d977acfa97a904205f8f83cb1bdc59dad0729e35c8b4d8f32df612fe9e85415b

Analysis

max time kernel
92s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 859KB
Sample260717-tt2cnaft3m
SHA256 d977acfa97a904205f8f83cb1bdc59dad0729e35c8b4d8f32df612fe9e85415b
MD5 f807e8009b807a5cc6fedce559cffafb
SHA1 bb6994dd2117e96ff559b1e4e82b198e0b36a5e2
SHA512 262ba798babee8da9cd88f4b8290819fa662e2790b806e27ea51f3a0fc0e8566bb98da80db3f602756d1b54cf9d122f103a8af59ca9f293f7ff0efa10e82d1bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sasn:A3k03kHRJk
TLSH
T15D15AE03E79500E9D10AC1749AD69A23FB75BC561760A3DF2368C6152F62BD0BF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/916-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c618-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/916-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4100-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-568.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-636.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-728.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1086.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1301.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1327.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1347.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1396.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c618-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-57.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-240.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-259.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-440.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-489.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-568.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-617.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-636.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-728.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-742.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-791.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-840.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-865.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-884.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-891.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-904.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-917.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-930.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-950.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1006.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1049.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1086.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1135.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1166.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1301.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1327.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1347.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1379.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1392.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1396.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4100	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
916	2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4100	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_f807e8009b807a5cc6fedce559cffafb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:916

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 859KB
SHA256 d977acfa97a904205f8f83cb1bdc59dad0729e35c8b4d8f32df612fe9e85415b
MD5 f807e8009b807a5cc6fedce559cffafb
SHA1 bb6994dd2117e96ff559b1e4e82b198e0b36a5e2
SHA512 262ba798babee8da9cd88f4b8290819fa662e2790b806e27ea51f3a0fc0e8566bb98da80db3f602756d1b54cf9d122f103a8af59ca9f293f7ff0efa10e82d1bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sasn:A3k03kHRJk
TLSH
T15D15AE03E79500E9D10AC1749AD69A23FB75BC561760A3DF2368C6152F62BD0BF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 7c5bc7c15a32cb68b485e2e80b97c0056c2c8cdda4abe75aad2628bebcc4f2e3
MD5 e62246a2b63433b6311c0c1494f7c10f
SHA1 5c111133ad86e78bf8cbfa233e000cadd1beacba
SHA512 fa8afe5696840ea6750c0b555fc464db4567c29c59342af7db57ed85a8ced89b14b6186aff21df00370c58e7b58ea55f1f20fd04636e7a21c10d2dd5a5bd57cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sas70Le5ji0hmxNrM:A3k03kHRJUPji0Aj
TLSH
T13B658C17F6A402B5D027C1B9C6D29A6AFE713842173086CB1359C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 874KB
SHA256 54c6b5ac8401d41ea4568c96af554b4efdf7ac69b88b644b2156db90ef19e9cf
MD5 a7a17151d19edcb95200f33b35e08fc5
SHA1 de037ebff2bebd6b1ed3f2fa6073b5f6951b66ea
SHA512 879cd914874892923b83c4a8db41e2a209a311516574d1b22a2fc942a45c7ac172f14841e76792926660a6e4b137d6cdbe3e1b302497d24c365e876e27cd9832
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sasda:A3k03kHRJ
TLSH
T1FA15AE03E79500E9D10AC1749AE69A23EB75BC561760A3DF2368C6152F72BD0BF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 883KB
SHA256 04cab14722603368a146975d1194e4f8f822cb93bb31aabb77199bd0e6dbf74e
MD5 3c394b07399c65412a810f4efb24a9df
SHA1 dd9575effa646483dee5617d6fdacbb02c17610c
SHA512 5fb24a4af44806f24191bb66b4090709f07fb4f21acb7eb3938498096922c43ae33f84d68bb3c338dafa3bec51c23ab447303991c5cda42e80a1ae54d6c6fc75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sas06:A3k03kHRJC
TLSH
T1B815AE13E79500E9D10AC1749AD69A23EB75BC561760A3DF2328C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 883KB
SHA256 1777aebd3e76550c4796f6a48e828205574bf88c17d3a23008a17aed06e66af9
MD5 b53d3f6d4dd60c63b724195171a51f04
SHA1 84a44010c653f4f3c4bb594ec0212149bf72409f
SHA512 da27de1f9f2428287d5df595e9fd7303e260cb7526cda481ccaf7bb7fe6bef2da729936b6b68b96e77f5fc4888e82ce80802ab0938ed60be45841f09d60957a5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasIo:A3k03kHRJm
TLSH
T1AB15AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 883KB
SHA256 60d49d71bbf54652e862b28a2afa1f54cc8ad194c3006d8ac3d7b7798d360f56
MD5 a1f4ca88130a4ff498606a4aa954b494
SHA1 fb72e26701b5fe52b424f3f09296ba714ce9d852
SHA512 9d974c9aad6863080da064f7f88d0453c600b48d6ff3485aad084ff8415c2342597d0436678875f85ecb88c69cc3720b375fe6b6a3cf0eeb1603a9d6ddd51e88
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasYu:A3k03kHRJw
TLSH
T1C415AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 883KB
SHA256 2c991c2ab0f45b5853a237399c37b27ab1db32f069a437c839b5aed1ef76633e
MD5 7e36641d970d95e7dabc9085448d7657
SHA1 8da4f3bd16bc75f04250bc6c8ab8e9fdc47729bf
SHA512 f0923cb3c690c9cf9de2cc0ff793154002bb76bb635286ccb510d7c22830b043f190d07f99424d0db1b5a5ec9a1cc15a78250db920d023599d5b5b3bb56b5a90
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sass9:A3k03kHRJF
TLSH
T1EC15AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 883KB
SHA256 67b08e00d1071c3adca0738f9f23b280eed6ccb43b15e839da2aba6ad72b4eab
MD5 51a10eebd4c5900b2bbbe0936572503e
SHA1 5a8a8f8279270169012b452c92b118759f302edd
SHA512 b13d51d235c28bfb8891ed972a515840b6ea1b61055b22acaca9edbb7e94d206384c6109d48285f004cb6f852bbf450d5ca3c98d1d7f27c991aaed8b15f768a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasUc:A3k03kHRJA
TLSH
T15315AE13E79500E9D10AC1749AD68A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 883KB
SHA256 be32c2aa5dc1c2e7d0387827cb0ff2583e16d2125279e9bf7795970fb92ce33f
MD5 1fd508472da3cc7e4408ff3b3297deb8
SHA1 8f3504e52d0f1d6525ab5f81233843690cdf4948
SHA512 708b6002117a3d1a77fd89b1b512642b47244b4ac7cc4e475c67e94812f58d98090d280a72a6036bab9853df5cd3e4494443a554583c2043bf05e0e680a1518b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sastp:A3k03kHRJW
TLSH
T13815AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 883KB
SHA256 28388cfeff46e47cb4c8b1827f50efed38925b9dbb839a13a24d4dcf10d28474
MD5 b1f2e947295cf15bb898da38c956784a
SHA1 643cc9bdc849e7e94635dfde88f70891fd91cf38
SHA512 22020861ac555a6bea68483bcf8c2401efe73fcc17bd02042713638b98805d4407e63fb678b29a5949af6b03c357a53d625ca30cf4ee7e90429474c8f26b499e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasyN:A3k03kHRJZ
TLSH
T1F715AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 883KB
SHA256 c2191cae9a4b0982239387d176dcb0c5f022df98e1be4b5edfd76b94895d9157
MD5 bc116bf8a08caff2842f2692eba354ef
SHA1 cf902c216677f69a168e46e44673106dd9ca1165
SHA512 10cba400bca4997c7c809e677e4b15ad7ef8e5f9f320bed93c41defe234108f523cd417523f971ccc02465962571c764685a2b78e68dd227a321531300da8d1b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasWF:A3k03kHRJL
TLSH
T1BF15AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 883KB
SHA256 7d3134aeabf58040a8adb6810130bbcaa33a173cfe44cb502e109262c27d5ffb
MD5 f40e13d267a0f0ac1b5d66df26928a6e
SHA1 0c47387c4f6ac0ce64a6730852ca08cb3a14de38
SHA512 e99c65cafee9ec0892cb8b56908ddee18ebe49d815f9301ff522afb07875422dae3253ebf424739913b5f93502ea8d418aadd54463efcc2dbe1e9e1e9dde30e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasjC:A3k03kHRJn
TLSH
T18715AE13E79500E9D10AC1749AD68A33EB75BC561760A3DF2328C6052F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 883KB
SHA256 83c59e7e498a5305e891b93ab909d9f572427c99f6391815b39df20789b34c07
MD5 77141d4a6dbd003240c9f590c3561a0d
SHA1 1bb78472bf7d3c848752a17f8d52bcce67cdfc73
SHA512 fdc01839a73164ad2d7902ae8302c4d91483100a1dc6b66eee1f969083777330c2233c92f6c2a632246599c87f1d49af94d6f469eba1a26aa9a95f7e7ca66725
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasMw:A3k03kHRJC
TLSH
T1B815AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 883KB
SHA256 76d3318552d598655ee27ea38e6112431a338404af60f7b9a03a27231267fc96
MD5 13f5bdf75b05d924aaae354e2efb1eec
SHA1 b2b7d33a9ff787e0444c75e1b007ee34a28d9097
SHA512 166182ced991ce3c9d41b73731e5fa88dbd987288f02739b725987d4bbf06c7f9a8d72d2bcd1d11c8f75f7c1de7162e8ab1ae4c303c19ea7448702a96a4bbf4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasDT:A3k03kHRJy
TLSH
T17115AE13EB9500E9D10AC1749AD68A33EB75BC56176193DF2328C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 883KB
SHA256 3ebf1775f571ea0811ef3a80e9f951d5eb6340f17ae49da0e7fc7f2b0ce0a512
MD5 48f9425eb965cfdf6b953ccf69d49db1
SHA1 2ceeb64d2870061b2e58dc9c002d980029293a4e
SHA512 60d39a36c439be0f1d2614f64249f79c3ce08df60f4df10545d929634e53f292551bf8ea2ad82d33cbab890ee3bfcdae1e0a3ea1b0d16bba0d34c747aaf7acc2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasVu:A3k03kHRJ9
TLSH
T1A615AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 883KB
SHA256 3f459c9632a03726cf397bbf036cb061a8404fbf739b306058eb427f78781569
MD5 2143ec72b6fdbf52082728d7fad5cca7
SHA1 a4997cd64824ab39c49b42c8a2c12fda0288d395
SHA512 e607c436e9912dac711878ab7a35a68af2718eb2cc3ba171e8f6e9baf3635da55f2b145e563286992143d2d9e8ac9c4e37535951fef7f37c493d75cb79a183fc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sasdb:A3k03kHRJM
TLSH
T12B15AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6052F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 883KB
SHA256 86c39efc7f43ff45f9fb8f7a49ec405282d08767c074f5d73eb5726aaa3bd9f5
MD5 3489a285fc6a6daba08471642475d6bf
SHA1 cdb4a3631c398f1977a397a4427e1130030c593e
SHA512 dc5b9534a28de2a13d74926ad17717c53319320d20c8204300d6e49e9a4738a4c7e331c4502002ca58692e71fee816d0dd6c21bee85d32c09c2a03e08886f717
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasNf:A3k03kHRJM
TLSH
T12F15AE13E79500E9D10AC1749AD69A23FB75BC561760A3DF2328C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 883KB
SHA256 69cbcbcfd314280e865edd4b3d2d2d5f4981c6599b11a7a14f093ff509495310
MD5 483e2417811405498233ab1121c3dad2
SHA1 7103988ef108aacf3c27242e0890a017a6e3ac26
SHA512 28d8e77bed08cf772cc11fa50b07312ff5feab602e2636cebcbf7e3c0a085f26424cf24e02be11d64e37889d59e8e4b5f64d1e4e90a9aac91155ca4059a137a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasWK:A3k03kHRJ8
TLSH
T18315AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 883KB
SHA256 237f7e79a41d10d07c74e6bc1fc5a3ed7a7b3df4d5e6b5f9c0ed2b09c69905d2
MD5 5f031dac8f8f5d1b3070dcc8bcfdd34d
SHA1 cd793cac92c27faf9a768ccb61e6d75f6d069e5e
SHA512 a19ba03befa7c9a28eec3a80e1b376ae350aff913d04e076ec55d464e620c8a5ef471ac0279f81add7191aadab9c70a96ab152bc5fe1d082e3d6c0731799120e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasDk:A3k03kHRJF
TLSH
T19515AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 883KB
SHA256 dfe8c6b2085c1ba6fa11dd0636352e6f09105b6c181b3f142e45b0115604b486
MD5 dcf7e617bf99df36c7b25e44f07b4b0a
SHA1 80428247f3f14c1108f3f510f5b53f8b8769cc68
SHA512 67f0ce52e6ec01a591cecfcb4ce668b32910ba157d1d039c640243cf3d74aaa9cc6f85b423f9bf3ac4f0260f0a6b0e7865c1cd2f9bf466f08d9bafb3a1277442
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sas00:A3k03kHRJ4
TLSH
T18C15AE13E79500E9D10AC1749AD69A23FB75BC561760A3DF2328C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 883KB
SHA256 ef5315dd2cc0954f4cc57778645bd1a2f30aa94e78f62500c6feed558997dd9a
MD5 262c2e2bdd8613c850361011694d750f
SHA1 69bc0f196115ea33850b5a986e205c874a9e2951
SHA512 cdfcdb09fc5cb16333c05647601afb96df47f980c43c2888ec4a5cc0242846b78fd29cc278d8bb0db40b7a6e804c335d7946c2c136f1be302e92e1e92827552c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sasvg:A3k03kHRJd
TLSH
T1DE15AE13E79500E9D10AC1749AD69A23FB75BC561760A3DF2328C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 883KB
SHA256 6db03aba3820a7cfe0acaf7778138bf4d60834f1ee473ad9e499bd3f3a322453
MD5 d7cc91ad03d057922ed48762733da3ed
SHA1 b124d5bd9c51b37fc3c302a7b9778cce9acc7470
SHA512 5cdb2403acde3aab164ccfd123ff5e3a5139601a2358062bd142b168ca6bb7c02585483acd54c454d664a915ecdd390cedc4b538e5df3ee48266c5ec925fb3bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasCr:A3k03kHRJf
TLSH
T1DE15AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 883KB
SHA256 1d4b2e1fcb26696f9ee92a67756486b9600fc41ec6cd4d575831826260a54a2e
MD5 3b93f2836300372c5adafa93f0ae2d6f
SHA1 9caeab5959e68efc9936bb52cf9e334d64406e6c
SHA512 aa2d913f1e94b934fa890cd799f5e2f87e0ab29a7563d04b7336af3d7bcf6eeaf49d721796db95b7e3b9b89bc1f3c90b6c3be961e45026ec4eaa3031d45f0153
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sasgn:A3k03kHRJZ
TLSH
T14115AE13E79500E9D10AC1749AD69A23FB75BC561760A3DF2328C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 883KB
SHA256 4b0edaa88c30ccde44cea29e8b1c43258d8e08a8ca2f765620e913d20b506737
MD5 8317ab2ec4cc2720c5b3de4cabfd736e
SHA1 9ff9cfea2134a0686767a662756e56320d5b5c2e
SHA512 728d32bd5fae567c79fdfb0b273124f96759c15777f4ac03f310db85741452fa69a9d4b20992c569ca94df2848b5bfe429ff767e6b41dbff20891d842cbdb88f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sasex:A3k03kHRJ3
TLSH
T1EA15AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 883KB
SHA256 09be5b523496ee6004759c39f19b2f15975d22eec7e8dc571d801fd784ea3fab
MD5 b481142e5e17c059fcba299d57a0032a
SHA1 c235f52e89569cf139544caf48b71936bbd9373e
SHA512 22efdb61c94b8e3cc5dbc93f64207596eb136412e5e6234b9335f2967f96d82c8d45c2d4773ecc69943906e48e977e17f1e43f0de913cc033ae944a5f3a4ffc1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sas4A:A3k03kHRJ4
TLSH
T13E15AE13E79500E9D10AC1749AD69A23FB75BC561760A3DF2368C6052F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 883KB
SHA256 488c321b7dbc7adb76c75abfb591db450a9492bdd2925e854ca19329d194cfda
MD5 6d146ef267a87a8773b137d0a34b3d14
SHA1 a2a4ad11f832e7b28e04e265d425fe620aaa81bd
SHA512 598496136fa39a7b3df858c4a058a661beab2d1ab84be0894ddd5c2523419f6dd0501e4c03e341392e52b93f8dadead1cd4140d5e11ff10cb52851db21cba0a9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sasx9Q:A3k03kHRJh
TLSH
T19E15AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 883KB
SHA256 ee4fa4c02f5636f36058e578a5b4d5584b0930a3b0a892266111ca4d5343d4bd
MD5 c2b90e5a2914f4826c0376919d02ce9f
SHA1 49f4147b6fda310839727729d8b499a81320aa23
SHA512 672f467160169fb73f8f3b23c3aaadb52f2684312554e22f3ad1c7ee25d24aa7fea2688b61f376d53403dba24a7b48fcf5f4cc655223b1fd5eeb4a70ecd6f1c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasE4:A3k03kHRJG
TLSH
T12515AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 883KB
SHA256 1b0caab2d11756cad6382dbaf007ecf2e5f16ccffb8c0e9ea4daac3052b40bc8
MD5 8b1a2516cf22e2d3c860754262d7d6b8
SHA1 4ce1d8bea4a49ab86e8daaf84bf5adc7aa815d59
SHA512 783eea218e52cea5c305b47f138e4391b2180db29887841dcc7217b24a26627c9ff068cc111e6721abe3df64e6ddd34317119947d472338f3fbcf96f1e88d94b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasPu:A3k03kHRJX
TLSH
T1A815AE13E79500E9D10AC1749AD69A23FB75BC561760A3DF2328C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 883KB
SHA256 18fe55457bcff83b87a396ce6fd74e22ce4450f7e652b03b2a4d07f63cbcf973
MD5 a864eda7de4a0c174a8c0b2e5ad2296f
SHA1 3ddec3dc88318beb2330858d56c31986c71459c2
SHA512 cb3091ab7c4c34ec08938c66d8660d6280bfdb612d5573c3aaa6bcf444d7677abfaf2eba8175d3b4dd516066e2d579387e62438ef281d21237002ea29fdb6600
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasKj:A3k03kHRJZ
TLSH
T1CD15AE03E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 883KB
SHA256 d556139ff25eae4816562d16f7595567ff388a2f606894fac43e95f61b445c64
MD5 100e682c17fd83e73cee9374a8f617bc
SHA1 f247cb74b442a7de68aba6afd898a519d5875a7f
SHA512 29fcd8aa55b202b2d4dea9dd2da7845baf3d551858d32b6f4156e4ddf7f121480a4ff35407512afe65644fb03c8741fe56c42a100599fbc7b223898eb2b44ad8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasXg:A3k03kHRJt
TLSH
T15815AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 883KB
SHA256 02fb6f95f2007d28bfd27cbc0ee19c39094830679f3f413e77d14aae0e6400ed
MD5 4880375e6e2197a48d1c3ccdb2990ad3
SHA1 9357f58194339f841dd9457a9279e1d71c21a630
SHA512 e5b5d9e481fa03c430550ed620b79730b2b439126024eec24fec03674ba345b3cb33fa7544f537f675b70b03dfa2299d5112cc8bf149b19b6d434e1a055916f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasKI:A3k03kHRJk
TLSH
T18015AE13E79500E9D10AC1749AD69A23FB75BC561760A3DF2328C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 883KB
SHA256 1b8923c3e3e98f20f54a43ce7180cd2a7472fe155fa990347bd8d5979eec08ad
MD5 17e191df5cf013af9aa9973430c7f2fc
SHA1 6f53de8033264d839aed7064d54be2c6724f1285
SHA512 004f52c9d361ebcb620c24002269134af999e677de63bcd85dae979d452e1f5b541959c7e83814af0aac234fb8d7f95501858c821e68ca7926f528a8f38e4afc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasIo:A3k03kHRJW
TLSH
T16615AE13E79500E9D10AC1749AD69A23FB75BC561760A3DF2368C6052F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 883KB
SHA256 e7f4730c75eef3c7e62e5581766a56466a86ea8798dd4d0ce09e680e3adf25f2
MD5 320dc1d522c73a83ad72ad0efcd25e04
SHA1 3b8ba7a9a70cc692feb1d6c097aec77c5f89984c
SHA512 ece7ae5962f5445b56ab7f33e11fc317c69809cf7076ead9219d3d7e363adb3d3a3e67e675fa7cd6137359fd1704d8b8652875189f195702b1a8c07b58f26765
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8Sasb+:A3k03kHRJD
TLSH
T1EF15AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 883KB
SHA256 d51c1d1b84e7b5173a48ce865399173aa5812d6f6389d674fe09d871088ba921
MD5 1394beafff0e62191c2fcb3ccf915547
SHA1 75514a7feaf127fe9975ca6300fd74ec287f80b3
SHA512 5cb39f92fcba2d3632e1e472377c4ddafe3a104651fbf2cad2681de27481ba0d00b9440396e3dfc368e05ab8484ae390d8f33b12fd012f3f7503a9f2b2cbc2b2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasRQ:A3k03kHRJX
TLSH
T1D415AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 883KB
SHA256 a11fd376ef8e4c129d218c0d0ccb78d4e712109a5388005e4d0ea1516421adeb
MD5 544b545a3c10c469bfaefb12f54d4514
SHA1 4a31f702b9556cc737368f2190bfa830b80f404b
SHA512 45755320fc3187862b937d129e9a011a5f7db59dc2e02ea330af4fa76fdd6b475358efbd6ab29db325a27d8c34851410345f9eda0fd1da8a4dc02cbe3d9387f3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasWX:A3k03kHRJL
TLSH
T1F315AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 883KB
SHA256 6a5262122b70a6304ab7c23c0655dc2879bf348cc77b634f26c2410dbc3588ec
MD5 bc77c50feae5e27bee85ebddd48d18e3
SHA1 11b1ab057c7ba0c795497c85ad9a0d01bc26670f
SHA512 f4028aad59844cae5edc702698f847a3db3a782882f504a4416bdf9dc502e7dd7ebfdf13f03aa62315cbee9430e148d43a93ece7c8ba8023488e393e46448560
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SaswL:A3k03kHRJF
TLSH
T1D615AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 883KB
SHA256 47ef5cd2b48f566d2f440eb8802e11aa35bb85a03cc2a0878ec8a3ed13fc06a3
MD5 467ed3ed80aaec4696927419b30d62f4
SHA1 8ad3bbe1efaae7ac550cac05d8f0fa0db468fa1f
SHA512 93104ffb94915803e69c9af5e73a8b480904ad9f37381ae8ddc53ed566343cc8c5d41eb67afa91b0fb1c671ecf7feaee55ab20c0abf59a7bdf90b52702f20231
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SascM:A3k03kHRJ8
TLSH
T1FF15AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 883KB
SHA256 1e99ff6be92003d2740ad7ff550d8d5a6eb3abf6cb258e1ed82e75d948be15a6
MD5 b2c559bddcc04bf9938aff857c86de2d
SHA1 cd5ffcbd67500fa13c36198125f276faf55db880
SHA512 a51e49359ba2567f15a2740a0d53c95493fa02d4a89d0e8e0357b57d2214c544301771f19982fdc8aee01fd53a617c7e7d46471e0d70b2ac61205fbb479360d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsm8SasFh:A3k03kHRJ2
TLSH
T1F315AE13E79500E9D10AC1749AD68A23FB75BC561760A3DF2368C6152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/916-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4100-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads