161ea068b63a0dac2d9a46e4213643b2da0f8514848623161bc385fcf8ae40e1

Analysis

max time kernel
103s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 915KB
Sample260729-yg89yseq2s
SHA256 161ea068b63a0dac2d9a46e4213643b2da0f8514848623161bc385fcf8ae40e1
MD5 b1dd463c1bebda3a163ec09cad5c3650
SHA1 8ffbdbedc41f2338beb92256a2cb45713c7ab022
SHA512 98cc54e5d763e06f92eadf7e07b766e4834f614ff173b4d366bce3af9e3b974b01d761a12ba32de631000d1395c3c57e7493727ae1fcb5905ce79998319deacf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHy:A3k03kB56r
TLSH
T1E8157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2300-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c524-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2300-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1196-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00070000000198d9-576.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-686.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-872.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-974.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1035.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1115.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1142.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c524-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-441.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-497.dat	aspack_v212_v242
behavioral2/files/0x00070000000198d9-576.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-686.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-872.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-974.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1035.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1060.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1115.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1142.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1196	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files\InitializeRestart.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\InitializeRestart.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe$	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2300	2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1196	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_b1dd463c1bebda3a163ec09cad5c3650_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2300

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 915KB
SHA256 161ea068b63a0dac2d9a46e4213643b2da0f8514848623161bc385fcf8ae40e1
MD5 b1dd463c1bebda3a163ec09cad5c3650
SHA1 8ffbdbedc41f2338beb92256a2cb45713c7ab022
SHA512 98cc54e5d763e06f92eadf7e07b766e4834f614ff173b4d366bce3af9e3b974b01d761a12ba32de631000d1395c3c57e7493727ae1fcb5905ce79998319deacf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHy:A3k03kB56r
TLSH
T1E8157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 f1971ad9c7344b60b36304006674469a5e9f0f3fda80090bfb147cfd6ca57d9e
MD5 c6a7d12768ffd7d4ce711e38bf0cd472
SHA1 07de0960be50359dc1d4be3e5e00114a53f8f05c
SHA512 080fea1eaec2124a1a529d95824cd3bcad34e65e47818ea768ad41ad5163bcb045cc6457f2e7bfac986bab3e990e5900907747ce35c6b5dfeda25888b8c178ee
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyP0Le5ji0hmxNrM:A3k03kB56ruPji0Aj
TLSH
T110654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 930KB
SHA256 483c450171d688e9ee84d977f757beb2aab2014eb15e0988a212f591fb3657fc
MD5 667cd500e2e12781cb315bcb8eed5018
SHA1 5711e20b7a503daf870b823ba86715b770614f7c
SHA512 5b464ab90aff56da5ed83177af995f8bd0bf479e23a61327773a357cf865dfa31853c1e5e67d08e60384180699d7cad06593226c6dbb9aa82316f423bf8d12ee
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyRa:A3k03kB56r
TLSH
T1DA157B03E6840FA5D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 939KB
SHA256 3416114286f21b53617e14a67c515e2caf05449054f02016ffdf2927cf7dd6c3
MD5 dec879b220aca8895ef56df8e820a7ee
SHA1 628d4226f2a4d4745a71e2d990d49ae030dc0075
SHA512 e419d9b387115565292f4a70f1911dd8ff91286064a478788e774b15489091b7711c06c4fe0c3a88e2c7f5a15bb0fbb47a7d28e66386f97aeb5a629d9c21fba8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyo6:A3k03kB56rY
TLSH
T144157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 939KB
SHA256 10e5965001db64be09f9f1843588050a5beb68a687262d42d2f3832922865626
MD5 422bbd248892e91d1bcce81e50adde49
SHA1 32c80ab550fa9fb9377ef76274b69e6a80564edd
SHA512 26901a52d10c6023dc71e5053698ac9874faa8ae24cb1f2ac6f4e6166fc81cc061c094d7b119becd7739bb52cd829b88a71dd947cf01c4884b5b55d03c3a965e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHysN:A3k03kB56rF
TLSH
T1AE157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 939KB
SHA256 f7310b244ae3fefc80015f7a06e340b25978efb691a208b3fca5333ea109e545
MD5 349395cdf5ab3a75140c0eb93461a017
SHA1 af188aa344f495f47e9ac87519d63f77084b441f
SHA512 de087a5c1398fa9393f65ef651bca90d0ad4e15bf1d1e2aa1bd7507e778785b5cd946cde9e2178fa8e72423fc2857cfc4f3136738efe242046b18db04f67e9ed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyif:A3k03kB56rd
TLSH
T10C157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 939KB
SHA256 59c0f69cece247b7fc55e83c77cae89711515324e4764eb1ef09924b5a4b1469
MD5 a4a388c1e7d821427b4d4ff965972e4e
SHA1 e839ce3a3281abf9f5289c72b388a815ae58e487
SHA512 79095e1ad9e8103ca40e41b1512cf7df70e079dda63cd7d53efaa150872635b223ec808342845b13e4ce971203a3b291a3408559abfed43f0df6bb55a03ad0e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHy8o:A3k03kB56rI
TLSH
T1EF157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 939KB
SHA256 c4f3522ffaa6857eb05e2ac8350dcbe96c56eab92630cd74de36965208d9303d
MD5 6138eaaf6a594d2e7fe116de30822a13
SHA1 3bb837026bf3e1b68128d9002f7006b3a0f2692b
SHA512 c25d5a2e74ac0481ed2e309ffeb81344c66c35dfdffac90bd445187d7fa633cadb5a11ae446be20950bb40f901fe6bba41c50aebd473bfb7944784ea96385837
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHycu:A3k03kB56r6
TLSH
T1CB157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 939KB
SHA256 37336a479b164f202586b68d0215d85977fafbec425279ae6fb0ed1a9d653864
MD5 718966ebd57379f53942a02787ca197f
SHA1 93dbaefb6d203019430c15be5d7579ce0bf153ac
SHA512 efd1d1c033ae125e74d1afff0ef50f233b9d4ce4bc8ae5830b39847ca7b17af36f2bed921f43355898003822c7461136f87a1cdda327743385631124ad427c47
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyg9:A3k03kB56r7
TLSH
T1AD157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 939KB
SHA256 9419f1364276dc3d25155476286f3a9ca2ecf5f91ecfeec02863d82a7e64ec2e
MD5 fd6c6d30577c90d8e79c2fab489f5810
SHA1 a61d7077625ee2b1f24a865b0e64c717a6fabff8
SHA512 871d33228fcd03f3cfd5fa387758f97bd01b961ce534f191b56d2c9d4ac74c6a48b3724406a6f769cb60e58fbe8e15191b99e7de03cab52dcae12040f1760156
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyoc:A3k03kB56ry
TLSH
T1EF157B03E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 939KB
SHA256 9113e7874a0f3e000e5a1b45ce26933f2923e96546d6bde4b6703cc2e0f1301f
MD5 14f745d8a8a50f42ea514b0cd98ca9fe
SHA1 3739e92dc0aff4adf5d1ee17326ae076f4d1761f
SHA512 c532f3debd5474153029f077f50512e1b902d04c77f3668b4987259dadde470a30da5c69e590c736a5a6d6bc6d481a6674cea6d24b12ddbf0af49e3c26262ddc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyBp:A3k03kB56r4
TLSH
T150157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 939KB
SHA256 4c2e47fd6c02732094c76bb23028ed22e3ddd1ee787dcc2bed3da08c548e7128
MD5 34c6dd0e55e6a6e209c6c0e9168ed1f5
SHA1 aa5394dd868a32f9fc060f6a6aa18188c97a88c6
SHA512 e33a48f386bd45e8a6a3ecd9ca0be057ba807e2603e592d06a2f28f5320154b151235bfbbd43ce934ee32b182b6e08c59251766d28c23a633dc71e7843571a71
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyWN:A3k03kB56rn
TLSH
T137157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 939KB
SHA256 692e15445acee994fc17c38c3f4a4e211f5dea70e27c6d3d3a2326d73fa0cf29
MD5 3b60b8f39ece2b3b4121e01642be2c36
SHA1 e8adeb9e8df6d9c8c7ea14dbac7e474bc11aca60
SHA512 3168bee9651f326d6e784c346ba75b1c212124b855ed691420c06f0a6f929d067b7b2154971bd9281dea8e5367286acee9ef6948250339e11e336d19126c689f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyaF:A3k03kB56rh
TLSH
T16B157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 939KB
SHA256 b845f798e20dfa665d57c5546a15966a61e7e1a7cb5d2e974a4e4eb3b5b5bf4d
MD5 edea8ed2d2f1e18b41a7199fc54a3f1f
SHA1 05409ec948451cab6c87001f955f0ce1e1150cf5
SHA512 6e9f9fc1e01b3889e31b9efd4c2c2e772f9299b41e2e8b6e4fc42acf6a0c8dc1028c2ffe2944e4017aa6b661074a82719fb49d91bd80adff94e52fec58f920fd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyvC:A3k03kB56rN
TLSH
T18E157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 939KB
SHA256 18e3eacb29d8493b4a2d496fe657a478148c8182f747f62651647af476e6c6f6
MD5 dc1edd9225c6942c9eb3ce101197f9cb
SHA1 f349dabcdaae4f256d633daa1429c2d4b6177f61
SHA512 a7b359549c8a0587193178c4b646724fcd2efd043b5faf790d135d5a9a1b8b73ff0580e6839f19e4e03e1a5ac24c9421eb206af4bdad31199a62866bba916875
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyQw:A3k03kB56rQ
TLSH
T13D157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 939KB
SHA256 fc5ff0c7e2fca77fa6c20a19d40fa5fd63c4b0de208e1e6362a9350ce510c611
MD5 c100eca610f8941bee039e5df042bdc6
SHA1 8ced9c1b1cdb782a8489ca1046ab31b2ed07a979
SHA512 3d5afdcd68ea93648cf5095eb1cd32b619b4ac71d51f5b289abe3b2e07140f842bc27fa3c15b7cb4db9e2875f6096cc1bb39c924ae821eb02bd6cec706363f25
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyvT:A3k03kB56ro
TLSH
T143157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 939KB
SHA256 5d37ace270aeaf8e67dceeec964c634fcae5689cd0d2d0f1dfe869dac72ad190
MD5 b9f31ffec4c0367450555e2b44ad265d
SHA1 150b296267d773a8262629639c647f2cfd5b09af
SHA512 9f335b3028155270cc01f50b6f0893851abee6c5b72637e8854526d5a55448f4a9131aeb6901cd57fc9ca68abceeb65b54dd3816b0a6a20ade96ea22135399ac
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHypu:A3k03kB56r3
TLSH
T116157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 939KB
SHA256 f1ce06cba4766becca05a1ad6cbe9581fb418bbf272e21be3a64a6512f2d917c
MD5 32eabe43e27b9f46f476c60f8778419f
SHA1 679b934622d26dea64b1efe0b50d6852c705e598
SHA512 7bceb6657521ed41a01db13ab9ce53e21c9bfdaa27896aad5cd71396991f1f24b690a1c303270d4ad01b4b1e8cbbdd91621245c9cfce377727a6e4106afc1f57
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyhb:A3k03kB56ru
TLSH
T119157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 939KB
SHA256 085bfb4c624060ffb87884ccfaa7c9ee16435eb65ce3cf0056efb6c980932d23
MD5 50be8bbff8e0c02d45f902c02bd4def2
SHA1 a6babb5e0105b27893d428ee65ed068b589b50ee
SHA512 49d53d4e78f2cd5d66f32622a97d2e13cd0c6072c5eaf42b3eb077e418a530d7cc67aef8bded63827f85280acc264ba8062bec5dbd5f99882f1d30a02a2d0238
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHypf:A3k03kB56rO
TLSH
T1AE157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 939KB
SHA256 ad1fcb9556c66f812498abefd7a2b4231c07ecca21c9af4cc9a939528f476418
MD5 2397820579f883fb1b67affaedd6a59c
SHA1 24c8f8a142ba62ba9c6f5da43e61ecd7affa7e4c
SHA512 74b2dbf5db815342fc5ff92a0104bad9a2ec0c9cf5081a11131e9e6381497f82a86f6f207b67d79123a1dc5dd9d733e2477ac36e0c4dcbddeb57ba52b80a4f71
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHySK:A3k03kB56ru
TLSH
T1F4157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 939KB
SHA256 888c0da83c44eee89b06a311353f4b2603db376a49445b922eeb8cf89c5656d2
MD5 e5d0c0d30de0afbbd83371fade0078a4
SHA1 c4b6f9309908b9970bad8be2d69c2b001d9c931c
SHA512 0f1008a8b40fbddd0827c38616e92edd126958a47baf02dc64cd282dcbee4667bc3a11873ce9b6958b644e5ed65465573fcd536682081763b6a322126e040216
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHy3k:A3k03kB56rT
TLSH
T1F4157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 939KB
SHA256 2b1d53305121455604265bf596fffa6c249078d926e0390df50fb76923cad893
MD5 1d704c908a489f52d1398cdcb26ccb8d
SHA1 0a7a61b3b981695ec355456f8ec76739b038cbc2
SHA512 8a84ae52a645bab4e370a29aeffeff93d787114710ac3445a9dc7a01b834b1eaf47518bd1b06587a24e0a6586ac9a5b13bfda9b26d81f6128cd2c2301ef6113a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyA0:A3k03kB56ry
TLSH
T169157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 939KB
SHA256 bfe701a6b3dc77c611e83ece8f3705d4cc82a7cd57045f98506430b78fc42279
MD5 0d77b71c225732dfac45c65e28acaf22
SHA1 f5439242e2461a10530561819fe86f3b8dda2d43
SHA512 27840fb669f7a1fd7d03c2a89441371aabe733a10acfae68f780311b6ceb36c8bcf842fbaa2b0b5673d3f18561dcc343c0ac6434dab588cc9591f3bdf6f32e5a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHybg:A3k03kB56rL
TLSH
T135157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 939KB
SHA256 a77e2b837be850c59ac24f17be02e6e4c433e1d475e7cc176e26a7ea70268bb6
MD5 9ca01b215a7530558bbfe24da25b4126
SHA1 0117a5789ef546ccc926c12973a4de08e17fdcbf
SHA512 143d0de85a1c6df2e94c4f04f2251fdb462d6f346a59fc5bd917e2e00d75431147fe055b4cb6657ade7c93fe78085eaf3894b4049fa545a8bfef33cd63fb9a70
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyWr:A3k03kB56r9
TLSH
T1DA157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 939KB
SHA256 bd91f392f9ac11834c162776a17af9adf1d7951f896cb87cd12c67e369d90fb5
MD5 a4a6b4ed94c3a789a2943c3be597d3ca
SHA1 28dbdf844bf5884488810ea4fe0df08275e0698d
SHA512 502d4d815389db2c4e9233187411cd6adfc31959bedcb5afec53e8f59e1bfbb9fb75172919284e127fcd9f139691f8bbef2c4116452961b3d1f034c7870b0078
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHy8n:A3k03kB56rf
TLSH
T136157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 939KB
SHA256 cde7d6ae41cbfb0ccff9caf809555f5857df6fa0228eee8ec7cda4281aa6ee01
MD5 85e5c7ddd09966902810abfc02a6f71a
SHA1 663d16520cc76bfb8ba5820b200ccbefaba680d1
SHA512 f183fb8e9c5a04ca5f47b57b1e75b3089bc3d4fa15196b8027c8d7cccd73ff5302fd83b086caad020f4216930a35fd57742957392405f96cac76eea7317fd708
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHy6x:A3k03kB56rl
TLSH
T11E157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 939KB
SHA256 11ccce707efc44425b6ec0c4855bd6b81b95d54ec421080c966b62c0e881dd46
MD5 4b3c68ce3b457a0fa24fb4028a979988
SHA1 4b42ef8f73542f689ac84a973b62863fd7788dd4
SHA512 3812ebe5b94e365dc14d728f9d55b4451952aad2af25d881f0574796a61f844ea3998f2699bf81446b92a1323241039ba4b977229e5fa53eadc914ee071a057d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHy8A:A3k03kB56rq
TLSH
T11B157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 939KB
SHA256 7e25ad7335ca64c45fed88587bff2d64672ca7b1e6f9a0ffeb76f6da4d1efb2b
MD5 df264c221ce773978a52ad0126663613
SHA1 aabaef2f3ad227847463ebb3fe405e49afbca925
SHA512 1dde06909cf06c6b0e3dff177e20b649e2954bcc66d821cbe72d89cbcfbc3d41c2a5072ad1e07adaae4aca9d60cdd95f393bdcfa0057c050fca9435d646c7a23
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyl9Q:A3k03kB56rX
TLSH
T129157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 939KB
SHA256 126cc1c164e74d966f9caa7f8f5294f4476d3e9c21dfe2a91196c4a654c620a0
MD5 cde0966d9f763b35d2c1e0e094d5739b
SHA1 2089c74a9a0e5e5562152056f19050031856cc14
SHA512 d1250bceaee4c57c848b986d40919dfd002519c3f6e88b51109b16554c43d1b117a900cb57e4910a7338f74ae9092220090ad0e0f0e10b2451583456156ea2c6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyQ4:A3k03kB56rI
TLSH
T152157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 939KB
SHA256 3e6fea6764edbd5f7b6076aaa7e313944e46836b51366e534d331ba51b4e8815
MD5 df1f9f9c85c8363c879753314012ed2d
SHA1 7a2195d73d58911dbedea87ff08d526c98a6ac4b
SHA512 80e2d0fa577c5d4c9899d01e500494fdf8e9e7047fd70cf2422e7faa9982e957b17f76f118ae14b9b5ca8bdf5092746dd2f246fe893b4a0a3bb064ad3edf6933
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyTu:A3k03kB56rZ
TLSH
T183157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 939KB
SHA256 084e95fafbfcd6408b1c9bb65e62e31e62620d9daa5d54d6184c784039ad3cd8
MD5 1685cb507b45cd8a058faa0e130932cb
SHA1 d39c6244a22cb8d4d996849c98cc096105c951be
SHA512 85cac2839b0e7f8e329cefe0e8aa361920b163aff59535382befef7ac974ec3c55997a9397fa3d7a369001bfc161d4b9fe8fdb9b03122ccbf216811e67e1bd78
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyOj:A3k03kB56rD
TLSH
T102157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 939KB
SHA256 266a9d679a6003972478db1e337b7ddc40bcc6eae18f88100e3e09ea9711fc53
MD5 b2a2d5deac9b21b5f3034e07875e7832
SHA1 ee2dfa90d995716acf2892f858f1b3dc40f95c73
SHA512 31c8ef6c93de7a2d080320bf76da4435a6147df70e603fd9b3cc1851735b1d0cdd168188109b9035bf76c05a827db1f7f2feda57a5b94d24c340ec3168e3dba2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHy7g:A3k03kB56rr
TLSH
T1AE157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 939KB
SHA256 01b0040eb2a016306da7b7e667ad674d9b32400e05fc0e6b84bd17ccda063194
MD5 d6bccff5ff0fbf5d74dcce972d88b0c1
SHA1 a568b84aed8735fe468dbcc8f4058a63d766b269
SHA512 8dc467913221ee2611c39e919b81efdd8e66c1883484a06c3e74517c5e77115b5ac3ec3bcb014a1f2b30fd2899a902fdbda27e8b3b53b35fb907885b5d6803c1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHymI:A3k03kB56rC
TLSH
T18F157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 939KB
SHA256 21c849256ffc03c684d4df0c8ef981bef07916e992def6b84f3867f519e06835
MD5 4e19712123336cc53264e8971f9e7b8a
SHA1 67a7080e6bc663f89fd7c13cffca1bcd1925e91d
SHA512 df4c680ebf7e090ac993e7f7eb1509d7a6ae0d9b6f552fb059422faffe7baf863357f109965c3de69cd2a4a8bda94dfbb0b2a92a66d908d38dc23c7a83d21839
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyUo:A3k03kB56rg
TLSH
T1BE157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 939KB
SHA256 b51a9aca4aff6c9354264b5482b08938b07c5d3969a3c1b2b141945875263b70
MD5 8d5661da98100aecb8160d3afd38ef57
SHA1 0c52cc5a7487494f911994c3ff6c9bd64fc0607c
SHA512 8e067607f9873b2436b5687865437547ca4725d6d246a04121aa9517c84725e3cf784d908260bc29a771791156f9545194aec531c7d875da87851d2b0d8438ed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHy3+:A3k03kB56rN
TLSH
T16F157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 939KB
SHA256 23fdb9fc37c956b3e7cb50513407967d251804089b96c1d92d8be06a955bfbc5
MD5 3c12dd4dba239ab28eede9be82405c45
SHA1 9da1a7ee9daa2692bd76b81f6902bb2ea0474027
SHA512 696d8e4e3e6e847ca378598b32534a89f442eb3851b420ebf37a0f326ddb6fb09a544e6cb43282cc1ab2e0d2a18467e65691b3e6bec413309212dc434666fe2e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyNQ:A3k03kB56rF
TLSH
T1EE157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 939KB
SHA256 78057e04ac0210b3bcede9179ac48175fc131c5b5943f1db6bca2437357035a4
MD5 4e97f544d39ef4417b9fb855ebdf4e12
SHA1 03b118cd9ed91cf4422615d4248938940944c16d
SHA512 60f58dcf0fa88ce2c1cc361288885b94272955171da11a7d2b18f4d61ac973cbd848177208edfbc0628dab8997ff8441c4d5b8acb161a1634d6f1947d59b97d7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyCX:A3k03kB56rR
TLSH
T1AD157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 939KB
SHA256 c3fab63873484d91437a033fbbe46cf11f21bce81349468a72dac25b2e9beafe
MD5 531eede5a37818011873b1637f0bfcf8
SHA1 1f6ce6ad11d630a4fdff6cd16c072aed1c41d410
SHA512 754b168713e564c268d4aafb177d7bb303315e49a0b0521bd2ba575d4f3803612852080dae41593635b7bb65857d570be2044593ad4a782060420538508420d5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHykL:A3k03kB56rb
TLSH
T17C157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 939KB
SHA256 b8ac30443aa378f54746a924c47a4cde4b8048276edbb8de7ef089cb96ae2bc2
MD5 b3409cf0e8fc110d96cc99d5f0a2abe8
SHA1 77e75468cbddc6c8156721fadb028fa6768a82d0
SHA512 326fe39db9c7ab5eb134f9be85f861b7d2916218709622b7eb0822e1267c6fe6471f789a3b8bff8d893260d1bf2d8c03bdb51b91f87813f884775ea0ee32c87a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyAM:A3k03kB56r2
TLSH
T1F6157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 939KB
SHA256 e64ae5a0a1a0548254e2bf7ba9730bb6942e9a33ffd6ab3bb41f466d2010bc5e
MD5 de5d9ec2ebe53bb0af0a9e85df5ee830
SHA1 aa394e60aeb954e4a8a143e5ac1e61b82fe76c26
SHA512 4fbba12f23a0a449a595fc4e29029720e9f46abe54d21443e8ac4078a731a3af888df33fe6e9d357d125079cf23a9a42edc0bc78e37f72b3e6b036f26a8484b6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLHyhh:A3k03kB56rI
TLSH
T176157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2300-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2300-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads