6b17f7c771db94c6268d2eeb24b0ced1eaf056e6fc16ae4f62f859725d358c4c919d93e0b8272c14
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRag9:NDqatgl9TKt
TLSH
T13D155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 855KB
SHA256 0c7dd4f78061d79a8ab6ddeb438e5cda78b5ea1b2488edad4d11e3e8a2e2ff05
MD5 727d0acdaf632591e1db1e457988de67
SHA1 c5dd728bb091b1a869f2552a53a1522c0ab0e2e0
SHA512 37962479d56fc1a875493d03968c1545cba18cb1ef153f45d264331bacb7445c398209600e6582611a5e30be0fc2a6e14aba93a7b96abe30b354b3464fbd3618
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaoc:NDqatgl9TKY
TLSH
T118155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 855KB
SHA256 e223e7d4eba6f7b89f209b8ee98f3dd8567e1ef6d15278fd96aaf21d3ff9a496
MD5 504fcc134c883c95a4d680361772b266
SHA1 a4367649f45c8aebd3acb089733daf6356c9373c
SHA512 64f8a72d0fc09410471ced3e99b8cc2211dc0544eabff82cf9adc1858cd3ba44ebb66aece83a79fa2e94706907c23af6fc78e97dc5d65a7035e88cef0fe20309
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaBp:NDqatgl9TKO
TLSH
T1B6155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 855KB
SHA256 5049bd6b4177f81ee0bbbec65602c4171a49637a7b80eeafc09633860e982e44
MD5 aac87ab966a1b8949e0a9c9e700d3a82
SHA1 3217348bb9b2ebb435a366270f4e8612f83b7ae6
SHA512 895ef426482b57825f5f0117aa99fb6996a5f3b5c594c139b85b6df8523b44c51bb5baf719aceef182cdb8f186bc14e7089ecff25581fc4af606e162959a4b97
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaWN:NDqatgl9TKh
TLSH
T19A155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 855KB
SHA256 b324ae3c958e440bb3d6b7a07dba4c306737a5ca72d0977a0a6dcdd874cc289e
MD5 3ba7acde77fe89a2960eb0c3ab633636
SHA1 098949612d5b9bbdcaf161915d42a6c35faa6613
SHA512 aa09d94bac0d8dac46316e2833aca0c32279503f0764000520e90f58d7c2b96269ec9a7c80fd66dffacee70313f5eb17ae1f183f113a28133fbd714f726fd488
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaaF:NDqatgl9TKz
TLSH
T1EE155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 855KB
SHA256 756bdf794548fda65c7c145e4d08e99e589a79cac75cc7a946ecbb15f7a3b2d8
MD5 122636c3c94f29ebfa99539d45755904
SHA1 1d943fa9d83f565663e317da3300e1ea74053b9c
SHA512 167f046578b9293f2460b4e4daa3a4d9111c9bc4750d82ff791f8870fd5b66117b31436cb1a96110a1890d2dd881dd967d8c3b76f6190e55f9fdc9b4e876c5bd
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRavC:NDqatgl9TKv
TLSH
T1A7155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 855KB
SHA256 e546a42c1098545470e2324727816c0c78949c11ce2b04a6c7d523aac2484bc9
MD5 6a89136b53b843bb347b9fc08f7b9598
SHA1 5da30c647a096964f8af57cd62cbf6c09520539f
SHA512 f58bcb09e26c9cd235a5f5aba7d06377222f3e9566c8fc591b88b739bb1a92323ba0f9dc0027b9df6334fd1828ffe369e56f8a658f97d017a0e2a72aebe4e79e
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaQw:NDqatgl9TKK
TLSH
T1ED155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 855KB
SHA256 b58832169514758b2c05a5e321f95232fbdf395fcfd9fa14b8eed121e787c823
MD5 cfa1f7a00aa9cd612ade26d042cff5b9
SHA1 c6845e5a009824596010198a0ee151a11a0c9e50
SHA512 416b0e9ac822155aff75214e11472a6c21a61ce4eae3fc7d4cdaee685e228741408e6ebfbe23e8fdac5da6f91c40b396fa1cb50a85b9aa3a2caa2faba891858f
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRavT:NDqatgl9TK6
TLSH
T140155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 855KB
SHA256 279521d3417c6be765be1ef1fde512f7caca9a1d595ed0fb6aa949b82d5409b4
MD5 61e8b1de81b2973961f121fb79cb7c4c
SHA1 764f95dc06f2697b7019403463b58b4505d3f037
SHA512 ca2fa4523c17183e90e1ceee2f11f89c241a398acca10b1724ee5c573497f96260897ac8bfaee28755ff7c573187fc164d6b2c555e2a97a4aa270fffbb77fa96
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRapu:NDqatgl9TK1
TLSH
T13A155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 855KB
SHA256 ee72abf7e06571e816d8e35be40245c9c51a06e97dafa13e803f3d11387eab99
MD5 eb0da3c52096668fc58b952e75ce2cd4
SHA1 6283cd813a61edc6ae8ade00be1e79a3cc569fea
SHA512 db707259396d14faeab674d5a60d0b6411e0be6239898d49e4e9c14190189c6d41481885ff10898cb98853c925f8c518b5729977f966c259693b4741401b7e9d
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRahb:NDqatgl9TKU
TLSH
T1A2155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 855KB
SHA256 f454cb9622e195cb15c56a7bc9f5bc7bafea39ddaad0e4b45cff1c6ee56992b8
MD5 e0ab25da9b3049fc0401b20cd26af835
SHA1 8d99e1d7e84754e5308073a4e37fd769df921733
SHA512 e98f9ff18779f67f279ba091be826c4ad0d824f4ae19c84f785b9320f1f12fecded6417f5ab84e27e6400ade5381e6cfd983c4c935c0f77a2f40105e1979ddcd
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRapf:NDqatgl9TKk
TLSH
T183155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 855KB
SHA256 e6aef01b90f0e96c50922cf635bb7909dc339ec6d2cc18e234331e79e833bab1
MD5 1decaf6fb483fe11eb382c1090bd6c58
SHA1 0143cdba25203fecaa71722779d6d9653d07cd14
SHA512 0f1a77d5209d01fa1dff5bb2795eef0dea5740c17be72d4481a0b791541cd9e6a312a9d4414bbdfda115615a20217580a68aaa17b864be1d56edd432129864fd
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaSK:NDqatgl9TKU
TLSH
T148155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 855KB
SHA256 65bc5eafe1272aa1e5947fa12dada3f62a1f11cf4d042a42c5a3c2e4e296b299
MD5 ebb19eafa066556ab8bc0b3704324626
SHA1 a2caae1813546888dc72f95c6f7e9d74d52eaf6e
SHA512 8c6e9603cbe2a94b45e9a6e8300a71fb3a2ba90b810a228e63721fa7ced513e045e21d185160d17374d5ae2198d24ede70cdd95e71e61aee2e7d97724b2b1ee4
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRa3k:NDqatgl9TKt
TLSH
T13D155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 855KB
SHA256 9e756fb1db064d7e2d2ae42522d2f9379042b1674476ffe2c84a7447675174d0
MD5 9b6c6c42f95e60af4dac2ae9c42afb3a
SHA1 7dd2751c9e6c3ccd1e6c96540103df4a9d0bec9a
SHA512 3aae040fbc6e99695cdd2e3c396489f572d0c2e0f1f3ab60b2d3ad197579de895432246a2c11decd8c9563a48170e0a9a8bf7bd859733039611f122f6872a4fe
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaA0:NDqatgl9TKQ
TLSH
T11A155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 855KB
SHA256 37453929e5e486c39a0c9e8c6c4c71d1b3071ecc6f8274133a324e33be209c4e
MD5 1a065fe24cdf3dbf2f8d36225afeaa05
SHA1 1ca3dee78848918e69515f54b487c705f874a5f6
SHA512 62a6cc05b726491f64e7f4da07164eb466687fafbd8c649c7f26ffa9c6c95af5450ac14d316a615af1d10c5f136f719d31ad324c74ab01e170fa65dddce76d95
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRabg:NDqatgl9TKl
TLSH
T115155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 855KB
SHA256 fb4795cb26169043159f02df4741b2112b0b6e611528c789550b75c6b5deb4a6
MD5 7f50f500134518b85fafb2aa0cb15a08
SHA1 9c988e6c88d0d68310012bfc515bf0a9439b84e4
SHA512 b2b37f8fe286280746350770a0fd6a05f6abbdc7d85246aed3bebafe09d2232f9979d3a37f349f6afa51430a00f72d34fcde8062ba5aa72ba93fd3fbd20820b8
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaWr:NDqatgl9TKn
TLSH
T162155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 855KB
SHA256 f55fab8e8c1f9882724d5735ee8e59adb6b7e3f15727479551ebe9b29dd688e8
MD5 5fa3a6b8c0d9f9df6dc9435a14d2dac1
SHA1 7d76ec74f68d9357b7fce0d7c5fd2280baed5b14
SHA512 91fad06bf148a867c920f73edc3319278000b175216ffebe824f55e22b777c2cb36bc09102e5fabdbd308990659ff7c8e1c389ed3ed176c62dafbac285ff9eb8
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRa8n:NDqatgl9TKR
TLSH
T1CE155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 855KB
SHA256 4564ad958211a5b2a6e18f3e0b9011bba8afa164262714ef144d3efd5dbf01a7
MD5 f963da06db08d02c7f79a0d96427b403
SHA1 2d6858ed3792b028f13ad9a5a73da8cf0253add0
SHA512 aa5c4849b35dcbc25b0687c1f4fa091d64f08ddcdb12f5d5e8300d906bf8556eae6f0dde1fcc52b46fd3c4d6591e269f7299a5b876d6382527c5ac40d05d96a5
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRa6x:NDqatgl9TKf
TLSH
T146155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 855KB
SHA256 2ec9f4a688d24eff74b6ddb8170b24ee5ef1f7d190d1be566d9eebd32d3d5fc4
MD5 e85620bcfec3aa3a46d9928d4930c295
SHA1 d179e5e8b0d3f8aaf5ccd44fc46b002f87a93eaa
SHA512 5b4f48e46146ce0ed6e6f3e3fd50deb7d3c4e658116b90665ec9e9b719f429ecc74751c546afbcb4a7878d6b89fbd2af62c5c49dc6545bc147143eebb1c88526
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRa8A:NDqatgl9TKg
TLSH
T1A6155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 855KB
SHA256 408fce05b0e09df4cfb7b0920f4cff857196c11b8fa0862fed9d6c4f54c63e4c
MD5 e9340ca3e802defb53419738ef061903
SHA1 8911b74b67a2feecb0d23ce8667525b717e4ac37
SHA512 0a3aea74cb9037e67e1a9c7cff95c2c20c1e41a7ff2f7820a2eb46df5e768b41065e3fb4b33241d1cf659090c741ed5172246ec14ff13f97f7deb13fad6e3c7c
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRal9Q:NDqatgl9TKZ
TLSH
T138155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 855KB
SHA256 afb7d4c1262c72818c86e08e0a2e8f82e59207337ee45ffcb0f0cc46c8c66b6b
MD5 275cbf55783bd9ae62a099f63e839c92
SHA1 4295af5af3cba8222825386c357e63324e116e66
SHA512 5812e05a38d555d7e4564d39aa150960c8575064e496e8b445e10d0e00abe29a94e3e92ff907b4e90dbc5568021346c414e0382489fc6e49765ce9a5e3803c49
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaQ4:NDqatgl9TKO
TLSH
T1B5155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 855KB
SHA256 9a8290d976d1db38344d4d267fa0f371e84ff29dca2d7f20842361af1831acfb
MD5 a78713a15870715a6d76461774f7e7fd
SHA1 bf510148484f2fb6d28148451d9dbe18fdd3f4c1
SHA512 ff2a54859dff0edbd3744f080e92449ed6c7834a1f3a8cd15ef1b534fa1f0c64d4d86e075f9f23d2cc0bfaec16fee65d89564711309f5e1d91541f0734c1ba7f
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaTu:NDqatgl9TKv
TLSH
T19E155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 855KB
SHA256 bb22506ec4b7a0563c9deec003fbc7faad950137cc7e7779b532d137d2c12fd5
MD5 89a330d1e21c29cc6768bfd92a0f31b8
SHA1 38ece0a094ef6485ba479d560e125c204730ae64
SHA512 e74854bdc933414186f1ed6ba801f5021ab0410454a31afa9d7d5ed8ef876a27186c9ba53dabda9b76539be8c1ab19e28cdc2cf9c82d5ff35abb82adb2a4d5ac
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaOj:NDqatgl9TKx
TLSH
T1B1155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 855KB
SHA256 735b5258152924da0eb4be85a8394da227ee135a822bd3effb59d46a02aa21bf
MD5 ab655ff52b8da3b6f70fddd8076c21e1
SHA1 6964419633334eaac9b26031994d6b4f3e7e61f0
SHA512 f6ace6b778466e0f8a49cafec681c6118ee9d1b35f4f944a317afcea4bfcc1bbe3cf35f106f07608290da942bbbd2568165495efcf46e20e482e9646709786aa
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRa7g:NDqatgl9TK1
TLSH
T1CC155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 855KB
SHA256 b68c770322560ef25f844abe361464817995287b98c8514063327d03abd8f7d9
MD5 32e6ceed6d7efd81b673f6c1eec8a3e1
SHA1 968828762e320bc27647cbfca89658de2b442c9c
SHA512 cf1e6c1e01336fb442eeb7129610edbac0e37ba04c74e146991d0bd7b039e0f8d2a29f33d11fbf6fb9458c5bf999f645bfea042cad0501ed8d1f29494dbdddf8
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRamI:NDqatgl9TK8
TLSH
T1B9155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 855KB
SHA256 31f8c5db6988bc70da7af77b7b184335c168c535e9f05bf1b3eaa54df1c87f1a
MD5 c65613ec9192d4ee86aff960d1716d53
SHA1 5c842d8af632cb466909454a44a44fff1f28860c
SHA512 60ca595249da6d9cf89bf1a6eaca7e016d13a3f4248a637a7b2b033a3fe425a78aee3739981aa8a560c11857430c0a3ca6f8def8d2f2f7bee9fd3d7c37fa5473
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaUo:NDqatgl9TK+
TLSH
T165155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 855KB
SHA256 7f4dfdb3debd6d2981e5273293c75241c7fe855860977c9ec0bb87226e9d4ff5
MD5 c9d5c11f192774f2b3e700d2eed4fcf3
SHA1 2b200696fc02e57b015a310a26dbec4b7894a0d2
SHA512 2d6b83180af848a9fe026dd23fe9d454b19dd17ca8c8ca3c34fd70978600fdc85d107ca73d718340b63ebe2df17549514073ef2ff77171206b5d53aa15d3799f
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRa3+:NDqatgl9TKr
TLSH
T1CC155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 855KB
SHA256 a88e89b7697d1fcbab2b773a980aee68aacf567b6ceec8587ed2f1b77bdca7d0
MD5 df59508c919fc8384c42007ed598c91a
SHA1 f704c790bff6bbb4edd53f694b871e7894940b82
SHA512 9f5f83ae923b1be5e3495c49ea6d0eae8775e1bf532946390ba10063c402750499e4e1df8314dd7252c5717adae3c6f5f140f5df0d775a80119805e5871f9b90
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaNQ:NDqatgl9TKv
TLSH
T13A155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 855KB
SHA256 6dd474f8469430a6815fed35cff0974f2d6c3143cac8ede64a70812103b1e147
MD5 2690164c445e384e3e1555b8411ab744
SHA1 446b83946fd459ab9b8dbf424d975c7bfb485cb2
SHA512 7863134535e923149a4ba78f5e78a9b5e120c1588143952c2f45db83fcafa4888d9ef159d905fd92cfd9ca5224a028ff3d1201c0dd5f3afe1fe08ef785a40a85
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaCX:NDqatgl9TKj
TLSH
T164155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 855KB
SHA256 cc32b72a7cd7b6522ddb2c5912d9f5da27af4c4dc40ce307662b3e6e54bb74ea
MD5 00624e1774110d98b949d88522c0cb1b
SHA1 589fffcd6a62c21936553ee8afb8686e0ff00447
SHA512 084c9d74f8067be9c837290b9194230229fdf0d57c9c58d5de45fe0cbadf0881731d7462dabacabf153f32b9b40a1f76e79d7ffa0f2d0a83b40ab6dac8720260
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRakL:NDqatgl9TKt
TLSH
T196155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 855KB
SHA256 35019fd4cd630cc65adc39b120fac5894bdfc07f8de2c254a87c68e96f6f2c8c
MD5 a820b9431a462268d4395ccc0939182a
SHA1 a014272b5b4462d6a1a0560bd4e67fc61999564a
SHA512 6913b1d9dec967192ccc5bcbd00c827a58d8803528484cab8e7583c58809163cd310bf67c8dde6a2ef9601a2bd325c2ff26d9f8f8545e88d76de439009cf9f64
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRaAM:NDqatgl9TKU
TLSH
T10E155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 855KB
SHA256 21b3b6598ad493c3ed0b77e4d8863bf886c1752c5c49b2c7df9bb37e31fa2317
MD5 a2d2cc0b6c4a3f5558bfee9efe29130c
SHA1 1c5f2a7fb0d1a9cda69993f514fe45724b48dcba
SHA512 0b12b70acbb84460161ec639dec4973be8e0542c48ea95b91876a047616c301ae28607171418985fa1696485c6295bb1a00b13e261d2d38b5a33d7fce7a34c15
SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaoFRahh:NDqatgl9TKO
TLSH
T1B2155B53BA4485A2D416023054EB4653EB71F81A1F11978F23BCAB6D1F327F0BB3A769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3448-2004-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4912-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4912-1985-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads