567c099d44fed63276f42edb6fdeb52faf5b7c80a5134e66d59f43444cccfede

Analysis

max time kernel
105s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 853KB
Sample260716-b5d3dsdz3x
SHA256 567c099d44fed63276f42edb6fdeb52faf5b7c80a5134e66d59f43444cccfede
MD5 844f8d09b65f2c91d1d40c848d80c0a8
SHA1 d6e65c7ed84ed122e51d75be826f40a8140d52f4
SHA512 83fc1ac35bad89b78fea03420fb87a9b912d36a4e922f66433a5d50502267b42cc80367db68b017b68845c63340e34ec8e7ae1babe03584b27d3e349c25949f9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcu:A3k03kHRJT
TLSH
T14A05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4628-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c54c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4628-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3136-34-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb5-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-421.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-514.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-789.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-802.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-876.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-955.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1011.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1054.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1097.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1140.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1187.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1273.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1333.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1352.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1404.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c54c-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb5-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-226.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-263.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-421.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-489.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-514.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-605.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-630.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-721.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-740.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-789.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-802.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-857.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-876.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-890.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-898.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-911.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-930.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-955.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-980.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1011.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1054.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1097.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1140.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1172.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1180.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1187.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1273.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1333.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1352.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1384.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1404.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3136	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4628	2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3136	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_844f8d09b65f2c91d1d40c848d80c0a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4628

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 853KB
SHA256 567c099d44fed63276f42edb6fdeb52faf5b7c80a5134e66d59f43444cccfede
MD5 844f8d09b65f2c91d1d40c848d80c0a8
SHA1 d6e65c7ed84ed122e51d75be826f40a8140d52f4
SHA512 83fc1ac35bad89b78fea03420fb87a9b912d36a4e922f66433a5d50502267b42cc80367db68b017b68845c63340e34ec8e7ae1babe03584b27d3e349c25949f9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcu:A3k03kHRJT
TLSH
T14A05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 2711dfe98e6e5cfe1f86e8b4b012fc8a0f63eb3ea765bcf2d81b434eedaa265e
MD5 a6c69ce4995fff0abe35b4f8db768aed
SHA1 5ee173806033b2afb3c68eff0e4e83badccd9827
SHA512 143d1354d113941337e7053e4255f80a429d97b5f2084bddd7c2a69cf1471abc3ecfd9e9029dcc38e62b1f9501d868db88e0d2080b86785a8cae03e5cfeeda42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFce0Le5ji0hmxNrM:A3k03kHRJPPji0Aj
TLSH
T1A2658C17F6A402B5D067C0B9C5D6965AFA7138821B3086CF1399C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 868KB
SHA256 2f7a18377be02fdffb9d01804e3e758838a825c0958ffc7212bcf686e8b601db
MD5 6c545614f2c2dc2dbdd68d1a3e3b3edb
SHA1 29ec7a595169bc9a7ace3becbd1866f25d0c3bd1
SHA512 3e13aeb4610a1e3cbe1600865d2e37f99a457c447fafdf8dd007a4570a3e867354ccde7dd76122690348cc42234af18915ea57af7da855c1b62fd7162952ea2f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcYa:A3k03kHRJ
TLSH
T13915AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 901KB
SHA256 7ba346b9b574d2db0f0d67bf81dc916c55dfe111a344e0bd03bc4c176069cec4
MD5 c0203a0ff5bb84387a470afe99583a7b
SHA1 9dc8dc332fc6a0eca56c1ca61c98a251d40713de
SHA512 b12c55de7c2dcd8981de734a8a98091e4a488fbfc6be273aefcf468bf2cd9774190c6e7e8e5d2411c6d51c8c7b0a0651cbe124406f9cf930a2790615c02b3e9f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcTb:A3k03kHRJyb
TLSH
T1DC159E03E79400E9D10AC1749AE68A23FB75BC56177093DF2358D6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 877KB
SHA256 179bf0e5a5f8daaeb14c798f225c74d903a8cec7ff386058431a2574f1b143d6
MD5 eeb897ec5991b84f95370c96fa3dbebe
SHA1 2bf49d03e81245405c3b4c87306fb405d21b72ae
SHA512 22595fe456462ff7f80c5543603731dd0fcb3c76100929cee7f2cd45791d675d9517e35ac31c92391bce70bbabe6ddc39604931fccec2b5d01a08bafd9cc6713
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcx6:A3k03kHRJX
TLSH
T1D515AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 877KB
SHA256 5b05f27dfc1c62a9810361e488816478222ee1a1ab140b02ff5d0d209659e05c
MD5 4b42269abf76dd06f91e85c0716f4078
SHA1 02a63738c88b005404f3d39404a9acf9433b4575
SHA512 6adbf783626b9ed8c607e06f3ddee7482e432572b7e9410b0ff0a3d1666313fa3fee6a643a455917d5771c3d0e3bf18d41e05304492a8466aec82fb392380e00
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcvN:A3k03kHRJq
TLSH
T16815AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 877KB
SHA256 3ad84a599fe2bd0a9f48a3a0ee46f4e3d716ab784d720483a56ef2a2d7e5d572
MD5 b0ec026de94339abca281cca77974757
SHA1 7e9b9a38397bf53ab3156fb4a24a8419394590c8
SHA512 87f95da0c22762aa7cf7264413c1cbe24065af21053835863467e2496a9512ad34456743cabb1fbe710940e0c32387f52864ac4e2ff1428d4c696d148335d2e5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcVf:A3k03kHRJG
TLSH
T1B615AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 877KB
SHA256 73c33f82c2a99eb46dc72615f8b496f33bfba814a9aaeace7d62213fbd624306
MD5 91d3e40d7f7be24f211fb661b0571f06
SHA1 22bca9c5d0ba18939b1ea6489f861ef722d9ca25
SHA512 7bf64f41d6128ccc722f4a9bbe7eb4a4ba8e4bee7f72d79a9d26e6b18f0a1175146092ba72ae1a24dda9e8ba784e14b9bf193a114d7582e20ee42438cd445a19
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcXo:A3k03kHRJn
TLSH
T17C15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 877KB
SHA256 66a273e514db3041c794e201d37fb99253a6d4fed0bd35c848fd98cfc4ea4d90
MD5 d943b9914cb1ff684d01e4ffb4a4d02d
SHA1 7807b78c26e54f47c7e7ecb1fc60e439d46cc372
SHA512 7345c7e7846543f7eda56b5612f65e6b93435f82bcdaade641df65a4a1b870b6311d3c5876ecc4ac7d161519e0d295992a219ee774864a7d26fcece4753a3252
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcbu:A3k03kHRJJ
TLSH
T15A15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 877KB
SHA256 00d81ef7cce2fca42f4458d9c32cdef3288dc94d8896d88c4580ca188d1dd6ce
MD5 980ab87ab0dc5d84a34a916692d22700
SHA1 41428acb5a4099b7e9315462c257e4683d8734b1
SHA512 e0c7e214ab136eaed2b0a30889c1dbdfe4c251b4bf0f50dd8898b9c56e1222f8bddb25b330761e4aa8c18bccf5173993d3bc6c77478106ce221e65b4d27f99da
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcJ9:A3k03kHRJk
TLSH
T1D615AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 877KB
SHA256 aed322208a87d47c429808b9664031fc1a644c39a32399a3d7adf325bfc2b0e9
MD5 2fc11ee49875b908f1a31016861d16f2
SHA1 1159bd4cef780c9d9817ad449aab841db96ed754
SHA512 c20e337897c54fbf32b013d55908bca46ae2fb11d5fd08cc77950e65f9631dd2dfdf7d623b48e554c373702bbb181bccdc4873079abdb35c63a65e98d9b5c2ef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFclc:A3k03kHRJN
TLSH
T13015AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 877KB
SHA256 54fe782b2d610dbd1be58821f8aae6f9d9fb43aa2a84cd2d51c731f42687bd49
MD5 b741a5c47a2eb9b4a530088a2b3760f9
SHA1 2d16d412011a1d3ba00224f05513bd9a636b34eb
SHA512 7c71ed75bfb20ccccef904ee488df45b168d12a409f5b0a4ceaf907ad4b1ff3b13e06c73d936fdee4257bc4b4a2546fbf8b88f1f2a96d145d4c24c216ff88a63
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcep:A3k03kHRJT
TLSH
T16215AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 877KB
SHA256 d17ffb37b95a3e39a4c72af8b5353f3600632d303e11a3c017fd12165aa3542c
MD5 e655c02631bf85488c22120500904865
SHA1 7e19c62ff30713c26a52ae32ccf89c79c6cf262b
SHA512 14a7ad5d4854b7c9a4ce9ed6013e9865d8e288a98495d039761ddfc3ed6dce2ba7118aaf9460a668c763793e2cda141fbb3e366079fc160aa488e2ee71581750
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcRN:A3k03kHRJo
TLSH
T16915AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 877KB
SHA256 4b7e14ce8eac8547b70ae6c659e70a0efc858c31dca2d9b68fc124f6da582c20
MD5 3cdbf37e1e7941dc535c9158944ab275
SHA1 2e6457fe03f58d5192fba2f28345f95cff471134
SHA512 12dcf4caab40ae68c3a036b58101a8b130307dd71ab151d3e6e0083cfb8af09686c24607c893be94bc1e226d83b5a6e1b2b96914128bc03b83a277e5f83c3f4b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFczF:A3k03kHRJ+
TLSH
T11A15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 877KB
SHA256 bee50f1c9b488a6d9746b831514256b7d81d1d493cdcbae3e2fd31b8e0384c6a
MD5 cb8a62e2d08db90075a6d015eeb095db
SHA1 f5a40e6c7aa85b09b0bdac983a6e16b297a95163
SHA512 afd86cd336c3ffa68deea68ab5b7fb2fab614ea40d123ffa6fde222b96b7afb1a74bb37f6524968c2ec3934efb8c7a8c13a6c42cb21239e1897e12d91e8ebf77
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFccC:A3k03kHRJa
TLSH
T10615AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 877KB
SHA256 8d734cbe658065c817c567c51852aca2dc8439415b9ad8b8858ca02dec83eefc
MD5 1ffaf68a2e28e09f27398b652051c9c1
SHA1 f4c9faece764bf872fd2fdf721aaad8b7437bbd6
SHA512 f2864188e1f24c7b0c407214d4fe0396d2ca41b5b4dc5abd806d24c49aae7431f3f2625d1264628531ee65a175549e963abef35e20001fd074dc551684b932af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFc3w:A3k03kHRJv
TLSH
T12115AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 877KB
SHA256 79107c20b2244e297516e93609dd95bed74af2f4ae89418206d28cbf3a26000a
MD5 3cce431e47f397801fc075adb40e80e9
SHA1 d437b84946b3d2d878c1b94f89f6870d233addb4
SHA512 6e5b333d5739ec8931df12a60ae46f30a32795c376aa6cacf2a18d1800533dc5adbf0840f667aebf76aea78ae7cab3d666ecff8fc5896db43a58dffcf8a29a3a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcmT:A3k03kHRJL
TLSH
T1F715AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 877KB
SHA256 4c4e652ea7777a58f4dd6137d7193634f5f75e8f0fd68bc18650e65ac8db173b
MD5 00ba7c593cba577cf8891d23b18e8287
SHA1 5e2474adc4db8ad738ed9e340034946407d26f4b
SHA512 5bcbfd500ff1bc008ec36e0bedf1b8313ec19fddb7c7193bf7ba804ff7573d6c7f3d91e2bdea66f94dc54f9183ba8a051d7e8072849bade4e56401a8b1bd0db1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFceu:A3k03kHRJM
TLSH
T10715AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 877KB
SHA256 9b5ac2f3e1029c15cd265c6112e2598ea9342486533a68460948257325e9791d
MD5 bb0df131ff39375a9bb98be40f36660a
SHA1 d3388c35230f822ab396b753e255616faf8a50e4
SHA512 3750b45eca850a473b06dc5367a5b6c4c109ec6a329950fc63f078840a8638857fba479d8e853142bb79d98b5f6c3bd03a9bc6592dec64a619ad7effc690c092
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcYb:A3k03kHRJl
TLSH
T1B215AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 877KB
SHA256 85e79fa7278dfbcea22399b34f2fb413d772cfeacad20f101d40f4d0d151a43a
MD5 b5f456fd6effa6f21f6f1de105cc1978
SHA1 104d1bd689a8e087d8de4d4e09663874dc6c3ce6
SHA512 c55bf4b3743c112ad566c0fd4fd2a55b0bec2c31676f8b0aebb098110a656c7dac5ad2397beb4bcb73c8de297f9cdf44501e9151f7ae1ca4d46889bd42054609
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcGf:A3k03kHRJl
TLSH
T11C15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 877KB
SHA256 d7a5425233664a5ec460a2a9d88a2baf476d6efacd12ae33e5d1914e10112930
MD5 e92a730824026baff84bb999bca0e1f9
SHA1 d15c96370e38e9655ad814fd9597ce73de100a87
SHA512 f744634b8c88989bd7f19c29b751b0e5699e93d89b5a15676dff998fa4f1764e66cc72f2fec7333a6267eb1a64de885c1e6a19dc2f8646c5891243d307fcd144
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcDK:A3k03kHRJd
TLSH
T1EE159E13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 877KB
SHA256 1a86974a218c12113be3e6da74de536123388728fde422b9673fd0b98b3d38db
MD5 a68937d283baae00d71efb578260a5fe
SHA1 0cd13d842830dec1bf1575bfd72518a8e163368b
SHA512 5e876ad8ac7cd098818599cd4da895b335b77faef8b9392e2c1c55491e75ded756765f96642e2eaaef96e7dca47403de172addfd0ca61e7c550c5d7b08c31d23
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFckk:A3k03kHRJ0
TLSH
T1B715AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 877KB
SHA256 51d0623a60226765c3e2e6f1c299973db43df7d8f040c3cbfa5919b3da8ac6ba
MD5 271c3f2fdfa6d292ba651a1a54cb0582
SHA1 261928d7f4f99f2fc2886b3e9bb4def41b8bec44
SHA512 0d723be33c8fd881f4e74b08908d274f2eeb278a19692285ff94a7bd1a9b372957ce47af0049fa398a754c76eaa4d20d39d4fd77a421037dc12acf4ae0ed2a97
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFct0:A3k03kHRJ9
TLSH
T10615AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 877KB
SHA256 c5bd713777ab92b3eb4724cd03da5543b521262b68155b01c9d8090e0b7108cc
MD5 a6c3aff2b9cb233e7a1fbf55a92af87b
SHA1 75558f2676a3107f7bd56c678994337ddfd68e4c
SHA512 3a271b10409256aca01607e153d17ee6840c377f0118ba91a31f8fe8817a9a3b080c0fcc4ac0d4b62a8a43cf264c6d6ea234c1948f60e6f5ba6ad4dde88a808f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcwg:A3k03kHRJM
TLSH
T18215AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 877KB
SHA256 9bc2b72f451f7b036868328a259276a21d9de0babd15deabcfbd774fb3b2c6f2
MD5 ff055f3d30cec7fe179c78c0b8cc0577
SHA1 8348e8aca61d182e5200c12c7b1e86e4487e1c37
SHA512 cc1ebc12f27197a0ced5b902a0ea4453cc3bcb2a51c314cdabd7bd178198cf7b425f06ba7988668968e83a5f3cdf3e3866d1b8616710cfc9c431ecdabd1ef634
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcFr:A3k03kHRJe
TLSH
T13215AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 877KB
SHA256 59562d97a3bc7a2ed8a024f2949d598800b9408c430faea3ef04a0b831040721
MD5 d590215b7626a1b2109c2a8e67186c1e
SHA1 f7df3249e0740e835ac3dfd0813e10896a8d4da1
SHA512 85142525a357b4d92ddd548f681a7540b51b3a13e850a5dc5c6b5345d71f50241ea3786157c09bb159b6485df2b5a6f921cb9e9c095b314aa73e3c66c6f26e33
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcPn:A3k03kHRJo
TLSH
T11E15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 877KB
SHA256 972b48bf5d39d9e5ca1d5e3a0e93e9aa288ace19012015ba0438a7c4eed481ea
MD5 a7490a6efabd17da2b921e284518f20b
SHA1 e8a926dea8710cf472c6a23dd2fe3e00853beb13
SHA512 58bd9eacfaee41a875e4c4bd96586d487b95246f4f1fee7b1daf9d06112285edeb674c8033f458bfda5873bb10666d7cea2cd5a49b6ec23a1cc0ca81cf7a5cfe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFc7x:A3k03kHRJ+
TLSH
T18B15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 877KB
SHA256 60386c7ed648e546138cfed3a43fc56e2f3b16c3989f537732984625196d131a
MD5 ff4d31c0d0ac9a352f93fbc9df473f53
SHA1 e45f3f220b244fe3de6e79c589e44e206cf5f46d
SHA512 0ea73de4a555edeeb5077912a2fffa80425fcf6a0d3958711cb0e16c4bca7bfc784b4dab017557bca5c41e81bfa5b52d3e5502cf7dddea371b86def672793255
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcpA:A3k03kHRJ1
TLSH
T10015AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 877KB
SHA256 867cfb566e6bda4118cb8ece5a40bde1c490c8a13d9c225d17bdc7bbb87f8650
MD5 a7d2150d634c54e812913faa86cb30fe
SHA1 eef789274d308ec21c42f493b0c105eb53b877a6
SHA512 e7f0b2fd9f7e1bbe8f4f8a3a26110fecbf7c06ba5a683879da3c54e3141e96c822c2e5555c1ef70525481e065f9092946d66c4f0626067d6bd68de4806cfe55f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFci9Q:A3k03kHRJ0
TLSH
T18315AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 877KB
SHA256 d3440993e2344480689a204872ef75b59375bded27383f424ea50916ec853a5e
MD5 13749be6763856fc5f7af2a0896289b3
SHA1 5a25fd4a5e98dfba40d125a30a2bb6f6083d82e7
SHA512 a6f2091d6112f0f68cdb3410098a7cae85bba9049590f6b97d2f2b3fc33cc7af3bce3c88b9f5aa1f16ebe9f4bccad7557f2b35b8d74a0a433e98c39f5c492b98
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcH4:A3k03kHRJ/
TLSH
T15D15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 877KB
SHA256 d06ad60c3413ca287f01d1d41a6fd91d40ed6e10c8dce330ae5d0bf05dc8e344
MD5 cdcb797616ddb163999f5e4db8c24a5c
SHA1 59a840ddc9307d7dad0d919e70d9f7186dcdfe52
SHA512 11923c4267db20201b7434c407184a5f9673df088ee85f7ace7da97aeda18400c7d5f35f61f6004189fd608aa2db769fc4aa9787f65836e60387cc1629326918
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcmu:A3k03kHRJy
TLSH
T10315AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 877KB
SHA256 b0e71f6e71806dd345a87a9a3ca32ab38e1b5f623ad56742fec3748fb92a659a
MD5 35bdebfdc39c03376cddb69344582927
SHA1 29a9b3bd46d6865f4edf8805e90bb5ea9ada2b0d
SHA512 acd5d8b5519bfbc4fa2f8eba3d4c9b99ccdacf851a6e4e3d1c3658f4c06fb3c6e2e365cbb113e5583538ef2953e4957288a77e7216c11b996fe90f6afc13e493
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcXj:A3k03kHRJs
TLSH
T11B15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 877KB
SHA256 8de647d0b382358c6b3cdcf958193e01b480a8351d29bf95f9e7e243fa65e7d3
MD5 4d8b28663d589815b71924c4b9463da4
SHA1 df2cb35e56137da674ec5ae3cc6c62c5d0a32215
SHA512 1082b64882d9aac3f9017de14cf96b7b893100a06c71f15dae079952f8f18830d42bf675f9e93368763a46d255ac11f1ddb442d4687fdd0410d8441d6ff176ba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcCg:A3k03kHRJk
TLSH
T12115AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 877KB
SHA256 3798c13b6b6101b49a7869fb7990c6ccc325611b19c1124245dfa8fa18800451
MD5 cd1ae730c1ec0afb386abaa7801c0a2c
SHA1 745c3bf6922089e7c8a2fd7802d7844881694737
SHA512 20ab34fe6272d269a7aec7a322f8129c49c9949b917cfde75fb3b66aa96606959891974c48575b67d3542e1f2b467aba8c20f49baf2b816bf5a8070737193adb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFc9I:A3k03kHRJN
TLSH
T10615AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 877KB
SHA256 77f0c612732fd370033ba90975a4ca7ec560b18e1fb8306d24f31c579aeda5bc
MD5 a629d52d4a799b7091a6c3f9771e629c
SHA1 2106a940b7e8c2baee48ff868c86e52ebc99676e
SHA512 3d699f03363e7f097185547d2de282d0201a56d3c12822372bc8d7f3636f446712cda8e2b35c949bf3feca413e223d30a25754b3cecf8c2878087ca82ccfcc24
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcvo:A3k03kHRJr
TLSH
T17015AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 877KB
SHA256 c0f075bd4370ee2372e9fce6deed063f6799a4917879689d87593d0d26dcf1f7
MD5 656660223a19eb0d70957a7e7fb84df2
SHA1 e6e14f22b9a5bfb52ea6253ce1ecf1042b7f1571
SHA512 1afbccab0c20847e7ab7468d1e608df2bc00587ed9d8de2efdc887d2ff3abf0ee4e50a83c6f04597bd314ec5fc6db06699c2f2b9b2dba9ca2ef42f8820c1aef2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFc0+:A3k03kHRJu
TLSH
T18715AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 877KB
SHA256 406d4c650c6bb4804eeff2c0590623159d4188c0c72bea4636a0e48b71ecb5dc
MD5 de4829aa4e7a4f9a0e1a2dabe0ded621
SHA1 3cafc7e58b500d03fd046c57d16205afbee1a349
SHA512 757a564566018fcd21277e70887f40168631234498ca3b3471619049ebacfdd3062f46ffdf345c552d72765a1713a29f96f1b8bfa456aa4ce215c9c7de0399ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFc8Q:A3k03kHRJa
TLSH
T17415AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 877KB
SHA256 fb3792e8e355e0120bd50ec3303f9205edc9851c621ed69739d374b5c76669c9
MD5 86af9435834272fa1c873116c5f43c36
SHA1 511a4ae226b03f43cf3b226177d7709f0c1a049d
SHA512 27f5b3a87de48895a34f2380867d9f5b67e06757a19040e545c80d1d0f5795654dc4a766760ce4d7fe31ebe0a37cc13fd1979b3829041fb07302e35c7f23a6ea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFclX:A3k03kHRJK
TLSH
T115159E13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 877KB
SHA256 684e2929940e8ba165b55c1daab81678715f81ef95c566e6c94b7ec8e5033a23
MD5 b8261811df04cafd36ddaaed6b7d7cdb
SHA1 fbacf3e60965999ff386b12425528943556b3254
SHA512 2435b595dccfc31fdbd07e4b6e4c467268eba5b40c86237b5d3eb6ada35ebf2902820ab79b77edd07649e9d5f0ca27e2d4bf99137edae839f2666f1d13967d01
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcHL:A3k03kHRJk
TLSH
T12E15AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 877KB
SHA256 f6923f51ab322b84dd539d9ed36679726c5c8b477071b1710175257dab7c7603
MD5 78c05da694976177f20bb718dc6c9ab4
SHA1 34268961e3f118b56f1c5514283a85d0941a9936
SHA512 e5bdba21eb0d12be888b1218a03e01a7cbde9d85aa68bc16ba90734e4423f45367566b004440c8c6768ab018b47d6a667f70645965aad5246bca8558ae4858cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFc9M:A3k03kHRJl
TLSH
T12715AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 877KB
SHA256 f259ed7b6d0bb2de9c147746b428593e924dec65f017af2933c1ef47bea58381
MD5 9ec0f248a87062afbd96e4af1f81f866
SHA1 7a500112d019ed400741f3e7b2f53d9c7f503453
SHA512 3f884f57ba56e0fc7bb5aa42cdce4c1b85f060ba612729134d8d24217e9812a7b68771cce8067b266d33074156729fdded5d8fb6761b022e0981a8889ff870cd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZZKqFcuh:A3k03kHRJ/
TLSH
T16715AE13EB9500E9D10AC1749AE68A23FB757C56177093DF2358C6152F62BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3136-34-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4628-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4628-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads