8df75095adcb7381ad35f5f18195ad4838137db944d1dbcff40ca8d5dda389f5

Analysis

max time kernel
93s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 853KB
Sample260718-ff72dsb12v
SHA256 8df75095adcb7381ad35f5f18195ad4838137db944d1dbcff40ca8d5dda389f5
MD5 12474babb9e5c39dac84064c2a58463c
SHA1 62a3f44bb86eb6b8135dc59354d0cdd01509b4aa
SHA512 bbac9e0c52d6838810d707e3beded59951e6fcbd2d6d72d5ef6fe6225b37a8385dcd2fe131bd16092fa93cd2341f82357ae369b0562626b88cb00af4367b582d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTR:A3k03kHRJ
TLSH
T1FC059D03EB9500E9D10AC1749AEA9A23FB757C56176093DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/6004-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001200000001c544-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6004-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4188-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-240.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-489.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-544.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-605.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-624.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-721.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-853.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-917.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1396.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x001200000001c544-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-57.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-240.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-259.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-489.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-544.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-605.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-624.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-721.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-853.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-898.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-917.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1080.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1123.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1396.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4188	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
6004	2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4188	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_12474babb9e5c39dac84064c2a58463c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6004

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 853KB
SHA256 8df75095adcb7381ad35f5f18195ad4838137db944d1dbcff40ca8d5dda389f5
MD5 12474babb9e5c39dac84064c2a58463c
SHA1 62a3f44bb86eb6b8135dc59354d0cdd01509b4aa
SHA512 bbac9e0c52d6838810d707e3beded59951e6fcbd2d6d72d5ef6fe6225b37a8385dcd2fe131bd16092fa93cd2341f82357ae369b0562626b88cb00af4367b582d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTR:A3k03kHRJ
TLSH
T1FC059D03EB9500E9D10AC1749AEA9A23FB757C56176093DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 d7066743426dca11174b6f28bcd347505063547f50126e96914fe12437095b20
MD5 722577eecc8a7f1869d76bc69ea48d60
SHA1 562f7e9ab45fcf3185e4f2fdf8c25b039d7168ad
SHA512 0f6212b76721efb47c3d735c63a1ffb28e456d3942c65ec9883455c39d0b683761335e80a5e0ab278cbcc85d66c510dbee469e3e580def7f53404e04c52a8cb8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRP0Le5ji0hmxNrM:A3k03kHRJ1Pji0Aj
TLSH
T170658D17F6A402B5D067C0B9C6D69A5AFA713842173086CF1398C7283F67BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 868KB
SHA256 00ca6bb4ab6960d9f00b26859f81643346337967ff2a9b77f1f2839d5946e05f
MD5 6369494dceff24942ba4900f77dfc292
SHA1 9e6e83a4594a7fc95108068101bf78f37224fc2f
SHA512 ac43f6d13b03e3ec2f4a864f23089b230effa6c8e9b528a2c11d87e57345546fd2473a986f994b67666a40c99f17b2335f890299b7a03fa761ebf6f03ee4bfdf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRRa:A3k03kHRJ
TLSH
T14C15AE03EB9400E9D10AC1749AEA9A23FB757C56176097DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 877KB
SHA256 6f83eb6017b2b3cdd226ce71c433133aa28a744c617d6740d6ad536accb142de
MD5 62748c717328308ca8559e689a1255c1
SHA1 adb400c8dcebd39f9f8184bddf964c5f71f02d41
SHA512 92e28dd1b5b2e79cda737651e2aeb21c9de5e392b7a088742d4a477f64283058c9b846a37ef887dfc5aa28848fbd16ee8d617dfcba9db90969d1ccc402afb0ae
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRo6:A3k03kHRJx
TLSH
T14715AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 877KB
SHA256 43f0d8d659d5264681e04f0a7e20acc06a87c04464c8182848589cd53b4c3f63
MD5 5b1a2d6f006024a8c70da4908df0866e
SHA1 18ecae640cd923ef431290b67727d63c90e07fc9
SHA512 daa5257ca2cefe218c6d31ae0b15ed02994f4c619543059693c5b3ae7fb5ffcaabc6c3860db30a1199247cc138f92026c5381c838e02cc49bb91647b5112c18c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTR8o:A3k03kHRJt
TLSH
T1C215AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 877KB
SHA256 515926bb0347a6cd47491e2d78757e2f8975d51e6e09d8bf7721499d94287e69
MD5 7f17ee899f41d62ecd0189ae46fe7136
SHA1 492cba00dd7c79e3a18d3b5024fef6ad90d2c5b8
SHA512 b16afd245359ab6f751b564bcf2fe49f8a4eb1255dd99d103379f7d70a595f7a806f3f636828808365157420a089d7fce189aba586dc86c6fdd90eead18b4129
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRcu:A3k03kHRJf
TLSH
T12A15AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 877KB
SHA256 5397e45d46c98c4312a99330d852fdbd1bdadbe030dee2513c7c6bd6502368ef
MD5 2a9b0a1bb9142e7f38e599f885b9836f
SHA1 0a67aa035cdbfb3df61749577c7c97ffa1e8b3b0
SHA512 16893079a5c3f670aa066efe1278420304d205108bee6fd340758299ede7019181b889767759165e7d1d21d563ec40c20dd2a0c25400a3431aa7b70f90464950
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRg9:A3k03kHRJe
TLSH
T17315AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 877KB
SHA256 11e70b63e78897843c8580fcb81ac6d4cc29a53605eca19a2dbff3219d956981
MD5 33df18d216b231e4bebfe2188fff35fb
SHA1 5012afc956a3203f27329dcc6941a4d2ef58d333
SHA512 6601af39a0938cf2eeb9d91b0a89262f9a57329a141ca4b130592a0d16cd00af08cc69f1d096ddfaa99d472c8d621ee66ca0020324fa0a212bbb8916dbbe5ad8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRoc:A3k03kHRJz
TLSH
T15D15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 877KB
SHA256 7cd17da1c962b476bee1307cc7c9eaff7db1af880b4588dbbc5a6f6ee6d787eb
MD5 e52f2582a5237dac608996437eb39174
SHA1 b3c08503efdf942e9ee230b59ef81d910d36e44b
SHA512 e55816a59a1140cbf1580c7430e82a5512fea7cef91a3ceca00fe3e0d48a9f2b8648c6b605e90d704cc3b0b15d389fbe1ef04eaa85dc101a8f02c471adef3e2b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRBp:A3k03kHRJR
TLSH
T15115AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 877KB
SHA256 d2aaea10fb11ba089db3732df3476d3026368222d6cc1a05e319f4f901ddc6e5
MD5 526ebcd82698ba1672d45026cc611f83
SHA1 7e55a77944de9584b6d4c410a45c8764e0a3aeb4
SHA512 c018c5d72f3111fd3dca222247fb0e782ed0f5269300d1e0975fbe83cf066914cc5e1bdd901177ee041b260b6be0eede7c5dae25ee8d51dcd1a7cdec565efff6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRWN:A3k03kHRJK
TLSH
T13A15AE03EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 877KB
SHA256 582733edb2f451a2982365b15d236762d1725fa9ab48c2ef327d93b64c0ff5e8
MD5 d9c5311fabda2e60b95ef7890c325edb
SHA1 d7f9083abd2e6634d2185405d581a1181a7e9e2a
SHA512 8d207c564c7fca3560acc6b1dcae11b739ce8793f44598acd4fb411d0c0da631265f5a5e886286b091fe9a5466868d53e02c977ca90a6a0db5443f87839d4e88
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRaF:A3k03kHRJQ
TLSH
T17C15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 877KB
SHA256 f00cc787e2f2b7a2926b719102b296028c688e3b484e55b526003c2854d48ce1
MD5 b57baee1259f652660b2a32aa686ff4b
SHA1 34b3e96bd12a3c7246b6b4c4746940f1ca5d7f91
SHA512 f46f1f7e5eb79fea7809e037aaffcd0f3e59e54f8fe1a6f263d6dd4367f284acc8afec627578548e42e2e9691f1dbdb3b66f80efab8301a413de295ce69974cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRvC:A3k03kHRJk
TLSH
T11B15AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 877KB
SHA256 c93736afcd535c4106fd4a55e8c889c7fdf07ef11234d0741065dd9e438c86c6
MD5 660a2bee1f7f5856ad51230625b62370
SHA1 6cf3c8677602a41e78551c46108e1523900bbc31
SHA512 9388c7ee3fdffd6bcd2fca626f1e1782fd38b14a3ae2d13117021a3dd479408ecb0c78fa8ec804d6c3da5c27637b562665087199da009c6890d278036a860a4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRQw:A3k03kHRJ5
TLSH
T1D815AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 877KB
SHA256 8e1bf03e83589aecdb7bb9383b229568d3fc109f9afd4942c9e90a3014e7742e
MD5 bb4992976f0d6f4807a37054f852a79e
SHA1 9fbd7e085b145f7cc5bbd84dd01e5a3998d4d7a5
SHA512 44350d25a41a0a225dd482945d03505f204102d6eab7b8a6c216415ddf97ed31a3724538c3266d2d0f295c2eb7b8018dd850cb9b66069acf68d74c6861ecab4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRvT:A3k03kHRJt
TLSH
T10C15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 877KB
SHA256 72869c95e72cbb09729bc0cba08d9272fc600e9258fd01981de4ade312aa9f87
MD5 9e02907d57aafb6aa1b78a5a6e6f42b5
SHA1 cfcafae637fffb10d5beed8aa053f7910f978e95
SHA512 5b8ae1bb0fc0f35224ca4be698fcaebe31c16a462cabdd5e25dd621c27cf81ddf4874e569fa13a2316d5fb5785476c85da7020142921566d1aab1981a69918ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRpu:A3k03kHRJy
TLSH
T11D15AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 877KB
SHA256 2450e4a2f6b16008cf2f3702f50f634931ef3d30868f354ab091df19d4c45a9f
MD5 18dd8e033e471438d0e20b7234e3f8fe
SHA1 612b0337092007bd301c11ca447d4201b8ff2f4a
SHA512 3e12320b0be8518ea75f89efbf0743ed53d309e0ec4088d2d0ad0bf1b097eea125b1e9be162aa0ac49837c84a605547b508bd3f170e8ea8023915c3e7a67df06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRhb:A3k03kHRJj
TLSH
T18E15AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 877KB
SHA256 e023cba229aea87993ce3176a3f529f5cfa6ab28a85d754afb81ed9dd4bf9c1c
MD5 e634fdc421a2d448dfd1826b244f2279
SHA1 6305f1c223d6e5d2925af9814877a94958603f7e
SHA512 bc501924d72133158f128927d8cc8fdc385b8e088c9499f417563a00782774caa1a593cd7ab6f7b583dac3cede0ba64d3f18c6cd6ddf7a040ffd1e1067742587
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRpf:A3k03kHRJb
TLSH
T1ED15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 877KB
SHA256 28ba74bd3bb465b1654729d32e395434d4a459f3acc9227d10107f6e4b0c7eb2
MD5 8f02a6c7c6183be315e9fd8a7f800ca7
SHA1 74848cd735a6c673efea68bd4d23c3d5b1dd194b
SHA512 68f2b58bbbe91c29e30a16c10a2d6a312dad32da7dfae3c1035402fc26558e99fd8d40c5713d78847978ad8a3213420b3d5ecd44d0c17bf57dce1128756ce1a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRSK:A3k03kHRJL
TLSH
T16D15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 877KB
SHA256 129a14d4ec0ab6517b84ae7d5f5b24ead08e2e07c0b47d8f5f795a86463d7284
MD5 3d843adfdfb3e9be585c03c78e008e88
SHA1 e3c291c7e10b1ca8aafc18591033dc0e34fcaa67
SHA512 ff0ba320e30cbd4cf1973dc15d9cfdb8285c1641f833b5c8aec853d569dc0502fc1e8620d3d907ce0294430b7e6cab7f0cd9601eddf9af823e4de275b4210a33
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTR3k:A3k03kHRJG
TLSH
T14A15AE03EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 877KB
SHA256 9c376ce91565fadc70ad89c9eb86075e09464ae0385cf824b5062c7ac5b0fe1e
MD5 31876934b49b0d5180c33e764563e5ce
SHA1 a49982daebedf25d9dc7763cd54a745f4c21de1d
SHA512 9633acbdf5e226cfd4be89c49b0b74db6a661e7c1d37f9a3b75e4e2202d1b07f3d71463057c9635088bd57d0b763f80dcd6519ba278dc5f3c03bf641fa3649eb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRA0:A3k03kHRJ7
TLSH
T18E15AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 877KB
SHA256 982b198ce168353c036ec768d974d724673558453c8b5cb7953a02b329010756
MD5 4a85645f474dca35062f0403b5938beb
SHA1 d11c272c7139f723b3584c69542f5ebc84da6137
SHA512 a47bb71b8ff23b06ea3c6ae2bb74c97f9ddd89133c9738f214c4958c2d86639915278dfd3871229680e7ee448ec7c2783e598d0ee262169fb0237aec36032e8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRbg:A3k03kHRJO
TLSH
T16915AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 877KB
SHA256 7b53289e29bf610ac8da94eaa7df4da15b833c6dd1c2038076a2b55c298be3e0
MD5 cd3202b605d07017c20ab627ff6918f9
SHA1 c928c57d40c8d4449d1add5e465318a8f415e9f4
SHA512 7ec91f84b9b654f47f4b665674735a2b3f8cf76b154cbd50bb91ebe28723d8a3c2aec5245de65baa7b39f5f79c089a499ae37e72850234fbf02cfd22d734f27c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRWr:A3k03kHRJQ
TLSH
T12115AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 877KB
SHA256 c9c3ef7cd81a33f3ee1d78f76059a561508571c38453e07951d9f8a3779229a5
MD5 104b931a672a0cfdb44a17ed4cdd973e
SHA1 78ac359da1995f5323a0424ec46433b7b8ec95d5
SHA512 f503bf9b31f717c222c94392c532ce7eb911ed4770ca3f6f3bac1db883a57876c83269b409cf6ec10c64d188bc9495acfcc07a227d503ba19bec9d68103000fb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTR8n:A3k03kHRJC
TLSH
T1DF15AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 877KB
SHA256 6aa02060f821f8924c7ce414cabdb29c5745b850e22dfec5ad1d9dfc585fc84f
MD5 b308aa514456c1c4076274601283e3e7
SHA1 fa21bc7ca18ad0f156068020b461ac33b58e0712
SHA512 7d2d8757d85ad09f1a8bb3586fa7deb59c3135b953ac2c1bb938878d3c61a37d2e5155edeb4dea634a757b2ac9ec01ffc861df0f186f9db6cd80422c549acdbc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTR6x:A3k03kHRJw
TLSH
T14415AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 877KB
SHA256 336f56af46a368b8eddec1285776f941eed36115e2587e2565310d6982e87778
MD5 a60343c745890d31f308574d8407a8f1
SHA1 9812d07bdd2845671df60103b6ddc7ff387fe966
SHA512 96ee0b85ab9ac55563779db422483d2db518d8ff653cde8563cc1bdf64adb3fae7d98101045868150eaa3cbfc9449a2bf90dd3b533c93946654b2a46ab87ff3e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTR8A:A3k03kHRJT
TLSH
T12115AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 877KB
SHA256 fb29e1fc9f8e7368b026e7758dc7f38a49e31d4b51603dd653b30b6c7965ff85
MD5 cca33d02cfaa968a3ab39e978caf445f
SHA1 1535a3c0d021a572d653f9aa193e59ec8528ea34
SHA512 5211cb7c71750972c1f76478cd2990ccfc08b216a5d9bffaef3a956c38e8aed05d93fec9e1f3a62eb854c5ee39c50e2cd25452aebd5765ff605b48f55fe7efd7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRl9Q:A3k03kHRJ+
TLSH
T1A315AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 877KB
SHA256 a2076f1a98571847bb29d128e1846499a93f06701e326881013ecbd9230d9d08
MD5 e523f698143f8305ef6d09913a88c622
SHA1 924b9ce028a85b1c4e95de95f96f84d926b8628d
SHA512 914f3139541252fdfd701c0b0b46bc77d9f77422e305f5793235362441477170de3f79e35a010d7ad1ccd189a9731ccf13035f85864ef59fb34a924f66075ea6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRQ4:A3k03kHRJ9
TLSH
T12915AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 877KB
SHA256 7ebf60a8d995138fe88c207a6c3324f005aab7c6127aae840be31f3901cf1471
MD5 991578afbc839e875fd1bf6e19fff2f9
SHA1 10c24f159f1290b85e7807a26bb00f667bef759d
SHA512 df14605f728c72d9e7a521bd5544847b8a470ec3e704a77d8a4077f66880bd1dcaf53767e3bc9cb741e8daeff71ae7afa01b6b230aa0916dd5a6a65dd38835b5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRTu:A3k03kHRJY
TLSH
T19C15AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 877KB
SHA256 65f6702ab29e26a7ae44ca175b0714eae2641fc4acd10f286260c876c3afa933
MD5 681430614cc77a7b45e790ecc8ece318
SHA1 c2ed7537e2d98097544f2acc36fd5c1d15267000
SHA512 cd3c31e9099cb25c9b352c08ea48c10a2d40e330673560ce6ac38049e2687a4544a4fa3cf64f8786cf97acaaee1c313654830a06ef6a72f5e80013ad87cb56a2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTROj:A3k03kHRJy
TLSH
T11015AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 877KB
SHA256 7a037468feb4d8a88bc61f338a9708f54c66920e9c762999e8ce85ca4ef2e4cd
MD5 7579835890e7b3ab748f6112854ee907
SHA1 f508344020eeb171c4852513a36cf9a0ef0d1de8
SHA512 26e7aeec73c364ad0aec2a3386ba294e4cee716346a2627d1bcc88a00ae6f035d73bc5e61ea0c961811c62aff9920e663ece853261598dd77c184332762ad650
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTR7g:A3k03kHRJ2
TLSH
T1AD15AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 877KB
SHA256 0dee90fc9476d989e0402c50ca22264b5f98a042d613b0fa7ecdd30ea599d759
MD5 4a3b063360373f6e8e495e46e8138a71
SHA1 213a325eb6dd0a1c845098956e10a54c565d56ee
SHA512 1cc02e842845fe63f8e44cfb05bf17abf08989ae48cc003888b84f89a7d15ffeca1577b44452ba9ff19fee15ddff40fe99dac317369366cde1c92ff2265f5530
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRmI:A3k03kHRJf
TLSH
T13D15AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 877KB
SHA256 0c5a26e59df913f6b7b8c819752e3168d67dcfafc72ca8d4e30e77e9bd44e966
MD5 0ec0ec3369ade832c1181881893737d3
SHA1 b31f6b49b8ba5bd2be074faaff04da8b8ae8de84
SHA512 70a92223366e8aa1aba3b8ae45773fab6bb0252963c2508bf2e3b88d1a24757bfb966a24e597ff20905e2be9a221594aee150cb3d1777ae4bc2a5e7e5354e741
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRUo:A3k03kHRJJ
TLSH
T1D915AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2358C6152F72BD0AF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 877KB
SHA256 72e2db014f7f5c779f442c584fde8b9d49f2838856fe4a906ffc3149c1a3a6bb
MD5 500265b39a862e4fbab601f683dec170
SHA1 809a4805825ece9e21b080c530da644296af2938
SHA512 a86ac6810c3209c2eb8db2ecb7f4e31806c49d5ab996f646688d651939093daf78c5d0246db7d7f5dc0b22b1b6f17b97bf1ef8088551725ef9a64dc8611ab7c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTR3+:A3k03kHRJs
TLSH
T18B15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 877KB
SHA256 f3138ea019e64a36bead41596bf30e49bf8e69c1c299e7ea8a9bda12ae2f8a64
MD5 3c647f1b544bea178c681e9ca95d7f96
SHA1 84f778321fb903bfa887b55f45d2efebe45470f8
SHA512 76eed3ac469342766e3cd260dc84c14251ec07206d6dddde1c487abb31214de0f323a7495a023a6b7296bef5191193023fed00d3e38877931ffb25cc57d43bf2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRNQ:A3k03kHRJE
TLSH
T15315AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 877KB
SHA256 61c5dfc042535f44e6973db7c3ceda52603c50bd05f1ede3bef9ffa02a382218
MD5 020f274123f82c6f3118d04222da9173
SHA1 4ded8aab65ab1e66d9cb4f7bb63ae9bab8da6590
SHA512 81dadf08630cfecc335d0c65130d0af960ed45aff7679d9656d7fe660de0cfef8c77622364ea790ad2954e331040daf77838f2e1b3fbc5ee35284ca621b2a2a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRCX:A3k03kHRJk
TLSH
T15815AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 877KB
SHA256 a4fcbc6ee5d4e4376c4ce4e02ba02d13c54039dea61c38bfb608e872bb70c131
MD5 7a70d40edaf6855cdf673fca6eda85b7
SHA1 1882e02ba7517e678bcecfbb12daca406e633cdc
SHA512 8e18f390d6f44d605ca3c7527cddf1dc7445eb534d548eb1f00ff2e2577cf3377a4b7353d73617afbaf402ee34debc1d0e61b85d3530d23e7127012e77bf08fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRkL:A3k03kHRJ+
TLSH
T12615AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 877KB
SHA256 25227d0944a643034a69704449f609bdd877dc4953224a8323cddcaae2c2a3ee
MD5 a27f92c0bbede938715de51efdfb04da
SHA1 aef45ade4c233efe9dfa163368682381ee256461
SHA512 d0742e5d857f9a2e3cc53becd555c1e60d9525ddd56234be51aec2db6cfd6d94931fbf014b31e36d750f3467da9170d19962c3f905fd6fb52442c5b8f1aac307
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRAM:A3k03kHRJL
TLSH
T14D15AE03EB9500E9D10AC1749AE69A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 877KB
SHA256 fd32b190507dca389e2288155eb4f7c7271945effa3bc3922d42c2893abf3a81
MD5 fbd1524793621191b1b2cde288152ce7
SHA1 352294850723555a30583db2544cffc60656a7c5
SHA512 0a31539cc4b419fbd1b9d8d40e12db8155390e2122d92c0ed96ff449689b5af6cc44e5cfc116214d0773faadb1ae714c38d531acc1838a91798510bfa46d7f78
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8AkTRhh:A3k03kHRJF
TLSH
T11015AE03EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4188-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6004-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6004-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads