717d8d44f8748e4c2323f68e325e33611dbd581b0e6a42a2917b6c699fab6b82

Analysis

max time kernel
124s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260715-cz5tlacy21
SHA256 717d8d44f8748e4c2323f68e325e33611dbd581b0e6a42a2917b6c699fab6b82
MD5 866002545b05ab0a21ec56ca2f02bd34
SHA1 8c7a037a9d96805bc727447857ed3d3a0b369292
SHA512 e1c882ad1d74b58e551648f434ee1889f5711d4e5e19f5fa75f5df8bf874647b967b9d0b6b0b271124d53c8d087f9a2daeb4a89561bf3e9768289b5e5922aa9c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclc:A3k03kB56rv
TLSH
T1B9157B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/2356-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4a1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2bc-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2356-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3264-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2de-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001896e-202.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a48-209.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001983a-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c7-229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a4a-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-281.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-414.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-481.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-506.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-597.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d3-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-654.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-734.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-753.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-796.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-803.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-944.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-963.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1018.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1055.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1074.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1130.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1188.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1196.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1257.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1336.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1355.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0008000000018903-1493.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c4a1-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2bc-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2de-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001896e-202.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a48-209.dat	aspack_v212_v242
behavioral2/files/0x000400000001983a-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c7-229.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a4a-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-281.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-414.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-481.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-506.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-597.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d3-628.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-654.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-734.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-753.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-796.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-803.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-944.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-963.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1018.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1055.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1074.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1099.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1130.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1188.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1196.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1257.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1336.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1355.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1380.dat	aspack_v212_v242
behavioral2/files/0x0008000000018903-1493.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3264	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2356	2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3264	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_866002545b05ab0a21ec56ca2f02bd34_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2356

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 717d8d44f8748e4c2323f68e325e33611dbd581b0e6a42a2917b6c699fab6b82
MD5 866002545b05ab0a21ec56ca2f02bd34
SHA1 8c7a037a9d96805bc727447857ed3d3a0b369292
SHA512 e1c882ad1d74b58e551648f434ee1889f5711d4e5e19f5fa75f5df8bf874647b967b9d0b6b0b271124d53c8d087f9a2daeb4a89561bf3e9768289b5e5922aa9c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclc:A3k03kB56rv
TLSH
T1B9157B03E6940FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AcroRd32Info.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
Size 968KB
SHA256 79a9457e5dcfcc78d1f2d5fe244793b612b2d5f9852b25ccb75db75daf35cbe3
MD5 11e42a32379c06578df8c09df3c3c3e0
SHA1 e1c4f8f8b21a57cf9a9cc133c7aa91ab99822e6f
SHA512 d670fe384f4360b69a3877b0c189c46f7992455eac0921268430b08bfaefd95cee802f710f41cab60a53321d4efcf912e4e2b42992fb4f6b4d8053caa7dee0cf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclGP:A3k03kB56rp
TLSH
T1A2257C03E6940FA5D10F81749AA58662EA777C125F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 7cbfb680d24b8ca4289a0e6f55d7eb2701973e08398ccd44643c59a640a7c1f7
MD5 eeb2887efe40b3ab573cec10751dc019
SHA1 fe5d5dccb29e3d3490635682f1177fe2b5110b48
SHA512 5536aa997f90b723f36f806035aefc6a8ca6a9a4a56752e5361301317afcd243138ebc88eea89b905baf25e1de6456288be5d8949fc85208e8c44dee59a4b615
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclk0Le5ji0hmxNrM:A3k03kB56rbPji0Aj
TLSH
T13D655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 953KB
SHA256 c5cb579fd2112e6b6d8dc4f2eecf9883719b8326c3b93a98c34b2bd3fca38482
MD5 680f969b086b987b50cf4d62a94d7528
SHA1 0d16557e0c30ad36207f47fda0b36ce1aa80957a
SHA512 3c5185f411cde2b6b64e55a53fa2f2365772d01d481a065a66045b156e1a5def67764ebd2492ba3650807a506135882f715760b68a9ffaee38c32e4481b89afe
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclOa:A3k03kB56r
TLSH
T1E9257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 962KB
SHA256 8873a6c89eb5982142808ff702f3ca3bf90902272428286ff702839a0e9da668
MD5 f8722f96090f016cefc653e19bcc8482
SHA1 ace4b755736bff7e13068cd575f62ca47578e3e7
SHA512 be05ed1b86deeeb9c671a080fa997a41dce5c2c1ad50cadb384c50f432350a748835bbc698f4eaca997865730ef46f7dec7572def277174ced659f91a252dd69
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclQZ:A3k03kB56rf
TLSH
T14A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 962KB
SHA256 62d513d9eeb661c326f68d3a816d9f5c92f23ef5c589bdd089c13340d2349700
MD5 97bf95ea3a29846cc5d3a780597a243d
SHA1 6c432da01b8ffba1ead98accb171e41e4c71fd45
SHA512 e236ad0067434312a44ceb60cf6462b7c271e1412ef10f2116e7006e4098408af748afd07cfc0a802d52cd37f83987048ace6c483308fc89563a156def9cd16e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOacl31:A3k03kB56rY
TLSH
T13B258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 962KB
SHA256 cde7ec5e90aa6c45cc6b7e631094e99bd574c5ec28dfa9d22f0dbb0afb809f17
MD5 60b253f29cf00e961c7799d415ae2c24
SHA1 f1c072698e7d2ce31d2acacb8d7c9621b3f1dd02
SHA512 66be19b7c20d2f006a3ca37e0fc98976de51c4bac7ae31f114205f38e8a65d7174237a247df3c46c69626ab591d51170736942563be94a50e373f9107f9c3370
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclv6:A3k03kB56rj
TLSH
T120258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 962KB
SHA256 426e86b2146af6557fc636b614ec29e85855dba1b480042def6070f73cc48d46
MD5 de7a37742f04c8094cec3d2342ae787b
SHA1 0eadc3fa642f05d6afc5f8b1b43a9a57c5cc5edb
SHA512 dae116df66f2562bd1db8dc0ae5633c508746d50701effc50ebf59ac7e754972faafa609cfdcdb1b46c40fbba6252743b151a0992f3322b8ef2f66740687314f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclxN:A3k03kB56re
TLSH
T18C258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 962KB
SHA256 af973b2c7b81e964e4333b974bfe611f1b4f205686baaa24f9a7609585c8edae
MD5 40471b5b66902cf29c50ace5ea8b2b70
SHA1 7764f9703ac3cf4d9213b23f30a75d42193f69f8
SHA512 3937a8e1e1da4090bb42156fbc5fc816dfe93c3e33e38e1a578a12627350ab8682effda4a328f3786044a3be111c12bd432652ed75784650a84d68b24ca5c8a3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclnf:A3k03kB56ry
TLSH
T1AF258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 962KB
SHA256 a539ef6a6e3f3642e5c61832937a0121434afd3c0aae3e024f26d407cf311b65
MD5 5324f6a15fece3a57c8ea2986e9a59c5
SHA1 b4f21fdac146254368646af503781206e8da92cc
SHA512 86f6017a3163f299a22b9ad379d9bc4eb1654dada8390497d9850b0278a9964492cb4f375d61e28f4b91c31ee0efbc4d78de434934fabd0464b8242006cc945a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOacl/9:A3k03kB56rI
TLSH
T176258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 962KB
SHA256 24ba084521fb32dc32c2803a469797bdd35527018af726cc38e4c885c9701b33
MD5 16e83229956c992c4f947d76bd7fdcd0
SHA1 950baa3573591242ac7b543f8bed045b75ffa584
SHA512 a25e63c852ea30ee38b138116738087ea66c552d3ec892fc177b2a98ae442dfd6255094f55e58d7b84b6885349f7b855194102f0ff75888db16178081f94aa92
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclbc:A3k03kB56rJ
TLSH
T1E1258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 962KB
SHA256 9144c4a1ec542118ce60c4a2f621f59e7dea912d03fb9cb336becd18ec7c1aaf
MD5 b1be9c9d4caee219d0fa7cae52054348
SHA1 f1c251ccceaf4ab8cf463e02a2a12ee6a91fa3cf
SHA512 8a8b4c1daf3f5fbfcf4cfb04a5511d84b143cf46a080228f63d91b6203d77611c015863dddad788ec4a8680e3319f0a4e51ff7463ca854c2992347a91f43b2d0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclEp:A3k03kB56rn
TLSH
T1FD258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 962KB
SHA256 e8b58a84da9fb7cf9dc3ae814d4488584c2c697034bab5456df337588a898c64
MD5 885247d05dc327ac511ff95c408f8d90
SHA1 7131ac5945ea0902f0b75e881d1146f0f986b4f7
SHA512 8c4344bc92a2cccf07c683c84f363c8f5fd473ae2bc7026239d0320e9c5587f9cd1cb0a22f0e9fc8834d5f4eaed978ef9ebf710aab36ca16d8f4cb750584596c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclLN:A3k03kB56rs
TLSH
T14A258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 962KB
SHA256 a74be89d1cdc07bb0e01331692d9ec2d5b9767f49143f70a984bca2b53a42797
MD5 d51725df974b4e4fb27c7a8a403690b6
SHA1 d8d9f078f365bb25b4722a6d06f1b6463e064b49
SHA512 195460d210e386fdbcb9d33e8bf07242777b1e385867eaa35e1cb9b39bc8a39713b2397d34e01b16a94eafe5b7e1c4eb834c38d92d17e5c6059050964fb7e204
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclZF:A3k03kB56r6
TLSH
T103258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 962KB
SHA256 448331fb9e6a2b11fc9aa862d36e63e17421dec1c29af02e5427b0bf68f5f27b
MD5 dec14c52b21215d57f543984e88b65f5
SHA1 9fda0be7577022a69cd0dea6375cb3bd83d7930d
SHA512 a4af49b086c08d192daa6c9dd4e7af4460bd660645862ce0452a05070ca9060972ab06fde757875d55e08cc7a4e72cc2400c4c3a29c3f30406bc6e11e9ea63c8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclyC:A3k03kB56rO
TLSH
T1D6257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 962KB
SHA256 fb0fbf695fc377b2e7a0d53a61aa3713b79ff1d0a805aefa7fdf1145682a7eb5
MD5 e6563dfb1b5acfa890068f4072a187ae
SHA1 66734f9a6be932515bfe615fc8fd2277f0929c36
SHA512 6647169a4f309c8cdfa7c25da6512f16a57175077f90a0c907eda72bea20eec9089c2441b228f717c5bf16bfa25771e8409817829cb834d036c1fa197dca3131
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOacltw:A3k03kB56rb
TLSH
T1E2257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 962KB
SHA256 a114bcf9350d152e838e769692427501da2eab4f21af4ff49ab03e8ecdc38586
MD5 9233fe4b7753273d6d6dda8a3c3d666f
SHA1 76291acd2295204220558a70bbbebc20c046eec5
SHA512 260d7a700b4325ac08191bbb472004bb41fe264b7b2890de8c26c0cf935494d1069bb2d38151b9a7ccb2eedb7a7acbe9a35f821d862c371984e35fe9c2d96904
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclcT:A3k03kB56rH
TLSH
T1A4258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 962KB
SHA256 ea2189228eece11d9f6fd1118e7560726a9f64a1cd28a09868d07d0aacf9da4e
MD5 923c9bfb3c10ed6bf34e2ae53dda1c67
SHA1 23ad1525c370a42c009b25d8c10d7d6ecb082021
SHA512 a674167cc5f3637f0b714fb255b0bf27c01da0c0ebe60583a4ec543965bac1e57b5c5ed8ebb0e9251eab3ad8a5ff95dea42d13c17d9ab034d0ba0306825a3325
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclwu:A3k03kB56rI
TLSH
T18B258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 962KB
SHA256 74e9ee255594843206daa78ebd72f47646597c0c242d590264d4a540aa412d97
MD5 cbdee21a3715575004890299ec327664
SHA1 17a61ec5b92d64b84237b2d712e3ebea7621106f
SHA512 0068f8360262365988c0b075f507d28c0add9381f012e6642b79a1c8dcbbd392cde98e5c2e6407be0497c1f000ca33b67d241f0c902b134a2818a3ba2138731f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclOb:A3k03kB56rx
TLSH
T1E5257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 962KB
SHA256 c048a83ffb47d843872bc9b8f0144e25ac5102d0b095a9bacd99d4e3e518dfcc
MD5 2c35c8f205cb2183942a008b88325ce0
SHA1 3d317667eb2cc48ff58a7778ae19b32d184c5480
SHA512 03c70d8aa2119af14b7fadfb199077c7861f04463595975507f84b0488f08c17de7b8a7a23d8955d1c7c68fb8d4c6154ae18e5aee032d92a7c4c6dc050295cc9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOacl4f:A3k03kB56rx
TLSH
T17A258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 962KB
SHA256 aa6328b9ab54c2a9dd2442d513ba9819519955a838aa9ad01abcbf6f6801fa83
MD5 9acad1701fd72149a5a55aba31a0fe43
SHA1 a408b3c0a665dde7deebac610c930c205be43e15
SHA512 331d86cb5a3c65bbe5d5f5dcc9fd1fe60ac9a2cf3369f5db8d8cd319ac3a3b96d4a06c0fa7f54c92b961df633ff8601b8e28c3d1b6b2a1b427cb00398e9e380c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOacl1K:A3k03kB56rJ
TLSH
T182258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 962KB
SHA256 7d05ceac2d1abcc12d1c5799a95b555de49c389d5a8b61f6bd8ada5a5552d0c3
MD5 d081b7b426c777a395c5d2295ff3ebb5
SHA1 e8ba989d17a14af2949dd1d7f418884f5e266a48
SHA512 fa10709604ce1183ebb568016d5a56ad0db99ac192b3db94c420ab6619b55b00fad720081ba107db9ac4f3b2930877a230893a30ba272fe00c3ebbe4e6e46dc6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOacl2k:A3k03kB56rA
TLSH
T14D258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 962KB
SHA256 4a4758e8494dbadc0534feedc4e1c24fa3709b532ce5df078663cc7c98a9b2be
MD5 2d1dd4ee08a174e9602486469699ce0c
SHA1 1251f2f9f62572266e9e5bc86d29936e0ad838fc
SHA512 b9b94c83a492771c77645b9de576d3ab205fe2476bf23eb17de5bc3a8bc4678902adbdacc166733c1e9d3ca22ba032e6b6f180676180a9e63e8763f3623f24ce
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclT0:A3k03kB56rJ
TLSH
T1DD258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 962KB
SHA256 cd4b661d950fae530943cde3c218607753a6c3b3c0ba48eede4f13a12ce10eef
MD5 66fdc25a209865fb4d02223e76e2957c
SHA1 df65ef48fb92e373cf315829f491fe91245787fd
SHA512 7522cf7183f04589321e446b42c8fca59b526b8d23f39081abb259233599d73cf795d6a3a81f26056c55eeba99d94fdf5d03038c0536a822d579e73f16385267
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclig:A3k03kB56rY
TLSH
T14C258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 962KB
SHA256 a6a686cdfd81469d365c862f6f6782f2f51b34d2de4cccd4e2441e119129ebb3
MD5 7ae72b575dc4ce24261effdc26dac34e
SHA1 9ca47c8566084908f5c81dccb1144c768d6d52d7
SHA512 87f9cfdf7a9257a52d24cb7d7b03d668c037ee20d29cbe3ad36fa9cc6c3b1e82091709a5be5f413f143b8b24dba382c8b7550d660a8d68fa986ebbac827b62e7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclDr:A3k03kB56rC
TLSH
T1EF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 962KB
SHA256 4fc78444ca94488a2a20f54253b8139d46500c47ed4b62c679657a509b03c595
MD5 c06a72cdaa020d61636f4f8d9334703e
SHA1 ad62aefd9bcaf4860b086304ed30e0bb8bcf5aa6
SHA512 84f39b431d8b1d7979967629fd831a1c483d7bef81f7a9a211274e4130598ad5527d007e8776bc7be53d37c2ea30cc885bf5f012768a83b5efdd6f9d324ce55b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclln:A3k03kB56rU
TLSH
T1BC257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 962KB
SHA256 e041ba177f7c28d276517588eef06a7981f3c8e10ab7f6c95164fe02a9cd479b
MD5 1d76d9b734de4169fda31081319d862a
SHA1 c4b1470007d356ce9ceb0df7e1f3501819305d29
SHA512 f030467dc026375061915b9ee5f6cb0d6654a8a90b4cecbab6dbc92e82989ee3b8b885541b491452c49f9270f376e2048042571bf9a262a26df9a3c59899df81
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclRx:A3k03kB56rS
TLSH
T189258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 962KB
SHA256 0106e3b1574e3629c573ad555426d5d991760ba2fd377e1e718fcedfed2a41dd
MD5 7f34d5fd5c78a07a20bb71e669b104e9
SHA1 7733401efab9283da95c620a98aa6d3f84da890c
SHA512 753ca397370682af77a1abba23232fb89a7d4565fa113ea284afe1ea58012698fd1cb1a5aef9d80a941e0a2babe44ff2b4d795257dca73a403929a6c26bc7839
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOacl/A:A3k03kB56rx
TLSH
T175257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 962KB
SHA256 5fefe24954416073a626787ab294dc1da8528fcf5e60e3840403c94056115ddf
MD5 7381022ddd9d6f6c0b00d226d544c52c
SHA1 9f94a20b173bb85e985b6a651a5537fef2aa9625
SHA512 3e9236cc24663a9753f30f8c56ca0a3460300a155748a878613d50f07235da5cb476d0cb3854cd1ada887b5210c89dd65b8a2cfe7a787013941063298a48a677
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclQ9Q:A3k03kB56rI
TLSH
T171257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 962KB
SHA256 b35f36df739dbe568ada6626ecc23df4b0bc34ca7ea83334e380c6c2baf28f8c
MD5 6df740d4daf8052ec93894e764bd5850
SHA1 4619eeb3ed4eaedc90d6fe8095b2fc5858677677
SHA512 c47fd9efcb4a15c695bb795f6b741bb056dc1105872cfa357938fcc657923adbebe208bafb7e29bec825dd25ddc001c88b758907dac8e841d963500b3d7523ee
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclx4:A3k03kB56rz
TLSH
T11C258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 962KB
SHA256 c324d7cde32ee13f0f804e6c7c50156bdc2f82f9202f7d5e5d980b7188300c08
MD5 6f0339a8a41021723e6854ac4a68bd2b
SHA1 0fb3be3211955e3b9481159d38108845a4ed6f68
SHA512 51b543aaa553fe632dc36a478a95031cec5ab25d57e25dd33d69c0308dbd9b8efa13952b98c2db6a20159a90ea39306924b8c1c6d5207683269cef5fc68dbd83
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOacl0u:A3k03kB56rW
TLSH
T1A5257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 962KB
SHA256 29541966912d0cb84329d750045340fb825d567228dcfa6dfceb30345b4ffc97
MD5 89ae8546025b5dd5b1a9c5303c0e3069
SHA1 67afcbd7b6f8361477c0256784c70832d13f383c
SHA512 578b00c9e78c1bce25ceb7ecb66171675b6f9172725e421f0a6b748d0b689ee3984f5ebfad656a09c4509879fd10ce6c72cb4247ec74c2bd0db93dd631110046
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclFj:A3k03kB56ro
TLSH
T139258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 962KB
SHA256 06876d8bd1c740d37a7fef7b1cf1271733fff02ea268f71adf343464c488b400
MD5 4b44c07798f1b4ea295eadde23b90916
SHA1 d3c9993f71124ddcf9aa13a09d3b7c1bdf561de8
SHA512 1e06408d8654e8ac8bd673c06ed60e0c2c3bed8b91c1aca7663fe4b2839712631ef60eb5dc2d1b48ea8d83a9e41a9de1986f0438162ad785e417f70a2c5a6f5d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclMg:A3k03kB56rw
TLSH
T12E258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 962KB
SHA256 3594d4bbab3cd286ad424d2635b9d629a2105344ee66041965b05c788ddf5adf
MD5 2c474afc4033a90c7941e24bc0c57448
SHA1 bfa82bd313797ce72907df4af42e652f639f53a3
SHA512 0812e41516440b7ff8267980d198790e54b63e4a2655487fa4c83665f1d711a7f34ff5f3943d8f39f1c317c294c968d5a3fc8acdac72c7f995c7ef20d3edecd3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclTI:A3k03kB56rR
TLSH
T1BA257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 962KB
SHA256 398d3d3bbdcc1b4b321f0c043411b136348b4b803c57430e401892b0614c1031
MD5 424a32774ebcf7f21c121598bd038533
SHA1 0375e9b5a01c9b5387766b374a5c2f0350635e47
SHA512 ad51241b4d6b8ba223bb311449401e843711a16c19b6191b8b5894df4cedae1e17238da1af99ae2398530417a1348768d02ab928c5d4c5e1432ed40826db7027
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclpo:A3k03kB56rv
TLSH
T1BC257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 962KB
SHA256 c8b901d2d3ffe578f28eed8472f95b7ea566d8895b4256a70a449878e0f3db7f
MD5 7540ca722db45071c5693577e28011ce
SHA1 fdea7b90981470d862363b89988e5c07c007cea7
SHA512 8f542d38de9e3890e7c53aabef27eb2c053af2a847b988595f72e4b1072c1f654194900383ac1d2292535b0296ad5e84ea30830966e99620d198da5ea417a74b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOacla+:A3k03kB56ra
TLSH
T1F2258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 962KB
SHA256 e2b3c04bd29ad48f20062adc47e77f56c5392d6eb4c101a1a0e3ea400cab7117
MD5 64f08a47c7146683106da7f96758dee9
SHA1 4a0918c67791829197005487855077b5546ab26d
SHA512 e72b48deec74a782a1c4b7306f8d00679d58987e01d6481c4d5976f9af42ab6e8d435f3273947eaff615fed0f1736e03265e4beba9b216cdbf2307578b20f742
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclaQ:A3k03kB56re
TLSH
T16A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 962KB
SHA256 f5d279123edd82ba15acbfca4a6fca104af66dd4f5fc06ca454adb395af76d6a
MD5 921a34d691d23dabbd03ae12ccf0862a
SHA1 f63a79e1e053c0c66fcf49559cd96952df42d44d
SHA512 2351f6e63d6eb71487922df2c43fc4594150dd8c0a0d31f8881099030e6fdac2adedfd7cf6755a52172f2266c381d537bcbfae657d6db45f3c3d6b5045147e46
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclrX:A3k03kB56r+
TLSH
T1AF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 962KB
SHA256 cfb91c023f384bf0f3e23fe39dcad9a0363f64ffb79005a64674818157b16db0
MD5 a711a14e41bfbcabea64670764d1d11c
SHA1 ece423c0c3c4db788afd3f8cd54d49ceac86627f
SHA512 8c73a0251fc50219220f05225fbc5f47f69d608c21e34f5053c0c6ce95b47d56c9e1141a6785c6ddac4a336ed30e36189bd7fa963225762cc4f82ee7a5f6d569
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOacl5L:A3k03kB56rQ
TLSH
T1A0258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 962KB
SHA256 a13e3660e61c280ce33eec67c42ac60462ee85c3b6eb45dde0c3b7b1849f2663
MD5 5ded9d1c89fc42eefcc4764ecc9846ce
SHA1 65ac066d9f75152ae1e3417c7d91ecad3056d772
SHA512 ba38dc6319acc139c8b39d5bf24c34e3d973e3c1e278a258725ebf4f721ba3843fbc718e028c6c2a0fe5009ae90e6027fba59681afd0fe554a23f447a00e968a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclnM:A3k03kB56rB
TLSH
T193258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 962KB
SHA256 16263cece2bd21f1789851cc1a876789a596610606ae163544eb0bf4181fa569
MD5 9d0b304ad4ebe0d95260739b2c20050f
SHA1 1779592e5e0560c1ec99b011f26055d699cd9c06
SHA512 18c1b4faab4026d2121b1aecfe09e400a8b4ac3a93a011616c5d06c63867e1c6977fe8c81024a8456cf22cd3a96cff5b059741e06bf59757f964fe211c69ca34
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrE+oOaclQh:A3k03kB56rT
TLSH
T13A258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2356-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3264-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads