9a1eaf7692b80a9657ee9ea433e6d564baf3793f357144afa17fefef1d53d48a

Analysis

max time kernel
103s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 925KB
Sample260715-grrdfscy9n
SHA256 9a1eaf7692b80a9657ee9ea433e6d564baf3793f357144afa17fefef1d53d48a
MD5 f4782666d5b4b4e7630cb646b71b2ef5
SHA1 0cf25134b7eaf96147990992f2d2ab444d3c3282
SHA512 66e69720d003e31297c17884945e6b7f20898ec55922436e77428eefb8eea8d3364fb190fea627bb18df87fde9e3c651f00ff65ecbc6275f8c069b1d5eb3f83b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKag9:t/sCv7rTiw2RYwZCUsjKplpKag9
TLSH
T1F2153A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/1280-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c579-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1280-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2648-22-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c9e-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-568.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-611.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-642.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-764.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-795.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-910.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c579-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c9e-60.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-226.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-444.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-494.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-568.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-611.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-642.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-764.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-795.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-844.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-910.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1003.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1046.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1083.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1132.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1151.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1176.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1184.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1222.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1331.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1350.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1375.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1382.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1403.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2648	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1280	2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2648	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_f4782666d5b4b4e7630cb646b71b2ef5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1280

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 925KB
SHA256 9a1eaf7692b80a9657ee9ea433e6d564baf3793f357144afa17fefef1d53d48a
MD5 f4782666d5b4b4e7630cb646b71b2ef5
SHA1 0cf25134b7eaf96147990992f2d2ab444d3c3282
SHA512 66e69720d003e31297c17884945e6b7f20898ec55922436e77428eefb8eea8d3364fb190fea627bb18df87fde9e3c651f00ff65ecbc6275f8c069b1d5eb3f83b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKag9:t/sCv7rTiw2RYwZCUsjKplpKag9
TLSH
T1F2153A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 5b4abd66e83ddaf24ec7bcddfe8648c34ccdd1bb2eb951eb04ce87c6055d8886
MD5 b6d75ac2b0efb393b76d39930bd8b800
SHA1 c450c3e6cdcbaffa11414beb7d4c9c875f5070ca
SHA512 eee3d6bcf09d2a8204b417996ef05709c475e5db778529b8ec60f0d1885bcbac4d683efc52cbcb54b17f7cf5907ea1f8cef67fdb929cd9f4deef27042e235183
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpKagJ0Le5ji0hmxNrM:x7iw2KPji0Aj
TLSH
T188653A17B6A84661E073D174C5E6864AEA72B4461B3087CF12A8C73C2F63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 940KB
SHA256 3c224d603e034c130a30b71f27f8dcfa161f721b0656b0f93d2d0be2418e41dc
MD5 8283161fc6c99e1feb07f4bab025b1bb
SHA1 498eb3ea0254a822226db7c1c3ebd70b8e596ca8
SHA512 9d6c9fd1df3dc06aec5b38a6d74a2824b75f1fdecd3e053ec532948287c92909028277f375deadfdfbfc64294798880c01fa980cb263277e14d3596c8c4d1285
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagba:t/sCv7rTiw2RYwZCUsjKplpKagba
TLSH
T141252A1766EC4895E566613089B94606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 973KB
SHA256 0f0a0aeb2c0e9562bfc031bb12254a4bc579e08c0743f23bcb14a29c43042d37
MD5 a38e846ab582f6e07da4f35ecedecc38
SHA1 f1a6ef5f435cda7387720011e578707bad58010b
SHA512 5e07bebe1b383f85124fd07a9c6201ded9708a88709e3de09b18ed71ed25d3e0cc607f0f9153cd6ec947deea4b5bfef8947ee686a3608162b4223ac15cbf9ac2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKag4b:t/sCv7rTiw2RYwZCUsjKplpKag4b
TLSH
T1EA253A1767EC4895E5A6613089B54606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 949KB
SHA256 8470fd7b0447d67a2f930275e18a6eccc3717aa5099694862b4adda7aed2eeba
MD5 3719a48a77877362964185abb4466824
SHA1 406beab199b61655faabe178e65fa2c867da4c46
SHA512 dd20da2126ffd985adc339d5621e45a31c1b7053a98ee0991a4e0dced09f510703955d3a1bf2366c47a419cc1bde75faa1596e76963f6d4460f275d63404b785
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKag66:t/sCv7rTiw2RYwZCUsjKplpKag66
TLSH
T1C8253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 949KB
SHA256 b9474991a4d0e2f89a4889a4d86ab2501eccc0a880cc25eb36c940ef1e73e932
MD5 2f505ca066b4ef61c162eadbc7d9f78d
SHA1 c4bba68e9277767b63db566537bcc562f8bf7d73
SHA512 5350c5fddc37adac82bea84d86de06b7cd94b7b0930b5e91ea7d366aef3fa780305ed393a561dc40670d14f1467cc1e627c604b33086e6a0f47742b915cd2120
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagyN:t/sCv7rTiw2RYwZCUsjKplpKagyN
TLSH
T1C1253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 949KB
SHA256 193538c1b0e29afeadd25c29e43b19567babb71ea99938f3fdd2fe403ee18f52
MD5 371d620b17c891a0e55c7411a9b2dfe3
SHA1 4ad5b998da1382f26c60418a6e32aae82ea6e4ee
SHA512 38c430d60ba0c4658f1b648c9975a4a64128d0a0475b6f1484b64f03569109fe90dc257e76405f3c4f9c579892c98894e7022a580e7516c1917a14c4c4ae8d80
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagof:t/sCv7rTiw2RYwZCUsjKplpKagof
TLSH
T10D253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 949KB
SHA256 f3d6d25a4ab37a834fc1d4eeaaccc83cb3d703645e480fa61a85e7556e0d0ecc
MD5 eb2e92145e8b6bafab4166331dc05d3f
SHA1 ad4aee3014eb9753e9c1fb10eec876714bb584eb
SHA512 a86a90ea7b5a88d2e30de3a482e01d3d5a9361f4f976606e3a5baa457112fabba68c7e9b59d11f8a74c6a31df606782b68aec08cdf18e197526fff7895142759
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagCo:t/sCv7rTiw2RYwZCUsjKplpKagCo
TLSH
T1AF253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 949KB
SHA256 6f48d4af77011315fa0081678e696e40740acd5a6a97fea7b52c6cdb6ab6ec64
MD5 a6efb50b5d2c73414c69b50614302c29
SHA1 2cfbd7199424dcaea9843240e95b4a773ba04dc4
SHA512 2c36b67844f368a1fbae544be08c4cda2f90f143670d9e11f03197baaa7758034f0e32f6d6cbe147c37d7c72f7699ea0d332cea26553f74a9ba10cbdc22d552f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKag2u:t/sCv7rTiw2RYwZCUsjKplpKag2u
TLSH
T190253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 949KB
SHA256 578ef49d91acce52d885e2b081029ce05c27de4025d2eef6d71ad6cde55be99b
MD5 aad602e6659ed76cdce0e45540565b80
SHA1 530e7f35ecc97f38ef02caf23ce244af7685c108
SHA512 e0dbef1c39bf5b2a9aacc30635dfd3da52d7096a760245d85a39199b96e7774a6fb0b0572c9f2d9402f15470b7307ea7d0dd9feba900b294101109cb0259748e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagq9:t/sCv7rTiw2RYwZCUsjKplpKagq9
TLSH
T181253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 949KB
SHA256 f8e7143d19745912d83eb76993c7c76562ca84e77be5df299b2e88c7ddf6a78d
MD5 9eb6265bf68a239cabd646b0496ffcdb
SHA1 9d34a0af13e2cc61782603b24dc7af9710987c92
SHA512 48b250498acb2c063e03319f0fee97fd84f8989dbd18f2ae8c46a91c61e01fd0b5102824ac7de22b0c6e68892203468dd0ed8b179b32af5f273b275f10cb73a7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagqc:t/sCv7rTiw2RYwZCUsjKplpKagqc
TLSH
T1C7253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 949KB
SHA256 602137a5623f2ec5813454bc98e1b862e3dc5ea667032f03421ad1a42a9b900a
MD5 b7771c455b52a0de8d0b235356ef5621
SHA1 03d45fa2a75d4bc88a3f18746311d67c9f8b01e1
SHA512 02d3b0ef9387a6a455d9cf40a21c5b1ec74347273a5382ed94732290431546b3f1dba505dbf479660ba969a7cfa1baacca203bd4527dab781e047c738142c39f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagjp:t/sCv7rTiw2RYwZCUsjKplpKagjp
TLSH
T14C253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 949KB
SHA256 24229ed17ade236e19fc0a97fe0d095e36acbc83fc0ef43f94e30777e8a7f8a8
MD5 bcc8b2dc83648ef5bee5bf7daa202a9d
SHA1 979883f3125c315868376fadce7e230b01697351
SHA512 cab7ae521651d23bd024166a4dd2cd116f722e222a83b14244ded7f4eb83903a4d66e35882518715c3e8527c5590bb80cd1d7243fde9fefd0f7115976759a25a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagE0a:t/sCv7rTiw2RYwZCUsjKplpKagEN
TLSH
T142253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 949KB
SHA256 d9b4cf7799252d467adc7540cceff721370f8dd18d9fcd6405a5cea315a62abe
MD5 691d0addb4eb8cd74046e2d560ce0f1f
SHA1 e2c038634bcd68990aaec8d14707e036d1e18d3a
SHA512 c33cf1da0ec754036ace0c2dabba5e919649bbe3333cb7158d89e42807357b7043b6d033ba3080ac4d5773f607dd24aeacfb4275ebec662314fba01bda9f7575
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagsF:t/sCv7rTiw2RYwZCUsjKplpKagsF
TLSH
T17A253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 949KB
SHA256 31a2031deeec6abdfd4cb87dc2a9715d8b15a0c0336fd7215f3fa814e306ad3c
MD5 5368551ae6cc1a5307f23a89c99502e2
SHA1 19103ba3b84b4a5af796d0ccf1dbe496aaf45018
SHA512 ea235053a080022ebd9c05a7cb2061953aabc81a7ffb7302e71bc2458a30f3acb039a24db97b64ca67fdeeee8440902e24b13eeccf6b2b502ecca219f016d34d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagZC:t/sCv7rTiw2RYwZCUsjKplpKagZC
TLSH
T133253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 949KB
SHA256 4caaaa1ff0a4fb94639ccd11e462e62d99929191b5acaa42c0b6d26407b7a30b
MD5 c514cc24388c7bfd2db81c898db9193b
SHA1 8b8cf42035f72804312b33e3972bc327c30fb658
SHA512 5a6122557c199209dd641422ecf314b3058b69d0c1e283a78a6bbb2305d614e1a72fe25dc764d6fef2f73f4020be9890ce7b0ad339088c94ba6f7cb97409d2e1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagaw:t/sCv7rTiw2RYwZCUsjKplpKagaw
TLSH
T144253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 949KB
SHA256 2f441a7fb56984549ab74acaca138d447f11660b26b59eabc6e17e2ee963ff59
MD5 d31cc7d7501e6f887ad30ca5bb2f863b
SHA1 f12d5aa41de46788f371bba382e670e1d268a2fb
SHA512 327af1a0cccd24e5580b161a767f527e74841959f1769fad51e820c3dd93291ef7db3abc6100fd72639f15db505d7098570e11a91fa30633ea44f2ea6f37ebe7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKaghT:t/sCv7rTiw2RYwZCUsjKplpKaghT
TLSH
T188253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 949KB
SHA256 22f737891b68ed651f5637777bc3ff1ab1bc06d5f74502c23acc4cd0064385c1
MD5 404b6607e653e796b6e0f59425215503
SHA1 8b3ed6cc8aa3435bbe8249d071656f52c9207835
SHA512 eea718064af57e08a8ff3f5764ae7e100501a1d59a5fedfae5ca6aa73b1b29aa4a6e1e72e1a5849682475b28a431a132a58c3b81822a465810befb2836618242
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagPu:t/sCv7rTiw2RYwZCUsjKplpKagPu
TLSH
T15D253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 949KB
SHA256 6aab85b905820a1ae96acbc27fca242cf758a64159a0bce102ede980b0c9b857
MD5 f5e689fd52921c8496ae38f26fc5b315
SHA1 82669996bc38eaad7635d1998538d6edceaad4ca
SHA512 a5f96d4bbcc5e736d397c0fdaf38d2147aba31cc36ee19003a59c369a0ad124d34c330e78091e415350ef077a8193ef7de539c08ca0ca759540a8082eff5a9d6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagzb:t/sCv7rTiw2RYwZCUsjKplpKagzb
TLSH
T17A253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 949KB
SHA256 c3c051e88e699d51975987d66aaf0100e39c445e2150be531a81c228d744c610
MD5 1608e6f4377b1ff247aab964e71f37aa
SHA1 0d6b057b9227e0ce047a0089fa592fdc8f8d0a2d
SHA512 bc361c42d84b43ff6c9c3b3e2d1564aff76821370a4a5c44625a9d4e219e9d4b5b4b7a96b626dab28e5931d87c8ed74a4e7211acca86e6c85b2412f1169f7d42
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagHf:t/sCv7rTiw2RYwZCUsjKplpKagHf
TLSH
T193253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 949KB
SHA256 108272b57f2f75ba168e57c1f9ea03a2cd9893f1cfb453b82ef50a1a4c47c2bb
MD5 7e063c32fb38eb5c6792d277eda2345e
SHA1 e5b035b98828c7c78ce2f2df2cead4d6caf653b0
SHA512 e3b158e886be732464b9c990c90c6e5db040008ed342fe962342de52a89d3463076a83b65e5c2d0f6cc9eacaba63d0eea380809b7484affb903085be29cd2177
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagwK:t/sCv7rTiw2RYwZCUsjKplpKagwK
TLSH
T109253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 949KB
SHA256 43ae3c64d11151e521c4de713b092cc24cbd3245ad9ccc24d6a59d1e7635ac44
MD5 9744db94a34cda81c8c4f96828db5ba1
SHA1 2be8fc309bb6e0c60a8935b6261d63626491f9f0
SHA512 9b67bc9fbb311f421b9a36d5347d48bddeaecace1826a59f496b3cc0e802549d9e786934c7d3658db43d5dbbfd047e6fd7544fb0c7b7c14cec520eef9ef3907e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagtk:t/sCv7rTiw2RYwZCUsjKplpKagtk
TLSH
T1AE253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 949KB
SHA256 05662d57581005fa04dd2d38ebcdc511817d263a467762f6a26e6530ed339b26
MD5 76663478b82db7fad23e0678b4685984
SHA1 e88f89fb44c73f3257d078ab22f25601bb2512f4
SHA512 04a1a37592e96dc7ba8b312fc5456f03d4debddad77e4b85219eb54b8ff73dbce3c4501cfcea00cba055ce827e18120cf0dba0e9250f28c880859df2aecf35f6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagy0:t/sCv7rTiw2RYwZCUsjKplpKagy0
TLSH
T15B253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 949KB
SHA256 2b1ca69cd420f0631240e810148506633daff4fa7085418d097a85f053cfec77
MD5 a631306b1c49351d700780bf59d9276e
SHA1 d3d10c738c11374f3e270439e4b5ef8627091c43
SHA512 e1ffe01a619eaa73d7bb4cc8d5716a50c1d1cdaa61e6830761910583c40e8e960ce5c77b0c34cbd343f1bec1d9db55159dde769c8b11a4a0aafba70af7c526c1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagB70:t/sCv7rTiw2RYwZCUsjKplpKagBg
TLSH
T1B0253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 949KB
SHA256 4268bd81e3c9f712b4da3f46ec30c4eb0046393782152871be2552d638fbe152
MD5 79a3cc63d666fef85d9acb80b9be47bc
SHA1 daf90843cdb9c42852bd9d37eea80b9c66afc246
SHA512 70f7956e967dd9cbfadbe9f2f13ee93e8ff00a1ee9e24e16c266aad9b17d16c82bb87e01e0a0f065a1c27530576f15032107866467eb3d209fb870dd3e55621e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagor:t/sCv7rTiw2RYwZCUsjKplpKagor
TLSH
T1CE253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 949KB
SHA256 e694409d8620a2b9a3d4096dbb50d443764326269e873834f0ab3b7bcead903c
MD5 55880fe04f9128d7a4c2ba63eaff2468
SHA1 8ac782c9b9e1ef8db95714c5389d6af4d4ee7493
SHA512 c4749fdf556bf44afec4cf0377301041c510ec66825f1026c36b7e67cc9d82b298ae411b78f61421db08dc31ebf6b6608373e5c7b232c78bc8c3d26252513486
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagGn:t/sCv7rTiw2RYwZCUsjKplpKagGn
TLSH
T1B3253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 949KB
SHA256 ed421d1daf30821ae90cab01fd9f43528817f91f76ff1d338f23deda564313f0
MD5 0f76bb8eb509f922d519203ba9e50997
SHA1 d969cdd12aab2c90ab7a1e93aaf1afd5358a8211
SHA512 4931a516a518527e4562f9fd6dfb381dd2fa64bdf54081d56fa7c0cf6a904b8f8683e2a81a460929ee29dd57af6ed958b47271203211a20ab6c3ea0d94fa5344
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagMx:t/sCv7rTiw2RYwZCUsjKplpKagMx
TLSH
T1F7253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 949KB
SHA256 ee4220c3d6eada69838d49973069a5b5a71c5e959a98880cae17545d7a9f841d
MD5 67ae318e71438c2451f9e46acd254627
SHA1 6583885a21191f242ab1eb19f4e7608d2cac74de
SHA512 69940c4f36028a63e958a7ec472bb0bee92fd7065fc2a4f7474c7dd21d96832eba886b7c3511faab9277b0f986681b908eb4c70a75bad7ba58841e6215e38e18
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagGA:t/sCv7rTiw2RYwZCUsjKplpKagGA
TLSH
T183253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 949KB
SHA256 26989afe922506238d39ccbaa11fe276db8c69d982d7c6e2143e0c4d37293c3a
MD5 d557a6f4c4ce2f82b01946962bafc480
SHA1 1fb8ef763474eccdffc4f9f208fb05986670df73
SHA512 dd212a94cab5693df78df8bd52e9ab711a812499af71dd4e04448841c24a8b36584c189111688bc2df8443f64ee0eb2434796e5e16b084dcd017b5551c502b6c
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagf9Q:t/sCv7rTiw2RYwZCUsjKplpKagf9Q
TLSH
T1E0253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 949KB
SHA256 d5797e95eb9b682b4c01125f5866afdebc45b0c371a2a1cde216df524b154a06
MD5 a84b1de2018355ad7bd051125a1b856a
SHA1 c7018e28fe49a6561b8af79a2b9c4817b2308803
SHA512 810932a0f52ff95d53c183e912d0e09d799c27a39191f18f75831bc48a9796245968d1620f9231376f13ef6ff6f3000212c8cb782c4cba81b7fa982f33f0bd08
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagW4:t/sCv7rTiw2RYwZCUsjKplpKagW4
TLSH
T14A253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 949KB
SHA256 068ac12fa0a721a295dc9593db9c2c70f54234921b097d7978f29349ea97eb24
MD5 402e0237a612963f17a6ec8f4acd9aad
SHA1 ddf8172bfafa1ab52e4bf1b2d63b972e0999c008
SHA512 c0ba1be221fcbe8b3fd7f6c9f98bba66153b6c53b415efd466f01f6d3b7820e015490208eb06ed1de8e8e4066b51019b9e821b14b5e3f6da7ced89e49fe3f801
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagFu:t/sCv7rTiw2RYwZCUsjKplpKagFu
TLSH
T1B3253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 949KB
SHA256 05524354023e22fb5a522d496f4f383bc588488e0a131524bc37ff1b0baae1e0
MD5 ec2b9ea42537ea96916b69d042588c75
SHA1 888254e83e9428b3e09bf2d8ed8f1694759c78bc
SHA512 056444dd4aa77fd2453c003e344e022c31152012d41e372da10bc53a5074d16d30ace43bc93d90617b221013961b94d3cb7589f1ac2231d7ada95e658424cec7
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagYj:t/sCv7rTiw2RYwZCUsjKplpKagYj
TLSH
T188253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 949KB
SHA256 f77847cd9bc0e1cf0839e0903894827a9f641a71f4fb9aa252dbb430a1b4cef8
MD5 6b2a41faa35c0f3f684ca8c910bea37f
SHA1 5d5a0999df9967dd2ab6125ef733413fba0c364d
SHA512 70afcc6ae3fa5c4c58be7fb63968cdba34b60c2fe5583212999c1de9f6e2ccafd114f8a6e5074ed7ee81dbb63ba6ebb25b4fdd47c437fa9e04e165493f0313ae
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagpg:t/sCv7rTiw2RYwZCUsjKplpKagpg
TLSH
T167253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 949KB
SHA256 2cde94ee1d23b917e757bb28f6d596a32932cc6a42dd35f2ba2647ab39e463e4
MD5 67aa96d79bb6ca00b532718daf9d882b
SHA1 392003944f062b88956956db01df065a2d6807c8
SHA512 4ba55db94b59536bfa9b637ce5058b97fb9489ceacea9fca0f23743533e489e8d3c76969c3225214eb6fc8dda933b886c24c09ec4bb7c7f0eed1021386760387
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagwI:t/sCv7rTiw2RYwZCUsjKplpKagwI
TLSH
T1C4253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 949KB
SHA256 5e7a0034672abcf131fe43671c2b36cceeb9df466a9b6b849706b25864b67681
MD5 aa823ead621e6a7eb9a94856a9831e0e
SHA1 54d2f20cccbaf2b42146f437fed3bc5617e31bfa
SHA512 ae7805ec04e8cbf3069c218ffd00075b98f9a5ff416768a8263be1d483c3f3c46320d597efc027886dbc50b872e796ed26d15861d5314db77d311a1dcead87f2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagyo:t/sCv7rTiw2RYwZCUsjKplpKagyo
TLSH
T1AC253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 949KB
SHA256 66f60d8c0ff8fff50c7e4044f0894f26000c2acc47554339d909cc2b8343c147
MD5 a35369e9773e306d159217abfbba8ed7
SHA1 a39fb33e8c94e9bc506caf966f64b415b69475be
SHA512 a274966c88ec83ae6b2099f9cf9a39dba265883970831c50092bd4c9a88678a2ebca29f783674a2b6f35c79c3f752e39fad9227ef519745d6ed9d61e02d84705
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagp+:t/sCv7rTiw2RYwZCUsjKplpKagp+
TLSH
T111253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 949KB
SHA256 6fc6c7de2f4ebe5bb59a59ab36e5d3c8ef60efeabe6896798b971707312e517b
MD5 78d4aa2bd9f6d8146add05260d9fa03b
SHA1 78630a3e0100623e171c23f8cce497bf0be27ea4
SHA512 16e5cd0362963f0f9db33880ff4679c53f9bf992910e9caedc27546faebd2362926ebcc4ab506daeacfe45d21398aef3b6cdb5951e0055278c6942122ffd8763
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagXQ:t/sCv7rTiw2RYwZCUsjKplpKagXQ
TLSH
T106253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 949KB
SHA256 1d93d2b9f80bad5adcc8e47ebf36c827682f05e54b71eb1c983bdb930869958c
MD5 76e1b164864e4551bef3254468564663
SHA1 b6e474bc16c67445b4f5cf69822c9efa1de722b4
SHA512 a53d1438d5b62be9e6a746abb7263d3f9f96df40445d2fb91806334045ffbcf581f3dba53c6f81214289e24d21fba4457ad25191b7ecd45beec72d89fe27310a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagsX:t/sCv7rTiw2RYwZCUsjKplpKagsX
TLSH
T19E253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 949KB
SHA256 5697092096db86edb2be3379be26c16a03aaa6def312491bb4d34bbf6c0ef5de
MD5 1574193a11584954032cf8ed1eeee168
SHA1 0e3d252e2a447f36567367fddda2deb5dcdfc26f
SHA512 8e3dc9094cb5315c5b02dba21b5fccf3b14f3f3ecbec7feaad36fcd80048610f1ad77ee1e75838fb6da0eb404259ea7dc86ec9c0fbdf8dfa1c427127302abce9
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKagKL:t/sCv7rTiw2RYwZCUsjKplpKagKL
TLSH
T1AA253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 949KB
SHA256 eb668a97cade4d4cf0fbde468efd542072a6be0cfd9a605c40c81e45c10a6544
MD5 3a4b60e3fcfaf3939856a866e05e1e47
SHA1 b64caad18d5abc8b9916723efa7d4c2992d02e3f
SHA512 c36c1604f652ed7b7201ca54e688ccd9dac94c071cbcaf0a31828a5d4aa8bec3e64b82f6b494f4c8c991b51ced030600c0241c662995799722136ef8276ea350
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKaguFC:t/sCv7rTiw2RYwZCUsjKplpKaguM
TLSH
T1B9253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 949KB
SHA256 c9e89d3cfca15a9c77d3c16bd935387cd8f344f14ae5cfecd95fef0da190bf3d
MD5 b952222f1bc86a6e86fd5e5f9dfbbdac
SHA1 609e97e423f406ba661e2b486173b99ae5c123b1
SHA512 1242e41b6db0b3cd948adbb94e0eb3bb9d5e8b3b3466251a885ca27288c4a5e9f14ad1141f8ad8c0abfb3d37aef18f7ac300a3dd82b145dbd799c80901916a9f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPlpKag3h:t/sCv7rTiw2RYwZCUsjKplpKag3h
TLSH
T143253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1280-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1280-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2648-22-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads