cb93e5043f0fc498a0c4c687812cbc03fe1e20f1d2371d19f2a2bfa5c3208a72

Analysis

max time kernel
100s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 921KB
Sample260730-d5kahscl3s
SHA256 cb93e5043f0fc498a0c4c687812cbc03fe1e20f1d2371d19f2a2bfa5c3208a72
MD5 45e3d765207e23e67e8f413cff88534a
SHA1 784b4ad16dc42794e133ee412f6c514edd11853f
SHA512 61b8fdd187b7e75be92153fd6d97a61040903ca51d319f42e817388796ab9a44791d7c8bc4ce60d15a571be82b132fe33c57c99b0ffa23837c93427aaf3e0770
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyE:A3k03kB56r
TLSH
T1E6157B03E6940FA4D10F81749AA68672EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4216-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5d7-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2d6-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4216-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b300-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3780-47-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a67-558.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-613.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-748.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-797.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-950.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1167.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1205.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1358.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5d7-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2d6-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b300-40.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a67-558.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-613.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-748.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-797.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-950.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1048.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1085.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1167.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1205.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1320.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1339.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1358.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1371.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1378.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1391.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3780	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe

Drops file in Windows directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4216	2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3780	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_45e3d765207e23e67e8f413cff88534a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4216

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 921KB
SHA256 cb93e5043f0fc498a0c4c687812cbc03fe1e20f1d2371d19f2a2bfa5c3208a72
MD5 45e3d765207e23e67e8f413cff88534a
SHA1 784b4ad16dc42794e133ee412f6c514edd11853f
SHA512 61b8fdd187b7e75be92153fd6d97a61040903ca51d319f42e817388796ab9a44791d7c8bc4ce60d15a571be82b132fe33c57c99b0ffa23837c93427aaf3e0770
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyE:A3k03kB56r
TLSH
T1E6157B03E6940FA4D10F81749AA68672EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 44a0e16babb837e71ff80a4abd970b7db5c61d55b205dd2fb166b28ea997f85f
MD5 b0dfc45840d4c1555fba471ad6b1032c
SHA1 5ce4b8041507576223fa7efc1e5e192b9bff2e5e
SHA512 c9b1906c4ff795be521da53663eae981c43d5f1e43256b8a9c8acfe37135fa7bf44a911d0d34d4523957867b6ed1c6ed4d456ee0ff5d718d99b267147b80f6f1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEP0Le5ji0hmxNrM:A3k03kB56r+Pji0Aj
TLSH
T123654A16F6A44BA5D02BC074C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 936KB
SHA256 b4d314a58d0cf2f2eb2a3a64bf18bb2d19e6939ab9c1c3664f3acc5848a00c11
MD5 a16f33db6f3907fb9ee13e729eeddb9a
SHA1 9ae38c42967ff5ad475007270c67ef8da1c5ae19
SHA512 3587a9094fb0bdb6396a43e2599000449340708c0e47bdb4a55a0c27b9e11a1f07d5006d5c60f2a6778bb486322b88fdce8d6e661f4e957e355f38300e53e502
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyERa:A3k03kB56r
TLSH
T1B4157B03E6940FE4D10F81749AA64A62EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 945KB
SHA256 c127fa576d63414e4fd11a62bd48319cb6fd6c18fea1038d441eb1ec906896da
MD5 665848175265012701f8581a5a994cc4
SHA1 948c1ee9749d866e4b6d54a9733d6e4f207d68e4
SHA512 9b0780204e2df3242d1ed745ed699c727adab3df0af654869894271558debab8b7058f1f51ab773f40ac6dc28eb0e451229d5cd856c7c3d17b1d54348ddc7675
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEo6:A3k03kB56ro
TLSH
T10E257B03E6940FA4D10F81749AA64662EA737C125F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 945KB
SHA256 9992b2dc46aca953c055b4ef141c8ba2a091526541772476670f861fed36eed0
MD5 2fb7c91e020df9f1e63a61deca487e26
SHA1 e13c9003dbea405154ed670ea3be436a9a095697
SHA512 0d5eda3ffeaf735b8105f92075c7747a1c64c4f26ece2046feb330fb54129985269210aa1c367947cd976010283831d2570da42abbf5677e395449e5a061614b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEsN:A3k03kB56rV
TLSH
T17F257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 945KB
SHA256 ab165f85c784d5aaa663fd63ba0727d16a4470a7e1553e1c0e5be51ceb5b828a
MD5 714fc72f6a90262b9c0169042dd6bf1e
SHA1 70dfd4015d2032116a20b3cb2f1be662348907f9
SHA512 91eb9f0caa8d0775651317449c544d9b7a26fe4efde12e65e05d0236c5702771ddcbfc247bd44b77ce587d7d0b4de081a0a2fff25296c0f1ddc94b6f726f226c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEif:A3k03kB56rN
TLSH
T1E6257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 945KB
SHA256 b2bcda3a7f47cf06edfa5ccd2793b5b5529895ca00220c499962d3288798faa1
MD5 4620a0ab358e05d88cb17b6ad2deab7e
SHA1 c497245263a31e8be987bf92b056124098314e52
SHA512 776513b25d0b132d029655e1bccbbaa107a3e973454b51c55fdcfbe31fc1df080ca08a98f3381706f9d61619d02c078b24e0a3ff80df9f2ce0d31f71406aa191
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyE8o:A3k03kB56r4
TLSH
T11B257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 945KB
SHA256 00a42cb030822db7392424d8f635c9c0ad136559611d93e84d8e7ce47e27f344
MD5 df72709a3d14adee2a390b366d8b5f44
SHA1 baa2996c9aface4ad929fba56437c35feeb75ab9
SHA512 f54f2bf78c8ade32ee568d47ffe4b794928e046a850c88d8d1fd6d5e3c446c09a80bca9e915da16572341123c77df362792b2e861660fbf7e2ad76ea82c2f59c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEcu:A3k03kB56rK
TLSH
T132257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 945KB
SHA256 8b3c605395921fcd53fd0996cb7e7cd9898ac35492b2379d3125df7c05982f1a
MD5 4d1ae251851d102d374fdc24837f8e76
SHA1 da24afd6e18d4e355d625e322adb4eeb8f773411
SHA512 cb6cda86e77a44059bb8e6cabadded477d0c275ddc327a28c0b095310e2628876bced7e07701b2842efc908021ccc5c092c5c1e8950ce22f510a5851932b7327
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEg9:A3k03kB56rr
TLSH
T1C0257B03E6940FA5D10F81749AA64662EA737C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 945KB
SHA256 55a694c75731a4e358adaa40bbcd15151f94bffba67531f07f1948140782356e
MD5 8925a3d244a9dc064443a780430be07e
SHA1 ca9cab9bf51cce77f8f7f6c05bdba3ee1a5b2d75
SHA512 9e7b3c7e4c6b98677bf6cb79eff518a2d278053b3007ebeb1008baa80b50745305f97a75eab2094e6b2be19b03593b95ca158f5958b7f150509c106b6e3ed325
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEoc:A3k03kB56ri
TLSH
T174257B03E6940FA4D10F81749AA64662EA737C125F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 945KB
SHA256 7529e2c706444fa5471fd54f95c5e8c9979500206d704f542bd96b66c221505d
MD5 bcebd0b60e7d14cf14d87294937e62d1
SHA1 0ae070df7770fd1f09a92cdbb24d7e36d75b53d2
SHA512 8279ec81e8c3967635b0a2f9a112e34d8bbf4403fee472c30793808bdae54837c489d81c9d2abeb2c00c775219f9e129b5e97b9f59589178aa4d5dd3f18e6aff
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEBp:A3k03kB56rI
TLSH
T12D257B03E6940FA4D10F81749AA64662EA737C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 945KB
SHA256 3d4e4686ddc088f92a33d89ad4b53a509332758acccd511eaba344a2786a69a1
MD5 ea6d841ed0341057b0a1acc0f079101c
SHA1 f64f6d18e0f98ce72c2c1db5b643e48dc99b6953
SHA512 e12b8103b8c0d51549c0a58cbf105eafd4e4acd0f3aae3f4713aced1b818caf1f7bd0bcff57fcf955060c386f50828ed35016c7d64ffaa349da90913749a65bf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEWN:A3k03kB56rX
TLSH
T11C257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 945KB
SHA256 8fea74e4583650b0eb0d3067a18d3e26f222b68ecef86a3f2d07bc184e692a25
MD5 afa6bb1adc576f78a6f8abaff190ffff
SHA1 c3fae79165ff32c4c72283b25196bb3b1f5355a9
SHA512 81b2de857a319fc7ec8f7b8e1c93c03176ffb2cb91d647699a1c057af56f97f632e98eeeaa4f671bb81838247b60c2605e5848ce09db3c58b4237d7f2b04d148
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEaF:A3k03kB56rR
TLSH
T19B257B03E6940FA5D10F81749AA64662EA737C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 945KB
SHA256 4bf5ae121b69a403e157fe6f26897c945fb873e7ddf9c2c39491fd7bb7d677b1
MD5 fb7d9ecd0c979a16e6d13ef113a81dcb
SHA1 7699328d8c34927dfc5111d6b4d9cdd705607140
SHA512 dec4cbe17c61ab2d5cf61451454113dd3cb966600dfc4f3fa781f4c31efb8608fa768c74285c0917678766157de648253a92787ea97986be8c7fa54479f4149a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEvC:A3k03kB56r9
TLSH
T112257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 945KB
SHA256 5cc62ee75ac6ee898a14beb0755e3df45d8d4f203648ad1c6e549e05bb778671
MD5 8b9de0f030df6a2f25417e8ca16c5dce
SHA1 84e823b4715e12470e8ee4ce84f46d546635a3a4
SHA512 7249a69ef0ed889c275bdeca346a8bbe43ebc87af296ce1bf5aac37fce3f9bef0872cd88b282c44a8d82a60b00b7155f23c348238e8f3b79fac5557cfd76038e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEQw:A3k03kB56rA
TLSH
T17C257B03E6940FA4D10F81749AA64662EA737C125F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 945KB
SHA256 29747f0dbe0a8ccc8600aac3337c30d69fd39a2804857167635cc320c9c01175
MD5 32943f43b1aca3d9db213862903532f3
SHA1 0f393a9a69cb4031e6fd7953e0fb745664f0b5d1
SHA512 f79288c8c161ee95b154dbe28bcbf3d69e076e1c3fcd862a3dba0447be4edec3217222d2f36c9f5499baa70cd98afd8d171f0af4933c66f76dbb508efe8e77d9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEvT:A3k03kB56rY
TLSH
T107257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 945KB
SHA256 3d599bbd5bf07117f7be16e8b7675b2bf229d4094827c083a6d7d2a2a35b7880
MD5 0e40f2620f016a9509c8d95d65097030
SHA1 0d79b59946e905dec94efa60f9e22dd95381287d
SHA512 6e06f82a9730b1f6ac83c130a9280884341491457e93b8ea3c9fad82c11c40706fcee3cde1fc1fbe2269dcdc55489482471fa559805fe384752cba50f1a22ef5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEpu:A3k03kB56rn
TLSH
T153257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 945KB
SHA256 22a6cd2652dc214966f2a045051492a5386d67fa930e4fade1d5900c7d2687b5
MD5 bd6314ac96609cb0352afcbddeb8409f
SHA1 b18f0856fe1a1ac669489bae733b8240a6b30809
SHA512 d3a4c431bf54776437fcfba5fd614bd54164cec65dddff7d2c506937c7ae4c7d627f702417225cd3d5fb7e776963f81aaeb9a34683558196015b30d4949b3eb8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEhb:A3k03kB56re
TLSH
T1FA257B03E6940FA5D10F81749AA64662EA737C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 945KB
SHA256 da3518b69c330a4060df462bcfe7433605852df75ea96d33a06085c4154f6a3f
MD5 d408a0d5716bcc3bcd3fdb990849114d
SHA1 4642d61de74f521e9b097e03c17fc2f749297e18
SHA512 bf5556a3e3da09e26bef0afa420d7e1c749891bff8d438fdcbb8c0cfd6e77d17fb40c06237817da895d7c8ba4ff1e7cad6e8437387d6a216ad9fe4e9256ee910
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEpf:A3k03kB56r+
TLSH
T120257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 945KB
SHA256 4b262cf5037227c24b237ebd457279f76212c7a6c073d13a39cfa4f09fc684fe
MD5 47fb6216b3cd222c8831c773838a8cf2
SHA1 2cf8889c8c27147237d6d014acb924d4ad1def6d
SHA512 bf7fe82dd2ae086961ddb623b9bc0d91d2a4fb658c6662b2d21e6f12ab694164da0042035ccfe28d3e183d1af6d8db24b510a2925a3c0cdda8c78cc919ff4f39
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyESK:A3k03kB56re
TLSH
T1DF257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 945KB
SHA256 dc9bad39cf92e6c67349af56c62d84ebdaa3e92cb7ff7adc2a416d158001f286
MD5 6f61b3d66f211c4a7072852fec4be007
SHA1 3f4d81e5faca8cbbce5230630635cbbd345903d9
SHA512 794229ddbb532cecbccfe2492c853dbcc2b28b6c5bc1c6ebd0f1416210c9f4f44b516f68a8e1fafe84a9700909a133a291fb6e7dbba73e1122a659fe1f5524d0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyE3k:A3k03kB56rD
TLSH
T1B4257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 945KB
SHA256 5cabfc59bcd9802b83d4eea4976499abdab1dad5221c5ae1103ab09c5d9275e7
MD5 721918387083b0092f3c73e9ce7fa3a1
SHA1 d6d9cdf6da457451d30c7ec8da23ead0e924ef17
SHA512 d59cba41af55d60603e238cbe84ab00d6608c5c3d08039c91cba7ae8df57cc009fe85f81938c9328effb20d70b45efa8f4eb4d91ee2a186390ebf9ab9c3f19b5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEA0:A3k03kB56rC
TLSH
T1B7257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 945KB
SHA256 d6015a3a044e9a0294d6f2dc0fb0118b5f6bd9085d0945232d51ca545dfc682b
MD5 eb7cc42eb37f8b95f0e0af1c313b8ba0
SHA1 503bce29d09f9b695712d71db01c4c8248c8b8dc
SHA512 7a11472a171532ab01a2ce6f2b71fa707a0cf50e6c0e4a070176fc8dcbc2bc2349cbb367491f199ccbd5f7d2680038507a156b1aa3f05a106a2393116c2133ab
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEbg:A3k03kB56r7
TLSH
T19C257B03E6940FA4D10F81749AA64662EA737C125F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 945KB
SHA256 88c79dcc6d3ff308433007941e6a5613931dc9530b4b3e320099bf3868761e73
MD5 96c3426f6433d14d42ce52833f5ad2e9
SHA1 b439c485ce1681ecf7e1952e01847a461c4e0592
SHA512 8d04cfc1817b954ed9b8b9b9d53f577ef314392f934c811bc2e1ee9a9f8ea5e3b8dffe4ffd1856712905cd5deb91caa170e3939aeced651e5d3d48a4278ee228
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEWr:A3k03kB56rt
TLSH
T1A7257B03E6940FA5D10F81749AA64662EA737C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 945KB
SHA256 09339a89474e371d008dd3728940399c1c8aef68cf7ac8bc8cadadbbb87b88e9
MD5 f946ee5148e2bba5e54ef4c61d4eee38
SHA1 14b2bf865fbf7d288b32f579c4ea603b4444ed83
SHA512 112a3e064cf371d2893435f1e7193086d3f8383795197eea404197d6b735b9b9bf30b608f97ae0bd1c6bb24212c9bd89fec71de990949a5391f03f7f3c776849
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyE8n:A3k03kB56rv
TLSH
T1B2257B03E6940FA5D10F81749AA64662EA737C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 945KB
SHA256 4f5c3801f3e27de04638fdd1bd04762d67546c241c5d491f76af96adba7a4405
MD5 f79ef5d61184555466e73ccd8230ff05
SHA1 20578757c863ce29996d058474b03087f5a26def
SHA512 20e05418e230d8ed91e1f1d923ce843d9d4d67442b6e882cc88ebc5f025579095069873f655b0c01bad3adf1ea392bda8510fcf18fbc1fcf153fd7a2172c950a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyE6x:A3k03kB56rV
TLSH
T161257B03E6940FA4D10F81749AA64662EA737C125F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 945KB
SHA256 93b765b9b34aea19dbc846546930f1381913bf02342c0cb910d53dd5e12d3bc7
MD5 7e355bc88720fb65c3fad16c80510d89
SHA1 9de21f87618ff18ea6c69503f3a19dac408d8502
SHA512 3ce919499afdc63382b74b247c09e3fb92fb4362f7cf2c63efe624456a507d2a089ff5a4b714e6e03eb18c574b08cd7959f3ad358151e3354d098265dfce23fc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyE8A:A3k03kB56ra
TLSH
T1CF257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 945KB
SHA256 5e3a72103fea0339a1d696c75fa69c62333a032b6ba922b76f6e9676f9f8b871
MD5 6244e0728917386872f6904dbc829ca4
SHA1 42355b11329895a892d868cebb293cab0257afae
SHA512 de6846b469ee18ef56643614a97d15bd3aa6b512e8c790c8a561dde81fd5ccab99243c9c75f24c8b0127f2ff42b936d73949dfe4f43273549dffa18ad04b5124
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEl9Q:A3k03kB56rn
TLSH
T1D1257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 945KB
SHA256 8cbf6de4b8973d313714be4d8d9745bc684095e2b54c4a13e9efd2f84406cdfe
MD5 15d39ce2a8468d784124c02691826606
SHA1 706279c45a6ca744eba6967b0835c34a729e39ec
SHA512 100b8d28d5b1317ecda401becf559e0a1820c36f8676b158860010025ca52ff61c5098c3b1bbffbb7b7507098fb27ecb146dc373fd413bb80c4e49d5ac0cdb35
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEQ4:A3k03kB56r4
TLSH
T145257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 945KB
SHA256 bfc9504d4dbe8db67efab9a2c64911098582c18fda02cc213570ba7403f92bce
MD5 41561837423d7503167fca4ac56795bc
SHA1 697f53a22362cb48b8ebaec116ac9c2d89257718
SHA512 7a01a629390d93f457a4006184d1d92a9f09c1ea43995651c877e20ff2c2c23ff67a6eea693816e11b9af538f2f034fb1af73394cc254f5eeec984016a92b13c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyETu:A3k03kB56rJ
TLSH
T13C257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 945KB
SHA256 71384c6365c71242631d03e306d248b41f03fa6fd2aa357fa452f977a1680925
MD5 77f125075ca658d3a9897a842c9b4b0e
SHA1 f13ccfb11de0a3a96c0490565b7abfd400029db8
SHA512 9ddd081e32298d76fe3493ecfc6450cd8091bed499af141ec49c63f954186a80da8ba7cbacb2715acc4279c130873da29de2898ace90d981fc2a8980b72478d1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEOj:A3k03kB56rT
TLSH
T1BD257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 945KB
SHA256 eaa717dd41223722fa9ea44aa2a5318c40b60992f4a5ae78adfe1ad1ffb6bccf
MD5 e77c5f1e613b5a926c3d34b6753470bd
SHA1 16d3fc97b1bbae3f7b2b8edafea7b6a0e4996d9e
SHA512 4339a8fdde1fb07f18cdf561e4900d539233904887db9129a3b43b479204aa843450ad77ecedd6d69f8927dbc608d4e1d6e9e633b34761bb3ddbc28229809bfe
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyE7g:A3k03kB56r7
TLSH
T1AC257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 945KB
SHA256 7f3f5b5ec5ac6bdfb347eef28273b425ff0e2351a67c1ab1d1e15a94ffca00a8
MD5 c8fad239e774a52a1bd045daf8be2f63
SHA1 2327cffb4acb2bfdafb6c2f002b226c72fb69922
SHA512 155e457bba7ad5622361d8b4f3914608e9981349b8e6a7311a933230fc804be4cb8961be38942722bbc3bf6c1335df573bcee8e5132295da0084002a7ef5484b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEmI:A3k03kB56ry
TLSH
T1BF257B03E6940FA5D10F81749AA64662EA737C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 945KB
SHA256 c87ab2f8d823c976e3a49fa56df17f54b8ab7461a2158bf535a16c19035575f2
MD5 0af8ffaf5d4e225fd7c886a3039e37d8
SHA1 162b02ea7e5dbc166676fb3394eb6333919be2cb
SHA512 4ad9b994d496c5f5082b40a94a706f87a7363b1ccb752e3a39857e29b44a5fb91b0c3b081c269587a4a6cd7f97c37d5b9d7d5432d01cba2fa88cdb7b91270131
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEUo:A3k03kB56rQ
TLSH
T168257B03E6940FA5D10F81749AA64662EA737C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 945KB
SHA256 3619e79b5c5ac6b8a3caf9638cd4bab9128605066852dbbdcbcf5debea4e47fd
MD5 0f4e54d2c9eb88d72eaeee15a89456a9
SHA1 756a91cde18a3316c14c72c087ca8240a1c396eb
SHA512 1cbfa446051edc864058bd488e68791c2dae1ce7fa62f995607e837c9a9894c2cece822635ba1e512f4c12e5eee90088c65058ad47b5b6390f1372b2a6fe1333
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyE3+:A3k03kB56rd
TLSH
T15A257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 945KB
SHA256 7110a7e743263d814e972e1ee4f9c69d6f41621c1de062005891489b0b03cfc4
MD5 3daed7bc421e2ea1c5afc12c65bde49f
SHA1 4071925be94957ac738829def4bff17250f4e507
SHA512 c7ee6ef5552baa2a807b1e539cf9366e7c3caa3c937914d9bb72bf3765014a9438a235855523ac0cde7939c9460bc0032bd880d9e11d23c28bca773c1ba7421b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyENQ:A3k03kB56rV
TLSH
T182257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 945KB
SHA256 2b01e0ac0d092240a62c63addd7f013ee36ad7ddc688cbe8830f55ff9d0cfb22
MD5 c0ad65919868dd05f2dc6270c0f0710b
SHA1 0389da31b5ab529e2e3f2d918a1ed4f326cc0291
SHA512 29989c9e4f3bdaea2664fc3421958992447bc67cf4fd77495f0e94ad15617da1a203e281ed736401680fa75217bf91a68e87b699ba900068ed00cf8560622f19
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyECX:A3k03kB56rB
TLSH
T12B257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 945KB
SHA256 71f09ae1188e7ac469f5948ecda18af38fe3891abea4bb837f3edbeb484976f5
MD5 0538173d9a9354f7c4a8cf29f392b04a
SHA1 6ac5116870ae1af51c5b45c205ecbe7d7292154d
SHA512 67418e6c888c760f346226b73f3dbe85e31446a6169e7fd32f328a81fbfc7e79c177165b5ea3b9bc8ddae69646e0d732ff0c834b9f53df52ba6c826051b8808e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEkL:A3k03kB56rL
TLSH
T15C257B03E6940FA4D10F81749AA64662EA737C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 945KB
SHA256 b11fc0d027a146d3de360b6d82cbf84aef5beb5b975bf4c6c3f5115bf3a88269
MD5 ea948e13bc1083a39d0f52b6df037822
SHA1 de652b59a3790bb630564f93d506baaac62fa3c9
SHA512 ebe8e6025681e9a560f6927eb612c432bd69a6543edf081c03bc41dfde280891c6c62af7d42184f6c365a20f881cc674c975bc5797fd082d168bab203441393c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEAM:A3k03kB56rG
TLSH
T128257B03E6940FA5D10F81749AA64662EA737C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 945KB
SHA256 a532d8f7fad96927b670fffd05b1da551f26e9ccdaa4dd9edc587354d29b17e8
MD5 f192668ee53c8c47b710b5687198bf6d
SHA1 c721f454d5a53cc24497c2939c8cea4525f059f6
SHA512 bfdeeb5f17ca88e336a1a1af90ba9184ad8883a260fcc1c84eb22cece4f30f2e9caf890e11847cb108be67b65a93666e42bb2dbd39fea7c4a3b2667dbb1fbc18
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsDapyEhh:A3k03kB56rY
TLSH
T15E257B03E6940FA4D10F81749AA64662EA777C025F2097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3780-47-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4216-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4216-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads