7545045e31d80092a2fc0b453b61121e4dbbc297158ee22909a05ac130db08e5

Analysis

max time kernel
107s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 11:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 915KB
Sample260720-nwfk3sa19w
SHA256 7545045e31d80092a2fc0b453b61121e4dbbc297158ee22909a05ac130db08e5
MD5 629cd3ae16b55dd1a600eb85d1330432
SHA1 cbaaa95886358035ce0e5e089eb9c8cc73945cf4
SHA512 e8b9f40eb827161d3dde23f718e2072241b8fa3f673821b35fc92b582445f10ff5595886c5a6e4236ef8416bde5f3f97bac2216ffd575b50a8beb0fba27a5e4a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvC:A3k03kB56r
TLSH
T14F157A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4256-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4a2-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4256-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1884-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c96-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-219.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4a6-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-494.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000a000000018a68-531.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-610.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-641.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-726.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-794.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-843.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-877.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1153.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1185.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1246.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4a2-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-12.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c96-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-219.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4a6-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-444.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-494.dat	aspack_v212_v242
behavioral2/files/0x000a000000018a68-531.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-610.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-641.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-726.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-745.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-794.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-843.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-877.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-935.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-954.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1009.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1052.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1153.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1178.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1185.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1246.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1331.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1350.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1375.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1376.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1383.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1400.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1401.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1884	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4256	2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1884	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_629cd3ae16b55dd1a600eb85d1330432_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4256

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 915KB
SHA256 7545045e31d80092a2fc0b453b61121e4dbbc297158ee22909a05ac130db08e5
MD5 629cd3ae16b55dd1a600eb85d1330432
SHA1 cbaaa95886358035ce0e5e089eb9c8cc73945cf4
SHA512 e8b9f40eb827161d3dde23f718e2072241b8fa3f673821b35fc92b582445f10ff5595886c5a6e4236ef8416bde5f3f97bac2216ffd575b50a8beb0fba27a5e4a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvC:A3k03kB56r
TLSH
T14F157A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 6beff99a849fba9739125b5e5d5dd97544aa0c8b8eac8306a55ecdf1819ae376
MD5 168146c353b75cfaf705b40e13c1d598
SHA1 3ada4e48317315f9d9b464af955c7c2f2d896fda
SHA512 d3d6d2f73e65ff6a9529f5bb6a233ef8cd01cffe74afa0998072f8e14380429adab1ed82f0c59d728e2d9aaf8561bad37d75f19c9f127a9f87213b6db7c366e7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCP0Le5ji0hmxNrM:A3k03kB56rWPji0Aj
TLSH
T121654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 930KB
SHA256 1091671d0ef3486209bc2441a5f9c666ce81f22581ad1652f7b7f23d669fc414
MD5 765ce537fbf402f0d2bcd523f8a87885
SHA1 a7c4deedf187203ced3c3094fbe76162e91c0bd2
SHA512 59db95191f12244303d92a96fab425921382791975d777ad5030ce4c63a21e8288e6c8091e3d478ee0c44ca5a160dd1158a38df0703f6981881360940486fc9b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCRa:A3k03kB56r
TLSH
T135157B13E6840FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 963KB
SHA256 254af905c5f53f46368a89a9267e5f87138dcddbf22915802903f46e3f05d85e
MD5 b43cb3f5dcad2b60af1faa9a41222394
SHA1 bf9761f451dcb4d70f5aa90902e6144f9d99705c
SHA512 263a2aa48b8bcf9569b44a6f1ee002ac904c445d6e6ed5cf5fb1806cb85fe790001ba5198b5617f63bc82eb52f85391c74b1b9d19bfa2eb3fe7bc061ad0ee688
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCyb:A3k03kB56rLb
TLSH
T146257C03E6940FA5D10F81749AA58672EA777C425F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 939KB
SHA256 e66edce516b45adce74f824ca78b2029e3368f2201b8df88849896ae1777e66e
MD5 56755987fb2f679293a5a52cea8bd786
SHA1 2faa65c6381acfc58a8003a0ad0fe6d3344d6632
SHA512 6a1ac4a76c3c6c17c438936cbaf065b9fb3ab080964408ed68032f8b15852596e4d997a0f19609972135cb351a0d04573dffa6d1702447b5363ffa3f6a1b164f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCo6:A3k03kB56rA
TLSH
T1F1157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 939KB
SHA256 4f59cc4910ef356805647c182b616f241880c216a883a7d1973e16fb73f151f3
MD5 d92072c5846ab37d9a069b1d148cff2b
SHA1 b41747c7ab815fa61a29dac44f05f15a94aba481
SHA512 fb02f72da5efb7cb931fd6db028cc90690fea8a152c82c321aebe629058f88b3dbacc2337df96b4eb31f176ddfea144a93f5ef9802831296287ccdd5774c2ae2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCsN:A3k03kB56r9
TLSH
T141157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 939KB
SHA256 a982367a5944cff103a49ee0313f8ffca7c2d0386adaf0d27e1d3564912489e1
MD5 94460b842cf1a019a17d9707032eeccc
SHA1 c415f18f43301fd7597920f7de297a03c3595c4f
SHA512 d0a70ad8cf8b87b8cc8abe65de337e6a5e5f74f01adba178ba6e894692f2ea0511b6db9e54da9f74d8a4a7a4ebfc11c335190f4ce91122d5619cbdedfd5730e7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCif:A3k03kB56r1
TLSH
T1CD157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 939KB
SHA256 af070b9bb0606b1217d8cbf7b2d926b8ae46726a5bc8d004c54709a848c13927
MD5 6c574ddfa7392c2d277de1c402a7e244
SHA1 719ad191da8e87cc758025479313ca160c851d8c
SHA512 5b03287e869325a37e48a712978c514bf9ec05e8cb517433cd9d78c78116846ae10b7fcbc26f7858cff05d21cc35ff107c6d83586f2e7b3b9d725d98803a739c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvC8o:A3k03kB56rA
TLSH
T136157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 939KB
SHA256 fec3f229cf7f4f75982f88056448894761bd32be994d14ab07f5beceff63294e
MD5 08c44c163dc3c0ecd04ec8bc6f7d01a4
SHA1 f69a765fc2a6b7d9266ba1fb6270b65343e625c5
SHA512 31b652a31900a115a1ac44d48f99cdeb73637fa37aa8ee0757c07a8df7bee9208d0c9e52a5236e7a5cea4d9c5f32ae4f6f7b0dcc14b4743001f01c31b466c841
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCcu:A3k03kB56ri
TLSH
T129157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 939KB
SHA256 d8516d5aa310908b4aa480bd1d72654776cd9d1ebe546d277686988ccc00dbac
MD5 ca7ff208e8b698d55e1d022cc6a34ccc
SHA1 9a4c8e911779a7be2bf8976dfff0108d060adf76
SHA512 2de4600b157d6214aad6725575e9de9f6ed1f61bbc005960d39ae363acae72b7247d5eda8b150f49c8a64b00133ef94012feed651ac49ef4e2cc22bdf48bfae6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCg9:A3k03kB56rD
TLSH
T142157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 939KB
SHA256 7969cd270a4502beaea0977a88f17d8e8ba7aa5087684db5a1ac65809b52cb6e
MD5 1ecdaa81255f6345015a3739cf05d79b
SHA1 59dc0387bcee9f15e546ce5d8e35ddc57694e0c5
SHA512 1625a4fb5dc6147f02f29d53a0feeae740561d9da0f8d0e3a29f920907a0d7948b9e50d04f0bd2e1fc902e9fa46e5972c9b0843e3bd0be0d9d41ede736966f66
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCoc:A3k03kB56rq
TLSH
T101157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 939KB
SHA256 9ee964747fdcac558d9c41e913a4f0510b0bdda2a9d625a5047522efbf72d41d
MD5 5ed22bc6e7f46ef7a77345dd14ba1b5a
SHA1 ce0c647f2b222af367b9296200988a3799648100
SHA512 975e28484eaefc03c1c1b9cd894faee341445a7a927b20244ae067a046b022ca993ee4b8e54bfe8864c97eaf9bed676d8bf2ab1de6d925900db0c03188365af9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCBp:A3k03kB56rw
TLSH
T153157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 939KB
SHA256 fd569c2ca6d944b345cfcbfc56456ed3caf59ccf1d64eb007db83d5ba7ba0661
MD5 deeaefe9f39755a21acb1756112ce093
SHA1 cc4d51e603c17821cbbc8185019bd9ba9fed6fe8
SHA512 0d5c60108d22a8a308b991915f3ec7e8fdcc00adb135bd0a9c8748e658db8e73434793fc9f363a8dd6cc0f909ca9cf375746255e3309b89633676c51eb28ee5b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCWN:A3k03kB56rP
TLSH
T158157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 939KB
SHA256 d39c3fdbf8437be7413dad1ee98b85e3b2826634edd4f4e549217f94e6c64ca0
MD5 62c5ec60a8b868c06141fd5615a2a2c6
SHA1 4bed4b1afbccc2f6b3abd74beae854d8c04d3030
SHA512 b76cb82cf714469f369228172d3adb618c905abe268537a7993241ee154d45db91fedf2d685180e2d9fac158d406c2ed86027989f7ee4ab1493c45f657fc5e0c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCaF:A3k03kB56rp
TLSH
T1D4157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 939KB
SHA256 3b896dc001a034a3a08b93bbf6ec2a0d843beaed0fe55a19d504bc71faaf4194
MD5 038dde1c8ed12d1a77e668d0518e611e
SHA1 5b5eb6e9a780c86033018d2c08edae72b899882b
SHA512 024d32d04fb239bbb57a07f7a823ec7748cc26dc8f3c0d9c795bcb2ad37f738786e9d7e3456a74005d3a83c95863d36359d4d778c785a5f896c04a167140aa4a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCvC:A3k03kB56r1
TLSH
T125157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 939KB
SHA256 20e6e51e07ccd1ba96ffd5e38fc94cda5f6780d727b65a0e0d82d990336320e3
MD5 ad04d42af2ac7a6bec1cfc11aa84fa0b
SHA1 4dd648f7adcfa17381b8fd2f9b0a9d0be90b7927
SHA512 c9f7a3eb81ac78c7b4f3499ff90c9988ef42f4d440fe839d5428c8653c0a4b6b593ce9e1f52fbd091889e45eca691638ece45a377d5385d2b6ec325807537b72
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCQw:A3k03kB56rY
TLSH
T136157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 939KB
SHA256 833dce81b4bc1b5dd421906ae7e53a616d47b3dd77a2c7249e4474075c8bc6a3
MD5 47d96caf69c88fc3b266f4e98c84fcdc
SHA1 cc914de7521a2168a897819a263e91e406100b57
SHA512 00f76d993fed692cf538f71f05342a588e9102b9d01d0002fe15f4e3fee42627ddd45f654a7cbf1c9561e81381a4c175bfe30593e37401d5a9bbb5516ed3cec7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCvT:A3k03kB56rQ
TLSH
T102157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 939KB
SHA256 bd34235f330b5a785c614c39847be48a66b258e8aef8b5f6c5784a477fbf01b1
MD5 26236e8cd3f5631200f062cf61c4b2aa
SHA1 e94f3726f64961d8999a5ee4d42c1c1f8af9d1a5
SHA512 0fa0c32f3df21d1d6658ac99a388dd57b62dd7f024b69f0b32f4ae881f43fefc37427b42fd141276734ec8c6ea3dce7366f01b8a864cbee5d08961ab345e3b3d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCpu:A3k03kB56rP
TLSH
T1DD157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 939KB
SHA256 55ad53acfb8e4b217b51e4015b70342a13c6ca07bb0c48f5bbc1d16dc5b27adb
MD5 1026ca3a2dfd3ad5f15cadd1a5a43393
SHA1 0d32b25ba594a9202c168b0df41b9a9c262b54b7
SHA512 23467b05db5befe5fa1886b933fd4edf405b8f618ad420937266407bfaa76123866f7cd8c7176bfdb1f74ed234672b7567c409584415af2eb7abd6335c612183
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvChb:A3k03kB56r2
TLSH
T1A8157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 939KB
SHA256 329ed92a1470ce2560a3c8c9df7d5ae8a3768150a95fc6607002dab41787c8b3
MD5 4f1aff4ee12a763766a0f8660101a4fb
SHA1 fbc21d1d5d63f6ec6de9eacf17675c2286539212
SHA512 48cad91e7c2ec843097a9e35f922d4439a8ae24d75026704875547fe417e8abe60527b78cbad484c1b4cddc4bdab9a1e77e21315c56ab114f7c3bf91527943ee
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCpf:A3k03kB56rG
TLSH
T19D157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 939KB
SHA256 68ff34623373c29c45bab2bcdf291882b8a1392e32ae36828dda336540045997
MD5 51672db0cf43a4d63ad1526612a63713
SHA1 4be4d7b7a586633decc3030a003c01bffc0d2b3b
SHA512 74f677fa3457670903f60e37b47bc8c8050dc2f7d4d16d2d868d04db94f98c2d53fc4b469852cca18787a7bb1adc3790c431758885aec69b59d88259019239e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCSK:A3k03kB56rm
TLSH
T103157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 939KB
SHA256 54e2d57e2c147bc19d6de85965d08394a95e9c5d80998d196ec6dd53c0455521
MD5 162d24c33fbb3e3edbfd3f7037119d7f
SHA1 877e9703cb4d5be0e0c5b28bf2bcaf68de945bcb
SHA512 d3cdbdc908ecdb69104e196768dafbf294c7716d697d01c95958817641554ae8d9d78e36478b2984c3ecba1e3d6ec2d8c9d3322bab6501d9cc0bae317b2a6247
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvC3k:A3k03kB56rb
TLSH
T17A157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 939KB
SHA256 efe83e49b50caedc5074f841cd44953c17a1975899dcd33d56dbda80fa037e2e
MD5 6d356b39611796003e598e9ee6884cc7
SHA1 363b2a8c6165ead179dc0ca532db3afd95e9f480
SHA512 d88f7c34034bb706d85e9e69a9e4ddfca1878f5175b878f414d4e0572845538a782dbe4f724b7c477c0201c3458e67329e41506ea9c85c2d95dba69c890e3f7e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCA0:A3k03kB56rK
TLSH
T179157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 939KB
SHA256 8da478b6015464bbedece016284d0143fd19168c6dc2dada1fb02afc50207cb5
MD5 4f7744cb25bf8b3e7a82054e4f0e652a
SHA1 5cb5ede40b3cc2ecf266d36a0f68f1773e5e9c6e
SHA512 64b6fa5e80ff77f5f0ca3dfc213ecefb4f9aae80d5ad67e32050cc5e504433268894d108d261eac6978cde371a830463809807518b4f4eeaf749bc204f4d3ae7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCbg:A3k03kB56rz
TLSH
T1AA157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 939KB
SHA256 15cd4c230cb3fdb303f5ff8a95aa6ecb1f35e8ca74f79965e0776e609935da91
MD5 ca988edc62a92a8bf34d1c4d5a92b3c9
SHA1 3fe0badf31959ae83e83e80ec6996b13057b2cb6
SHA512 1d018a041224d88f5ad2e1622255be36a468b62f2d2d89ce355867693195ce5b7c6c47d52a7951fc6e2bd43021697f7073701c62ba7f990030675da5cfa9d797
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCWr:A3k03kB56rF
TLSH
T147157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 939KB
SHA256 7f02f628d088cc440163d30dcce5ce294856560a407d433272ad3ba34baa239a
MD5 f30ef41fc5a94a4e8583425a6916b788
SHA1 bbf55111909f866da990b8e80f05f7291ca582a7
SHA512 9370afb174e3521da2f61962aba6f450ce5a5c936090c6a6b0c0aedbb1be409ad42daf4fecee9bedb60076dc5560159092ace91b8cd5e62a8311f687db543379
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvC8n:A3k03kB56rX
TLSH
T1FE157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 939KB
SHA256 5855e4fbdb60a444ec2f39e49ae876b4b80b57290811c0ca6c8d92163e1e2fd3
MD5 fa3c76b2dd369037bc615b8811150f1c
SHA1 322214f2d62a3c54604b68bb82fc830bdf0b2a20
SHA512 c419c70b0f5d35a4349768c0253e5dc771dc41571d027c8ccdb4d382cc937dd7f4e4df4a29ae7606160dd1ec0bbd47296df1fd2e32f52a0a48ba53b1ac491a3e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvC6x:A3k03kB56rN
TLSH
T1B4157B03E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 939KB
SHA256 15d78b249feaff142b37a390a0da3136cf91759c0ddcda65213ec6ffd56e6b7f
MD5 c6eac96e48528152601ad704bbffc33e
SHA1 13228a056842999c23c4561efa6004b3087cd88b
SHA512 746d6a13b8602db156a057d9a535ed647870c5b5440bc225aa894984369257f084bed52b980e1528283d87db8a02cafdc541d4f2c6d13705d4d73113c3c6edf2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvC8A:A3k03kB56ry
TLSH
T10A157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 939KB
SHA256 ff24f189bebb1b6b25ed002e3b9b9ffcce07bc12a26269e13c1eaefabf91bc7d
MD5 2aa8dcad98e6755adccd9bcaf71472d0
SHA1 721e757fef86e3b76afa079b7120df431feb7921
SHA512 68456247295de311609fcc8ec40b719858b7b24b4a5633ee5650ccdc4ef016752d934a9a9e72863cbf83e97d3add1bd25ddd68ae3dcfcb78fb2d580c1521bc4f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCl9Q:A3k03kB56rv
TLSH
T182157B13E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 939KB
SHA256 e2f681366f11605045064b84c59de91e52247ecdb37411a63ff9f6e8fd248a41
MD5 0864e5332b226a0335bd976e9b95a4f9
SHA1 9100fa80c94278626926dc2007289a6787f13fb1
SHA512 268de5e12d0891f03714010cddc622e7a4f38bea948d18eb66b3b7ea70a5978da08b4583274776238882db2b4d0fe9a8b67437b2f8458f61b05e4f000102ed88
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCQ4:A3k03kB56rQ
TLSH
T17C157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 939KB
SHA256 7363dbc42585a770afd7a0dce2b69d5c5ea16ff1ddc32b2d953f14e7b4ff8efb
MD5 3f9778e7ca570077c7323f91ee001476
SHA1 b4f5f158752bd5e46bfb59790fa7ab66e7e353db
SHA512 36713cd5f662cb7c3dbf70ccb35608a73a2e3c8691d94a7f8e63227982c66ab02f40ae6605c9056c4d66c01f6e56ab8c883c2faaf37168c5f33395023bd069ca
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCTu:A3k03kB56rx
TLSH
T19F157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 939KB
SHA256 0e345fb6f5cb6d4be3f8101ce8b26c9a69dc05bd9b9444d4dbe93aa841615f3b
MD5 8f01c4be7bc392537fd117370cf712a6
SHA1 3950c0c79e143dd01a8f0e21769fb0da2bd7cbc2
SHA512 c85414ec3a38e193db4fe989849fbc6951e1e02db709e54a69842dfb998d23c7ccde7a4621618f5db7194e4031f12334369839bacd10f75d6de910bbc82d6220
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCOj:A3k03kB56r7
TLSH
T180157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 939KB
SHA256 e902ed251e03f7e3ea79c60b4eb1ed7f9de26aca6cb6d79b9f9ec5d2cb87e6b5
MD5 fed1655699030c691b73ee25f97bac99
SHA1 c07a5c0ba1ad4e55ad2db863d099fe2cfa0a8074
SHA512 620fd6e32c3ee760f362c3fbf317fc134da6aacc2d0b65574b6a97815b2d9f725e6e2b488da4e50d2ccc8b02e44c51ddfa094d135fabc13bd48e443fbd933a29
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvC7g:A3k03kB56rz
TLSH
T1B0157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 939KB
SHA256 2be99bd9876b7fb404a0b1296c91b9e88607fa7ceb0f898c727d68fc860a4f35
MD5 899a8f61b0910049eb7e7a3c0839534e
SHA1 f7d9a2e97a3cfb805d76873d0663f29fba2a4854
SHA512 4efda3be954ca3c28e90f3ceac23ffa9e30db43b1cece0d27254cd40b1ca9d1299d132effe16ba2aee3845b0f1ed132265314ed04053a775de8e228151c2ee61
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCmI:A3k03kB56ra
TLSH
T14F157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 939KB
SHA256 9278e5d00e2b5d6304cc3dc8ffe38f180f46f80ac4f288c484a387fc05597447
MD5 876ffe6365525b829e6654013bed882b
SHA1 712b2664e592a8c470749ecb505fce6bcaf4628f
SHA512 30397feba1c19f7a5c661fd81c51c26bf8a237b3ac1b0d189a496973bf01a8c95df531377948e93604b121685aa817b730878ce4c7380797f4d3beffb87bebff
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCUo:A3k03kB56ro
TLSH
T17C157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 939KB
SHA256 ee0e61a2f7ae5abdd3b4240509e363380651fcd12f8a55a3bbeafa1f1fbb58a6
MD5 93722408dcc44b08511247c10dc86c55
SHA1 59e65db65b586b20a206501fade3a9c391eb7b23
SHA512 f82b64701ff329c38a682d20aeafe5be368d6b0c5d9589d04130b957a8e6fe9ada184e19626774707d654cba9414b9c58677970d85276370c751d532c16ca67c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvC3+:A3k03kB56rV
TLSH
T13F157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 939KB
SHA256 a856037692c32e3b4257504cae61818e642b04c26a06ebc57a9f8e9897b09b0a
MD5 74b2aefb9744bdf11625a2d7fbd66a41
SHA1 a2e57abc0359a807253c2ced0be65e94637c99b1
SHA512 3f4e8c2368c29a0d5b0db6d401fa0063dba960005961bdd51f3df34b7800bb4a81fe9cc067072e6feb47c9900decd088c088db707cd0172e1aef7d2f9d301ec4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCNQ:A3k03kB56rd
TLSH
T117157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 939KB
SHA256 c480234478a0ec93fd7a026fd9880fcf72119a7540b237794da0fe5a428925ec
MD5 73ec9ebef797a463cc06b372b0311c8d
SHA1 8b1e1cb70018b5cf0a2261fe8e39544d928f326c
SHA512 7b31c1fe6f415429361e9f6413b44fe4ed2e70b85a305bc45d79c7cf2abfe004989e69f105d8c32a6b34b2f38013a49ccb52399e8823ad761ee99ff6d80db769
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCCX:A3k03kB56rp
TLSH
T161157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 939KB
SHA256 9adbb56908482455549b1d47441ba9a678aba1541df2627d834f48b210366340
MD5 5f9c8e58c6b9e063f5964f7bfb52b8e0
SHA1 770a4abe9c5f46dc0ea6b823646e56f5bf10a869
SHA512 c860dd12e2e10389eb243b8ded036632e5a9cd6d0a9e134328c5dcc631ef6e4c7e80ce532dd4edd98b32b03b3cd481a01b65324b1c4a6ac1f5c325198de38fb8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCkL:A3k03kB56rj
TLSH
T1AB157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 939KB
SHA256 15218f5bf5cf0a5be8c565cfb82b51e06748a6d7114f4bcc8de06f32c0200267
MD5 4db9b08e33a932a443e02c6794d2141d
SHA1 83af286c64c89bf80ac73d7e68c14f174edb7581
SHA512 926d466c47a9711bf61fc92f764aeae9335afcd28c3d5c8e50853e450a09d492901cad2fb8ff5be4980d0b85db20faa767c580041b7c1d9caa9bdbf536b378c4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvCAM:A3k03kB56rO
TLSH
T162157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 939KB
SHA256 49d413d99ca0cf90817a2f365b6d22548b7a3b9fcfa1ac5a9dbf113e9db29763
MD5 8b2337a44902246ee0a7479f440c6662
SHA1 bea945b6dfa854e4478852e3ff8ca9e3a70efd3b
SHA512 c217426c21612378999814e8ccf64f5917906361d6cb36dc1b3a6daa846dd911dd2fb76eccd2d7567f62c85ba9c45ad1cd9a55821f82427bd75b8e4f632382a1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLvChh:A3k03kB56rg
TLSH
T19B157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1884-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4256-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4256-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads