e9f1f1fea1ed3e4506d07f7b9a65271d2f6755ffae264a056c71036eb0d2be22

Analysis

max time kernel
103s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 915KB
Sample260721-txsvpacd63
SHA256 e9f1f1fea1ed3e4506d07f7b9a65271d2f6755ffae264a056c71036eb0d2be22
MD5 ea6af1a31863cb110bcbd932fe0f80d1
SHA1 72a5421e9b77b0dae511d5fd8feb04c1fbce1d63
SHA512 0996a5dc4fa0d4c667ecbd8da9580ae0245004135bbfe0d010fb737f3b2485874468d2c67a5689ea9a5ee32ef428bd6cf11eae732db4162e96928bbf14f70cbc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3c:A3k03kB56rz
TLSH
T1BE157B13E6940FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4304-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c58c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4304-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4944-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-620.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-688.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-780.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-899.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1007.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1087.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1212.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1322.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000e00000001c58c-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-620.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-688.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-780.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-899.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1007.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1050.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1087.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1136.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1167.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1212.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1322.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1366.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1373.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1380.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4944	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmprph.exe	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4304	2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4944	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_ea6af1a31863cb110bcbd932fe0f80d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4304

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 915KB
SHA256 e9f1f1fea1ed3e4506d07f7b9a65271d2f6755ffae264a056c71036eb0d2be22
MD5 ea6af1a31863cb110bcbd932fe0f80d1
SHA1 72a5421e9b77b0dae511d5fd8feb04c1fbce1d63
SHA512 0996a5dc4fa0d4c667ecbd8da9580ae0245004135bbfe0d010fb737f3b2485874468d2c67a5689ea9a5ee32ef428bd6cf11eae732db4162e96928bbf14f70cbc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3c:A3k03kB56rz
TLSH
T1BE157B13E6940FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 1682f6bcbb07a42411a68b6865931eb89b52c6f3dc5797d0d66c54a7013d25a7
MD5 92144bf31f3cfd3e7811be910bea7943
SHA1 ef5210a8b41b412192cd5991d8f2054634583c64
SHA512 8e177c189634a974c626e898536cc56ffe664160d6516beea777d500e7d004e0ab07a0b6fbf84d786117d1b8c06a0d88cd5fda3bc16cc838e0420977376ab882
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3k0Le5ji0hmxNrM:A3k03kB56rvPji0Aj
TLSH
T1BC654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 930KB
SHA256 aa15808bb0b2893e17964161c8ccc14e5961813b7d05c2e64d5f79f507b26e26
MD5 cb0002d793f562c71d45e31917e6bf90
SHA1 80485fd276bb740a57232a9a4603e6b1c745178e
SHA512 1e07d3603f8b1c321c9a69a23e8102442899525038fa7b3d0c74ae64805a46bd3263d1a8a4bd8836d6ed790349ddd72887691e4b4de868f2a13726ac7b77e4f6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3Oa:A3k03kB56r
TLSH
T12B157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 939KB
SHA256 96fa16c60410cfb12215799d23202b861004d96222f7a6b01b000b2a2a4a1f5d
MD5 e6704f59114d1602b4bf484deb3afedc
SHA1 96d001acb45f17c943e25e89a8d9e7e2e81d2d59
SHA512 d5a0a8d5627633a91bb97cbb175652a9ad47f62577cab0e7c466226b5f3c0d308e3ba6fd275cbb064da59069e97cdfcee74d890eda8ea3eb160f0d18811f1a3e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3v6:A3k03kB56r3
TLSH
T14E157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 939KB
SHA256 25ec17951f6116128394682cf642946f47f93780e740eac5b5d9a067acdbabd8
MD5 abd431bac73d0c40cddadda1eb122b36
SHA1 c1a7ed7eb997ac227cd500f11261ba6c3c1d23bf
SHA512 90378c6fd972ebb4724675c9199bfd03d5ba6d2b66a2ebd93d22d20fe8abb960e98cf111876c928806d38d959e1a5d25216d7e579657bece2f2d88408e139ced
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3xN:A3k03kB56rK
TLSH
T18A157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 939KB
SHA256 fd69d65ef18e9013b5355db2cbf4996d9cacddbd85d538a3e50d193ed5aecb02
MD5 b7fa8dc8c3c5cdc12119c77282211ef2
SHA1 f8440821a8a16a0e68fb5fb5e9b6cbb6ccd52886
SHA512 073d5b2dd1502cf8511837d9131542e1d1e7118b240fab98d7c0916d8cc34445958165acc4667fedc56062f3704571a0ebdb546a43c3fd6bb4c700ab328354ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3nf:A3k03kB56rm
TLSH
T110157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 939KB
SHA256 13deeb347a1d2ef5b8eab4e0234701399e42100395f40fee67f0ef562261d245
MD5 445219b98234ff794a552170016861d9
SHA1 4727c39f0beb9af09fade95843d060ad404030a6
SHA512 b3f68b4814ea7dff1b0181c10262a5a6018a7d03385f9b25806f9e80d8bc1ab253cd37ffc9a225fd76a9344a3dde3ba9f9d77c8c49ebb3d59c2f84aa9721c285
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3po:A3k03kB56rH
TLSH
T124157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 939KB
SHA256 87ebdd1fef3bfc352b4d966cde1aa8185a8732ceea8b0013dfe1b0cc1f1a33be
MD5 c15a606d8cd245f9eb5df7d59cb64185
SHA1 bc8703e270331118f688650bca75fb33ed6bede9
SHA512 584ba2e8c3f95a3671041df541e62092109d784995b8ac5dcf7c6939f9e15f170f2bd2c6cbdc322a4b53385b6f85782af01abb29c5790d7d7a96978a95747a8d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3Zu:A3k03kB56rp
TLSH
T173157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 939KB
SHA256 345af0d264f5b02543c6ca82b666f00e954e97b43f1d2fbfc3fbcfee3c0df58d
MD5 a3a08e1ac7238532da98be7f3d5fd40b
SHA1 87ca6a1a1c2cb699cdac055c903167fb43916bef
SHA512 65fedbc8fda88e965c44abfbf635f6de5404d964e060b3d3bf1dc548bc6002046bf318661f9cc176dd087d30300ed9c5659f6edc3bd8e6c46bbcfbc4c1e1af45
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3/9:A3k03kB56rE
TLSH
T125157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 939KB
SHA256 2951e3ab44edfd61182b81353598dd8986f955752b5fc17d3dbb4d6e3c2483fb
MD5 fb173f45a2c760673967ee1e1d5bb46f
SHA1 b5b86c53313ab682630893c5b50536a603f66a38
SHA512 16b7ebca48959038a70c25c4c53a5605dd78047d0b6ed8fd239d18389acedc75fbd56fddfed43e147658513eca61ae90b298f5668b91991eb49f82c25742139c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3bc:A3k03kB56rt
TLSH
T1B7157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 939KB
SHA256 8620f37d986d391150b918b7c54bb51d8987a2ca19f6871dcb9d4aa5ca51f6a8
MD5 0e76de1bb29e94e08948eb71d7c8e74c
SHA1 ecc46a3b1ffcb0b5a004b0ef90ab19cb0ec5772c
SHA512 5004f9e78b5a55c4804a846e72c262e333adcde5e85fe189d05de2e78e1d6976f9fc55ea544d7784756f02efffaa753007d8ed97ab52e8b6e88d818ea892be9d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3Ep:A3k03kB56rz
TLSH
T1F2157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 939KB
SHA256 1020404c3a4aaabbbcfc79eccb7a8bccf61f4d0e940d44bb3f8af7c296100a6e
MD5 a25abc03560883505c0f2e4c8d6f03ea
SHA1 08686d622c780fda71f520ef2dfe22f4b6bc23a4
SHA512 8f33b5adff317010362c1a01b8a74720d5271ceeacdc64b0099fae9904dd2a6426a6d2ac35e028c4e7550a9420fb6087fb20d316e450397afce0b23aafd20225
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3LN:A3k03kB56rI
TLSH
T134157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 939KB
SHA256 197ed92401148ac5f950aeaf9880db7f101fc51eb25ddbddb009e8c632a769eb
MD5 0a717333c8da43974325a24ddf0f86fc
SHA1 5300a78ce97cf240eee31988bed50e995d1c1023
SHA512 ff8093473ddab7d7cda1850a699015ad44a65288ea5e4a086d739b9dd615e3ba98bf5718de14045a99acc5b4dc63086dfd0dcf78c8c6f3698f27c80f713ea6a6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3ZF:A3k03kB56re
TLSH
T196157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 939KB
SHA256 23c64632b533f7dbd33bbb48e37f1b3e867344f464971ba19b18d8a7948dd6c4
MD5 9d1fe7489819e7f58914722f2d9f1076
SHA1 65d8cc04738e377ad3a1ab5b031877c259a736ab
SHA512 2e3ac1445805c0d420918b72cfca246d6c74795f3e9df6c47ea32371d3dedc75bc04c0749b9ee7dfbe22cd5379a06d3384bdc288cff309ed013d8beda93bcfbf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3yC:A3k03kB56r6
TLSH
T1F4157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 939KB
SHA256 8921ba09f7cd68d3523544fe601d80433574bdaab9eb41e4573b6c9ac0a7e5dc
MD5 05c5f1133ec8b7c9bf06d0ad17b45abb
SHA1 7917f92976debbc8b34a9b5505650a1eb703ef65
SHA512 4d61fb6517d1217bab98245a58bc567179f0b6fb52e14e2d45fb10cddf6f4413a02d8c8d000a57df0d7b4fae3e04b40fcbfb4a63b0878a79d78c7483a8fd44b9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3tw:A3k03kB56rP
TLSH
T17E157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 939KB
SHA256 a70651f50eeb9fe8378815803be9449607d85564e7d18071fc77acd74ac03d70
MD5 c9d862d83764526e3ebcd7359d34e799
SHA1 08c9ac2a2e2ea3977dce2d61f560fc0df32929b9
SHA512 9b29b8ec25f05589bc837fa21bfbba71c42705a08df425c22297a2d143fa0e3e49cfefdd3bd9faca35d5b1f602e712ab5a1e1f3e4068cc43ae2eb0d96f167d23
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3cT:A3k03kB56rr
TLSH
T19B157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 939KB
SHA256 726f2e4fc8aca6b65c98eda0a6acaa21088985c5e082988912e94e4894aaa712
MD5 ed69c0f54148cf715f9cd9c327b04ad2
SHA1 b04538538b27dd3d06552b4b5b7a511376a581b9
SHA512 a96016528e20207f58ed57c6931126c491f0fe9a2b9e24f6ce004d250854272920998e2e0f669df0685b2e45490fd3b9909be042915d8f032ac9c2e380c76230
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3wu:A3k03kB56rs
TLSH
T1EE157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 939KB
SHA256 c9799ac8333067338c57afca43535aa15e030d76004e1305712e3cd0665ba2ff
MD5 bb3a2313fca6f5405bf19395a738117f
SHA1 774242b5775ac3e5395ce165f9f03dc9e315df32
SHA512 63d122036d5f0f6989c7bc91b4fc2ae940ea0649b6896136531291d64d8471c339e3d4ac39fa61879d3c1d9a2d4164d56e3e0152102d8acebefb791f6a3b59f3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3Ob:A3k03kB56rF
TLSH
T1C2157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 939KB
SHA256 f40c6fc97064bc615bc765dce965f166469085c33cdb9ab1fbbc488ea8f4fdda
MD5 dae83803594c7c8e568cb2ba34d1a89a
SHA1 4c43412d22d014d1e8b86db2aaf33c9d28e6c353
SHA512 f621a57de1fc22d1ba3d1819be6ea6b329b90c0b7f4ff5ddecbca0aa59a1700c2c6b06fc7edc34a20c938ad7b08c8e35e2de59ce134de59336fdf88163c7cb5d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp34f:A3k03kB56rF
TLSH
T16C157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 939KB
SHA256 ee5a33415cfeb9fb7e7ee6384ed8bfbb4d6b90e2d3847469adc8aa1dc85d2726
MD5 887da8108f0a75da3ef722973351849b
SHA1 53041bd223c1800de52d8493d033bd8f65f40ba9
SHA512 29c8bd1e5ac43153249a930b7b9dad2490158e74afa075ea6c1aebca934f3d4db6a6637e23c497a9076b4c3962a76f40bc794286a7edd571ee9c35e95d4c861f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp31K:A3k03kB56r9
TLSH
T18C157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 939KB
SHA256 4533fe83face0b2d676cac23f08b70cb89aa0a567980af0776b8963844825596
MD5 f9a5556cbb9b35d281acf4b4e108d719
SHA1 77d15ecee82b6540af830d9bd727235693a9d5ce
SHA512 5b0973fc14995187c974354dcdc5a8cf4c44777e3e9e60c2a76a32e73ec0bad44c986ec64bbe1f960bcd4c9095f08089e5ca740b5b59ec0f16e7927b06a44cea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp32k:A3k03kB56rU
TLSH
T1FA157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 939KB
SHA256 628ddb0e9255b980e70d9016ec84d536169cba4059fd1f4ad4f21c633a0e5e4b
MD5 7b941d71af288870922062ce64d3b1a9
SHA1 1f11b7647496ea880a81fd941c0b3e70d4c45135
SHA512 e8554eabfece6a8cd2147611c4fa8d715f84a2fda5ab344b3dfcf92c23f5adc271ecc92955e212076891fab2078d35680208d966dc373291c7d8259c0fbbfc0a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3T0:A3k03kB56rd
TLSH
T1AF157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 939KB
SHA256 1fed03f8723efba37598c4f906a6a9ec28a23d6485560e70fc53bf33422ee1e8
MD5 5ca807a1991e83802314b4e53f1f3669
SHA1 0bd851bf0e4841ef5f07ab6105bc105ceb771032
SHA512 59fc350c4d2527903cf15a728a594d8b73db826a027fc426e9f64b02166f51070016b297e6f335125e7b5a5d01b741f4b434e7aee604ce3e50e1d79a783c6b2e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3ig:A3k03kB56rs
TLSH
T13D157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 939KB
SHA256 58b3a85b8d444500c657fbc0a089f26816f9c150fee83050aedd99b28197af78
MD5 6a0c0f8b2f661e5bf053ee7cdd456cd8
SHA1 7292ebd81c71cbadd4427f683701c2ff1b527c6e
SHA512 65bee3176d5db2728671508723ba001ad89b61588a7669030b6e6a97f6a1e01b476a58f750e14ca262248db26f0c8cfbaaf0c7f42d9c043705b6c91929174ea3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3Dr:A3k03kB56r+
TLSH
T19D157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 939KB
SHA256 1d497b92b16c9c1df0e869592bcaf3becce87af2de1b3a30dadd9da63fc4b353
MD5 4b4b55383f6f493f7f6368a66e1ba687
SHA1 428102c12268b0c91f03f071f25d69e55e2dfb28
SHA512 39326fe16faf414441a609d9c50b3f99a7f5a3e1ea5200350888248e5b8853f9843e08bd05afde9a18a721d4866859c3f107e863e5cb38dd393760403d55d8a6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3ln:A3k03kB56rI
TLSH
T10B157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 939KB
SHA256 be020cb026503f1e9f95775a68f6a725c204ebb3cc8b50ea11e3c01456ce89f7
MD5 e2f6c33a9ae2363e26a9b734d6f940ec
SHA1 91d05a1f488ba5aed7ab41c6c7f335a6177bea4c
SHA512 1d55aba735f77c2dbce0a3a301b4eea37cff236de9f1edb9ed2aa8661bc659859bb15f766ac41bb5f7311eb32cd66b6da1b3cef0f16cb5bfabc7b4584e5cc07b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3Rx:A3k03kB56re
TLSH
T154157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 939KB
SHA256 8f51889591373e1770b48e969e29bfabb195fe66edc3768f98a60e405d944652
MD5 fb1026c5d826054f96d1fa4ca44c8b62
SHA1 3f5589a758d3e3caee993118a24de2dd2d636d6e
SHA512 070b2d349b4c7c0f3dadae4a1346a7a2b5475ea1b0637447a29e3d5d8b2c4fe407f93bf02d5675002199b0ac8efcbd1f73bba05bf341667b36bb1535decb6569
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3/A:A3k03kB56rV
TLSH
T1A3157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 939KB
SHA256 e2b3ea6d85b5eec78d67eb8c9db1901738e42596de1717449a15998a8d2314fb
MD5 c7f68a4a98007e82be6a1d7728c4d040
SHA1 e7f87790dcc0aabddd29a616c097a3a37e4f28fe
SHA512 781166f9691f40e3ec1865dc6c98889f9f6ea3ea825e9c3618c078fed4ef144612e831572c82696bff2bb492aee97d95829fc42748e61f81c2aca9d48b7cbe8b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3Q9Q:A3k03kB56rU
TLSH
T1CC157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 939KB
SHA256 e5bf7d5ccac76676bab2639f20402cd1d685e1d7bf127649a2c1fab0a20570bb
MD5 5d2402f7bbf854b2ee199b6c5c2721be
SHA1 5e3ca3056e12f3b7d5cf2945565d35e3c57435b1
SHA512 510f0a41eca4513d9bef3461b15802a7d8923fc70588dc09875d6c7c5c91c5357c74bb28eba2f388aa16b178cccbcca2ac2980e474e5c086b4778e6bb83bffe0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3x4:A3k03kB56rf
TLSH
T1CE157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 939KB
SHA256 02df8f4b5b4421ad92357669c0835546553fb22d3622027e16a48573f258c8f7
MD5 aacebcb0673668b8c00767c69885bfaa
SHA1 04cf51fe8ee0a57fd2a9781475c8bd04b50624c5
SHA512 4c0db171da4cf355c3e2192fbcf5bf7cbfd70cdaa15a177a2049e15a6f3496a9f0f2fd6c43c711c83b31e6d78ef1a57cc612f820bf4d55fab796dea8988a7d83
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp30u:A3k03kB56rS
TLSH
T146157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 939KB
SHA256 9dee44fd0a0ba275f8e4da661219b227c380fce4cb6c6826b72b2780f6a3e8f4
MD5 5bd8bfdc44253377b44b30adce2edacf
SHA1 d406387e258a650eff5b3e6f7efd54fb60371b66
SHA512 094d64a722457d4cdb3a2f1672ccd9e7f71cb3ed257789541a06758bb3b67f41e01c5fb1bc2b482f8a3abae95f38921c3348ee00770f421658c32ca925e1fcf6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3Fj:A3k03kB56rM
TLSH
T1C1157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 939KB
SHA256 d299d67bbbb5ac872d3463981540f8dca3dea88609684f457c7ed5af194fb0ba
MD5 9b05721f15e97e3dab533cb29e2a65a2
SHA1 55696c9b7b11e2a66b75f1a2cba2ad65dd5e7605
SHA512 1b6ba5d6a2640d2befdb0e4fa002b91fe1d1c70ddab6b0e66c25f07a3431bbfad07041568b39985f5b06f4cf128acc327ce95ed2d094293c095f91fb8feda5ea
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3Mg:A3k03kB56rE
TLSH
T1C0157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 939KB
SHA256 62b004308570a9b08be253aa4351c621cbd18a53085b5d544ef1746df63c34b8
MD5 ac747eae1662fd2a14bd041b50e61903
SHA1 b64740bf9bec5062576eb7472beb5b079cf0cac9
SHA512 008e08839ad0bf973783c8dd8e3c7951689195e16dfd2b585a27d50ad3b279ad425824a3c4510eecf53c399f9d85d55a2044a94b1f546a0f0f3faba3fd3ae9e1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3TI:A3k03kB56rt
TLSH
T195157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 939KB
SHA256 9802f9eb07a5a2b25b34ac0a1096e82ac02b75b42b4cae75e2f226941f7eaf55
MD5 579e8c39be52781cdb2484dcfd26d4e4
SHA1 6d95d4971e90bd2a310a2dd1203268a9078ab2ea
SHA512 b53c73aeae98b1d65b865b03a45422014735a7eeee4f39df895c86bba58f139d168a6ba88c28425b5c2679cc389d2a07e83ed40ce8093dd3bbfe5b2c97961592
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3po:A3k03kB56rL
TLSH
T16D157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 939KB
SHA256 306d4019904c20ec16e47c3d557e4c30c768f9dabf091c8e3a2747a8d88de8a2
MD5 801b387a78de0422411ec6ab5ce09b52
SHA1 502fe5037c054f36ac82c9edfc1d148c59e86398
SHA512 906747d75350f571df47e066eee273845e4e27bef53e3612a48c8c4256a99c83dae65866841934633851118b99aa06c3b334fc3e7452b7a81ac8e02e556e87fe
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3a+:A3k03kB56rO
TLSH
T170157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 939KB
SHA256 4953831385a4775b1a170f88352a5c1ca1ef9226a083518fda803edb35e6f34a
MD5 640ae2e6ce3b2c9418153d1239094678
SHA1 167421d353d6f3a78831c0640d9afbee2c980bd9
SHA512 b1558959bef2a9ac12a78d96d5a5006221568cc4679c65ebed0f23aada80531c55a9698f149a5d973efe6181dfc4a1bb29f0b08e131c0af0c7cf9d9c2bf770b7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3aQ:A3k03kB56r6
TLSH
T191157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 939KB
SHA256 d3b34f68ae8d8dba23788b55fb6d2f9c3c8c7fad79068618448c1328afc0b534
MD5 03d73fe13a03fb2fa49f8f78fd655565
SHA1 7b06874a3f2a09332429c06b509f2e21fd1b9ccb
SHA512 e77540a5768befef58c16cb69992a35f937859ec13c1b2a7f9489a56c623ea4040402d03d9ab92129b90c0abb80b286ad4f09bdd59d1b51bdc504a80b55360c7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3rX:A3k03kB56rq
TLSH
T14A157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 939KB
SHA256 34a7e6aa57d3eade093df450550035c7ddf11425c81a4904d17aa59eed9c2413
MD5 b062383c56dabd9cf2b9fd59ce2240ec
SHA1 37e0dc929190bbc26857b1c390b1f7c9a3e69da3
SHA512 e19a4af1b7dd4c625f98a1bb80adda68672d07b543780cb9c1866ab26d0862bb518d4c3db6a4db3f9e2166ae0f7c38ba403d279a2edaf59767ba68c3bfa7e923
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp35L:A3k03kB56rE
TLSH
T161157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 939KB
SHA256 521d3be6155c00edb8dfbda463528a004484d0df7253f0083af32d1be5de1989
MD5 66f1d4b8c849a9cfceb29af68061797b
SHA1 042d13a6c2706f96a9e77bb96dd7580ab6d82a4a
SHA512 a740d79c36744b65a0703353703e8ec779205ab4009bd92974dde64b7bba3f201231a87416a25de1e7f012a3a4d3bd6e726e586935837d3c123f9f4f55db9d96
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3nM:A3k03kB56rF
TLSH
T149157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 939KB
SHA256 1a1c9a96dc1c8a88c879c454a15797cbc6fb61ed8e65b2603c82d3060691aa00
MD5 e5d489901dad9e1dce818fb2ce980687
SHA1 20f560b870601b3567769a8aa08cd5fd41e862a7
SHA512 b937562b1a9bb9a147fe984c1bb89fc0c3c18d64d42c101bcb5a6de0c6233c56961641a25c374192727907ddff5707f00a3f1126e768908592a21abca1901233
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEp3Qh:A3k03kB56rf
TLSH
T1E1157B13E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4304-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4304-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4944-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads