937b24bbcfaf98ce0c3f33eb10a39b49dfac539aa274ec874e4d06736b2ce8ca

Analysis

max time kernel
104s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 949KB
Sample260717-13mdesft4p
SHA256 937b24bbcfaf98ce0c3f33eb10a39b49dfac539aa274ec874e4d06736b2ce8ca
MD5 85018a9265bf4b31b0d126983b48f3a5
SHA1 4b4e6eace81ca2fed49f83edf4eddb5faa8bc5de
SHA512 0cbd5e931f2e7b6277446d917fa522d35f00fa2a1323faeaa52d21afce286af0ce15dcdb01ed897cad7a82f6b4a28eb4cb038eaafc2e6b8dbf99f58f8ad45184
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3a:t/sCv7rTiw2RYwZCUsjKpJshy3a
TLSH
T18C253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 45 IoCs

resource	yara_rule
behavioral2/memory/1728-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5e3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1728-21-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5056-59-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018992-198.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a6c-253.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-308.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-472.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-498.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-583.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-669.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-730.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-761.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-841.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-866.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-886.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-920.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1137.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1157.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1323.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1367.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 42 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5e3-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-40.dat	aspack_v212_v242
behavioral2/files/0x0004000000018992-198.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a6c-253.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-308.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-472.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-498.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-583.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-620.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-669.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-730.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-761.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-841.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-866.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-886.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-920.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1007.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1050.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1087.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1137.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1157.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1176.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1220.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1323.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1342.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1367.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1375.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1389.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5056	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1728	2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5056	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_85018a9265bf4b31b0d126983b48f3a5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1728

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 949KB
SHA256 937b24bbcfaf98ce0c3f33eb10a39b49dfac539aa274ec874e4d06736b2ce8ca
MD5 85018a9265bf4b31b0d126983b48f3a5
SHA1 4b4e6eace81ca2fed49f83edf4eddb5faa8bc5de
SHA512 0cbd5e931f2e7b6277446d917fa522d35f00fa2a1323faeaa52d21afce286af0ce15dcdb01ed897cad7a82f6b4a28eb4cb038eaafc2e6b8dbf99f58f8ad45184
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3a:t/sCv7rTiw2RYwZCUsjKpJshy3a
TLSH
T18C253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 3be50c4ecb3f0829c145b3aa89c55b712eefda27c5c738227eeadf281bc80985
MD5 19c18e37bbe1a9c13200b787c4217bff
SHA1 912ca92515371c1927359889e7e4e62e372717f1
SHA512 ea134dad0c8dd7a61e427b38e353c6305e9dc6488c09fbbf61aa295ae1037785b2e9243b6ae551d11a75eafb776c499a1e10751f13ad657a700012f1d37038f9
SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKpJshy3aP0Le5ji0hmxNrM:x7iw2WPji0Aj
TLSH
T179654A17B6A84661E073D174C5E6864AEA72B4461B30C7CF12A8C72C2F63BF1AD39735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 963KB
SHA256 f42377b33b7562eee98566f0ecdfcc88d7517851bed89b8c455c3ce4ea5871a8
MD5 f116364f5722038aa1e2687c055deaee
SHA1 0c7de4059129ca0f994fbdfbe742bea23678b46b
SHA512 0cb8cda609d59f5d4a6292b3b313d5bff382d9da652098dd627981f3bc0a358ffe0dc4b45336837708ba31486d27875738dbb53b9559097800c06b4bb367277d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aRa:t/sCv7rTiw2RYwZCUsjKpJshy3aRa
TLSH
T12A253A1766EC0895E566613089F94606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 972KB
SHA256 733ab9c1e3655fa5b5125b6cd62a1f72e895414be3d3f05e21d9fb76224786c1
MD5 1998b65b7766809f25d6bba5ac69d09c
SHA1 286ebf738484475916b7ad1e6c797c81510c8be3
SHA512 906d21118aed45d9c1063f6a9b50d68db817482a7ab75ba149226c1a00c6117c90fd8ad30be902b2fdc85b370d1bdca8213a21cf6af14f6a5d9f6741dc759707
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3apZ:t/sCv7rTiw2RYwZCUsjKpJshy3apZ
TLSH
T10B253A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 972KB
SHA256 f8fd61c32d8b7db9e3ebe34dc9efe3771d585860b21c29be4e2eafcdc99dc4e5
MD5 f93921eac627be18071fd88b8b671b2d
SHA1 1c2edfbaf591e50c786ffae196cf0e5909d5235c
SHA512 dd6f16c8e2c9ca9b094de90632eadfd2ac70ce6c5e002383180d17b6561ca4d796f23aa2642e1242a6747f5c576955d0308ee33e4b4a168c53eed2b69298943f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aC1:t/sCv7rTiw2RYwZCUsjKpJshy3aC1
TLSH
T189254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 972KB
SHA256 fd9add768f70e801f5c03deae3b3bdf05c5908e2337ab5d5e9c4bdbfc442da92
MD5 5464507a8cc341a34d1d5adb0c753bbb
SHA1 fe92e25f28f5e421dcd9346fb1e3daf367418686
SHA512 e9618a6c6cac7887a1ed3f28753a666479611376fa3cc97ccdbefe61a17175f5fac0657eb5237a642bb8ab952b209d652ef7a76f3be0b4274170adf853701c64
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3ao6:t/sCv7rTiw2RYwZCUsjKpJshy3ao6
TLSH
T1D2253A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 972KB
SHA256 c194f51ed97886a9f7e51386ccd91dd30626149d89424afbe35ac39ca6f0065b
MD5 ec01ab5a5f3671d8d5bef7461d7c980c
SHA1 2ab9da752e418a27d17d1f090ff04c16f2883916
SHA512 728fe7e068416fcf1eac2784f190d5b714dfa679490fd28b013acd24a99b94bb34c2ed4e02e235bb53cd42661304b449f72b0fc6abb49433d0965dfd37d8883a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3asN:t/sCv7rTiw2RYwZCUsjKpJshy3asN
TLSH
T10D254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 972KB
SHA256 ad7f631c8ad9f063213a80e4c66a960002f38f2f5325acc7776fe35fd9e8cdef
MD5 4a8b339cb252be1f98d2567651508979
SHA1 867444374a9e8ec3eeb3aef76cdc7281ee032cbb
SHA512 75750490ef6324f79ab01f576dbe9371d6449c96730ab8d7cb5ef3ed53e3abb3b0a5b71cee9994e14243f50e6d3dafd0e21513861800ba570f12c4f1ebcbcd64
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aif:t/sCv7rTiw2RYwZCUsjKpJshy3aif
TLSH
T1E3254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 972KB
SHA256 34bf13e4f76efa928c649e78c97931a9516bda52aeafc43d212bbaa09f3c63ed
MD5 5d91ba01674250c30b1eab25a7c668c5
SHA1 7aeaa771b1b7edc6f900d972e2b3fcd65b53015b
SHA512 205cabd35ddec737ecb79dfad86cd2ada9830afc34c10c6c4d5f2dc20fd622697cd8d7d0e4f34bd2af957496c71aabc8c26b5388399f14d889f6142c373d6925
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3a8o:t/sCv7rTiw2RYwZCUsjKpJshy3a8o
TLSH
T19E254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 972KB
SHA256 da14059b0174ba1339617a64e3b273cf5a6239f98b3591e2c5e023d034184252
MD5 f26f341db10ff5abbd4229855c82d616
SHA1 a3ad6a00cbcd4172a78a0e74cd09a067aa0352c7
SHA512 7782551c15cde26a7e5d7da1f8e64661ab163541178e608986f202620324f2f2db1ebe82f6939869c267cb5e7b56060f5fbe97cbac8ce323a19a17d12bb0df3e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3acu:t/sCv7rTiw2RYwZCUsjKpJshy3acu
TLSH
T167254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 972KB
SHA256 66083cffea50a4298c5a948d9eec9f6736fa34c49328e098b9f36be98e6cf2b8
MD5 2af541a485c5c3d3644a58be2979f98d
SHA1 4702dba11b98106937a65e58b0a9a90eba19348a
SHA512 6090e3054c5fd718786b25f0563229116b413c28dfffb51123c814f01b4abf9fe41b76d591cde2d4fb4820762349e40e7b5f03abb73551728b39635dcc3f127f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3ag9:t/sCv7rTiw2RYwZCUsjKpJshy3ag9
TLSH
T103254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 972KB
SHA256 4d3c2bde62814bcd2b62d1e782b7cf4e4d0f0811f03c7114b5721da6066259cb
MD5 dcd026c205ae8cee51d42f9759a7ada2
SHA1 4c8c6fba2bf8b52f6ae33bd4b9512f3fe771290b
SHA512 6dba7ece21210e82f5a2832483dcbfe10ddf199f53326b8a9ba2cbb86da69add5bcfea1c62e35edff0ee3170468a31d955670a1a6f347a2d2617bfe1ed816ee3
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aoc:t/sCv7rTiw2RYwZCUsjKpJshy3aoc
TLSH
T10C254A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 972KB
SHA256 3d2e14e8280f487a9326d54042fe6988be2ef1cb15d7613a2b5ae29b9ffb3484
MD5 9addac618edccfe2284e00519162d37f
SHA1 f2d2a754ac1c1a7cb9b3aea6798e55dea3d486c2
SHA512 62b4cf9fc4def86ce19af0931f6028f32c5a526d6c95c27c2970af53bf326549a815c1b7a5d911b1fab5d2097a66512ef75e19de8277b02e84d43be5efb8a76b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aBp:t/sCv7rTiw2RYwZCUsjKpJshy3aBp
TLSH
T169254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 972KB
SHA256 6aefb1ca20118cbcb6c818d296d88022418924b82f100476905e74bde365fa13
MD5 6c68fc4c4e88243cd4921d37a13c297b
SHA1 9a256fdd12384d4b6081afcf6009861aeb7afbd8
SHA512 578187be2708709d8a1d4355b336df279eae2ca52296811e91fa2ca7253c2df76c2c55fde16d762d6fefe81f7e03dde16a2ecf3ec61a7636725b41d7965a992a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aW0a:t/sCv7rTiw2RYwZCUsjKpJshy3aWN
TLSH
T113254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 972KB
SHA256 c717e8aa3c5b68034dda9734bce8696cb53ca106cec36035c6c3cb0709113184
MD5 b810d858f8d06031c86e62d6ec698433
SHA1 d2a43e21b21fd1800e2f8778fd1a20c5f1484d80
SHA512 4f3735a7a75bc50ebb68641359c22742f82be0ddf669371f959fc9b0d11a4232a1a998c5259539d4990d037ced9b76b1af58a86a6aba520b6732b6eb7a4d0f35
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aaF:t/sCv7rTiw2RYwZCUsjKpJshy3aaF
TLSH
T114254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 972KB
SHA256 16c8ead0ee633ae07feb6b23b9804fe19f02f0f12fe67d700096c225a94abab5
MD5 f044131f9cc56f8d00e7d47bcb72e8e2
SHA1 1c36c59ab2feb2706e8e164d4525f08d490c2746
SHA512 7842579b144d6a77f9b8d1b0ae1b417bea6e2521b5e911b648cb90a41d2d2dab53729a9293afcee3ccb38c59b138664ce528c6cec43863eea772f42387186cba
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3avC:t/sCv7rTiw2RYwZCUsjKpJshy3avC
TLSH
T1F7253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 972KB
SHA256 6cef4e75fca2bd971bdf7ec620edf3b7cfb86f7ebda0d9d6c7e8d3f28439f48f
MD5 4f1160c84b9240ec4b4ab07a1568aac6
SHA1 e7cd6ba50324537cca93e5cef186a01ea0717048
SHA512 055cd3e5bf1c76505f419f74b5abf7bbead84e21dea7dc6b91183732c94e15a991a5c3dd13d092eb022d0988ece2af543bb0abb32bacde44b9d8b7c2e19d0fcf
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aQw:t/sCv7rTiw2RYwZCUsjKpJshy3aQw
TLSH
T1AA254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 972KB
SHA256 bf17d8b78a987524209714c04466d5544ec9dc57ffb3e8cdbb13b99c0f69bd48
MD5 64f8f5aa3889d760ef20d427912bf0c6
SHA1 f5ae1cd9c2f34bf73c1a4c0131c80bbb207f8e92
SHA512 2a742bb5a90e3b5ae530d39a29de7713d5bd295da38fac37b8f2862ce3f8b584bdf746a3f8712ed96fc0b5dc0a5d979d43568e57e122326c7d6dc2fe7492042e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3avT:t/sCv7rTiw2RYwZCUsjKpJshy3avT
TLSH
T1EA253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 972KB
SHA256 a8ab06a78aa48f22cbcf63b4904923781200f4fdfab24f311c4e45c817877df2
MD5 36227bdf64bb70962ede8dfa8290776d
SHA1 889760e7f5a74dffff4e8d08a09f3182fca58cfd
SHA512 17c1a8f642910698ea838f10b26358c6f1f7ce388f9837db8712ca798c8de475c46548f3aa825c4b70bfd5b9722e64a98d2641c4f6451518916b77eed2ebd39f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3apu:t/sCv7rTiw2RYwZCUsjKpJshy3apu
TLSH
T1DA254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 972KB
SHA256 369c8c6d6c58261dc8f1bc7fe522299ab3072a074a38485f464a9223f373c1ba
MD5 9140e9d19319861dd1171619462b8415
SHA1 bb8a1f1c95722ae71ab1834b8e7bd4d3520e836e
SHA512 805403e23cab75bcda27999569ce1345e47160e332deaf72e17558882e1a8bb3c0811905fa239dc94d5d3e7a2fdda1453c42f7030c5ab73061c4a0a6c52ea81d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3ahb:t/sCv7rTiw2RYwZCUsjKpJshy3ahb
TLSH
T1C9254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 972KB
SHA256 97239ba4f2b9260500c728773051c64406e165c0b828132e0bb77c0c12fb21fa
MD5 0d3d3503b9ebde9f001696824ac3f4f0
SHA1 5b21196e200c9b61be46b760ecf4c1cc5f403842
SHA512 e86368f0737c92a6d2774dd6b1c2dc2e29422398196c895240d9237f5609cff82822fc21f90e8afe403683e0a709d53477a1788b445ea2059bed83e2c5a629da
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3apf:t/sCv7rTiw2RYwZCUsjKpJshy3apf
TLSH
T128254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 972KB
SHA256 1598814c6b75469c0bc57e3747ecb764b721d1a88d1f019a0188c0c8cbd8604c
MD5 3636c8abe84af08d674a56331abdfd50
SHA1 3ea28db8dbad51119a1084cd90022b71fb8f6b4e
SHA512 4a784a389bdcbcebb3315d2c15575c01ebf378eab6428c03f3449c216ac38071b1335127f8bbc4a3fb9e88d3a2abe47262e642a6886487464be2e3fd655cc7db
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aSK:t/sCv7rTiw2RYwZCUsjKpJshy3aSK
TLSH
T15D254A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 972KB
SHA256 4a61876f4039b9e972a519cfcc1cbba9645c471d2727db7b456a78bfd7e93064
MD5 e203781d5ee7a222dde4fa3dd7cca092
SHA1 c322a86ba8063802e4ffef7705cbc1f9a2649841
SHA512 b9729c36e4245c372ea3726e82a6b234467daf7198d820424e445801a668b939b5d46952aec7d10ef2e32a206baaa5039d9057252f7d730a55939e4ec1d048e5
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3a3k:t/sCv7rTiw2RYwZCUsjKpJshy3a3k
TLSH
T128254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 972KB
SHA256 6b2c60c973c9f98152437ed54e8d29a150bab12c8a7bb91d010265f043d64405
MD5 fc55080bb81892be3eb46ee6f47ae221
SHA1 9b237d0f270c9491ca6280c809659b337110fcb5
SHA512 1ec476a11cbb16b69da0a9b3b8cc5c72ab24fbaea85172750111599b645c80877895d0a964813fd21160eb7eb614520488b9f35103bd683bbd8ace9ea41d8592
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aA0:t/sCv7rTiw2RYwZCUsjKpJshy3aA0
TLSH
T160253A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 972KB
SHA256 066c3afdcd3ce864463524d9c33e31e0e4d0f583603932869d8b744734e503a7
MD5 aa336661b9f4885701e2a9782195e5be
SHA1 62208d874aa8ddcba5010e538eb065cd37fe1d02
SHA512 e2039b0ad66c7a4d7d6717c5ef6147bb8076d7de2001e586e060d9027816e4d0af966d389d84bbceb43c41ac329d59022ae9e119e205c28565478cedcd3cdc2d
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3ab70:t/sCv7rTiw2RYwZCUsjKpJshy3abg
TLSH
T1B9254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 972KB
SHA256 726a8623e63225f41180b04003ce6dc86599d965489827d084cb9a31d5ed7a4b
MD5 fc34200c83ec1b2477a1e46b28847c36
SHA1 44e39df963547b61c25e2f1c06d611dc903c6dad
SHA512 5f50f14919206e4bbf9c5d76203faef084aa1f267abdfd8b7cdfacf3d3ee2f57e05fef657eeb2adaa4977b1e590a8c3c5c591e79d1b2b95f841c90a07a814325
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aWr:t/sCv7rTiw2RYwZCUsjKpJshy3aWr
TLSH
T19A254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 972KB
SHA256 290635c16955e311c368603b7f4b643c0dd3580acd39b63a78a5983d2b4459b8
MD5 694a05bc748f41a62f9101b066e8ccc9
SHA1 28c41ac728b3669c46673dd6167fe354c0e75a4b
SHA512 d94a69afbf89fbb176aca6399e59196221076daa8f1020089d9abbdec201118bc8ee27c0a4e1178701489b0d6997cb17361bdc803d61541d7fab425356fcc5c0
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3a8n:t/sCv7rTiw2RYwZCUsjKpJshy3a8n
TLSH
T1F3253A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 972KB
SHA256 cf170ef49a990ebdc2891f0a4457457fa876e55b16225176c75cd672ffa375eb
MD5 8cf2db314f4a203d3d09d3d67a159252
SHA1 c3291b59e9ea6d44dbb9da7b83aa546aa60e8244
SHA512 11c036490551d8d6b9dc4d104b713c48762f64c36644a3f094a2358e721935255f176e91cc9ea462a3f633bc05f776821e6ac924070c3e2780d8cc6e820f919f
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3a6x:t/sCv7rTiw2RYwZCUsjKpJshy3a6x
TLSH
T13D254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 972KB
SHA256 9882d104fdeb6633a4d4132534ebb2842aa4ae62a4cfb986307ed8b49a33fd01
MD5 2b26719fe649bea0cb5d7c59c77ea5a4
SHA1 378a7fdfddd1707bb28d5ad78a33ff56367cda3c
SHA512 365800852d123ac2f857ca180e433602c1905ac01b25166988ed551a0ce433e346b51fb275fb75d58d5b55c7e782e8affb10c3df9144f1630284f32663a110ea
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3a8A:t/sCv7rTiw2RYwZCUsjKpJshy3a8A
TLSH
T11E253A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 972KB
SHA256 c1175f54701a717ebfea450ae0a80fea549cecbb73053b5ca5b94f4329078b09
MD5 a57e0f87b5a1bdcfd95a8f730e683c35
SHA1 81613472839dd3be33a18436147b25eb60c00b8c
SHA512 623bfd75e1b90ca9984b8c1b800fada82cf4969135cf41dccbc8008c0b6c332d12a15a68fa0698c2f19ae07190d43f465c9e51e30c20589d7e9d9e840412981e
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3al9Q:t/sCv7rTiw2RYwZCUsjKpJshy3al9Q
TLSH
T1C6253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 972KB
SHA256 ae0ae1a84850ab94377b90d31269f0dd6e987573910a93b82864ab90df16227b
MD5 b27d2d8431c275cf72533d2837480465
SHA1 497e94d5d334785177bea7167f94f320c85180b3
SHA512 7cbca7e810ba555fb8d3e7c182d7d0c37bd5ca027c4b9c249ef40a02c06f662a3bca55cde9c94f6070834175025bf2fab4cd8abb7a91ed12b34106dc80fa8c48
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aQ4:t/sCv7rTiw2RYwZCUsjKpJshy3aQ4
TLSH
T156254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 972KB
SHA256 5b6d6631243f02559e3e1f8e80f834c7261c6d18f73c96868316c6a9ff694b2e
MD5 47a5724f85741a33ee8bd34e98b036ee
SHA1 571dea1e49c294b8f0f9af92a71502966ccbc486
SHA512 d95d26673e175e75b88ecb8f9faf32616f7898fc150be690de66e2f98c3a8c6f2765c5fddaeed0750eb351e711dccdb58c4986aa8eb54229cf3f1a412dd65b7b
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aTu:t/sCv7rTiw2RYwZCUsjKpJshy3aTu
TLSH
T125253A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 972KB
SHA256 faede2e99c69f8bb2b3f7ff1d8d11946dc2111bb0d48dfd178c4167db09d8013
MD5 debbf67f7d4264ec1d7a0e0f7bcc8482
SHA1 f5a1711a2890d950154ce6c3611a28c752da1c49
SHA512 0cf2635a44f26c2e4aaeffa31cfd080bd8da76e87ddd8e58dc51aace33d7ac20341f471a8fca41921293b9a799a2d92bfe7273cd3bed6822a45b858f727570d6
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aOj:t/sCv7rTiw2RYwZCUsjKpJshy3aOj
TLSH
T130254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 972KB
SHA256 63b71d4cd801fd944e1bd8fd2cc7f0d0b7ab0efb3ceb20fc6262372a025ab258
MD5 5ae4b62c0225046f04cef1fdf1db197b
SHA1 814b162969cafcae8f839c7be7efd730f805a76e
SHA512 3459d85c86a342aa5a7df434e45351de68a6778416e7cc51a7915b33b97afb55f353d333894b63954e8dcb86b7a0ac9c98617794e7edec6fe7a68bb9ffaf7a65
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3a7g:t/sCv7rTiw2RYwZCUsjKpJshy3a7g
TLSH
T1F8254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 972KB
SHA256 634a6d8949d5cc4aca8ce9541562340c32e04eaacb9e5ec518f5ca8f9b6412c9
MD5 d31bbd90aac0077baf07bc127e4b9961
SHA1 c078d19d388098a1e070b457472696468f60bb69
SHA512 dba829648ca7559a45aec1020d7545c700f3c21eb641beaf9228d01a647989ac67c05b8a3c8b29bc4f4b3748fe2dbd3c2f404a655ea60a926d3705c39f1f188a
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3amI:t/sCv7rTiw2RYwZCUsjKpJshy3amI
TLSH
T122253A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 972KB
SHA256 f293260436da48796fe16287b51e81194e383e338cec442a05b1413c784e3b76
MD5 0c1407bf09a0d7e9642f5e5f5b753ef3
SHA1 d084912b720819e44808495ca6753eb223b284d4
SHA512 26994c217c18ada8ffb3bb807fc673f2e6e5c081808f70845605bc6e4c9b4c6037013cf9352ed0c01d5ef2bfc785d36dda7ad1032dfe6afd97ab10f7a86697bf
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aUo:t/sCv7rTiw2RYwZCUsjKpJshy3aUo
TLSH
T153254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 972KB
SHA256 a6af7282e502199b3fbfe2024234a7cced07f689f60b17879ee267522dfc11a7
MD5 89e815833d4ebb15b23593f6a7a4a042
SHA1 b3982375a60d110f6b860bd0fa1edd6426d7f086
SHA512 016518296909fd1b8be35f5fbf032594115657d5e648e732b10b1299c7acc9885964055f07e0198aec8744be31463a4f003086a7fadb70ef92631480f31e76ce
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3a3+:t/sCv7rTiw2RYwZCUsjKpJshy3a3+
TLSH
T1D9254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 972KB
SHA256 960e2535b6b6b0325bda53534be2dded281cb0bf8db236f4dc95495f2d9a62de
MD5 5e59a12d76120c56579323c9e41f6b2e
SHA1 b23b495a9a559fa4eab475102a40c9f3ba56d6ca
SHA512 b9f9c32ae45d994393324eeb04d20816252d3b84df578b48ef7c706cb03e8cfb52a8f1313bc7388957832f00afc70f4af6c377f39e5bc7339b5e6bd50e755b33
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aNQ:t/sCv7rTiw2RYwZCUsjKpJshy3aNQ
TLSH
T156254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 972KB
SHA256 6b6422a5a6fe2d167023062b6b3119e69cf6f32bf78f086484e3d954f85c2168
MD5 d32409b697a703548158038b1a31f0ab
SHA1 d5d8fcca1b412fb1865a518c7e550354b4c7da89
SHA512 1a1b3a1ac3a262e8300952106302787b619aa86ff298e129470aabc4fad180c115fea39a539903afcc5aef6367049c35a84a2fa516304c641aa3bc3940734855
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aCX:t/sCv7rTiw2RYwZCUsjKpJshy3aCX
TLSH
T1CB253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 972KB
SHA256 d959eaaaf6f02dc633930742b9b1c6fb8e0b3437bc64f57af9d85f76b4de0d65
MD5 811a28b0940cf20e6fe0f37e90b3ebe7
SHA1 6cd9f06d0cf49eecf5253a288935d6fabe50e62e
SHA512 c3c678e83f4adc5bd0a8bbc9abe013d1082e554a35e84e3e1154185dbc85291f526115b91365fb1f30bc805bfda4c6dfa04bc7503d8d95b7a956d3f064033788
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3akL:t/sCv7rTiw2RYwZCUsjKpJshy3akL
TLSH
T1BB254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 972KB
SHA256 0a6fba4320dee19d2516af66f8131de4eadd4835258e510e641a8cd5c48b4c0a
MD5 a252b4628618026945d271c0d6b145aa
SHA1 54b50fd5cca3036eba74415c6d183d7220ee76ec
SHA512 694a55de0e64e2cdd0972da4d5e841304a17da5fd9ea509d2c3307e64bf909b93c2f12a96b9513c84ca0d8b0a8e5e498c4b3c1d9121d8adc01079dc44b0c54f2
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3aAFC:t/sCv7rTiw2RYwZCUsjKpJshy3aAM
TLSH
T14F254A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 972KB
SHA256 bdd1052d5475bb8c886e5cdfca57d5cfb1bf04af27163b91d0b4b0c0c8936ed5
MD5 80e89cffff2a510208956c587d808580
SHA1 69e81ba85690fe34370bbde1a759c90578b92620
SHA512 46d22a1adb0f6062d6bd7a9bfcdb0954bafdca626024fc7e03e7526cc266506ebff0f78af6735712194add624bc85555171de36621fb8a6fe7ac006db3b592a1
SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPJshy3ahh:t/sCv7rTiw2RYwZCUsjKpJshy3ahh
TLSH
T1A3253A1766EC0895E566A13089F54606EB72F8561B30C3CF12788B2D1F63BF0BD39B69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1728-21-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1728-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/5056-59-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads