42a76d4df7137fe929850c9313ff63235683cc4b06453c48e3db979fd72b5403

Analysis

max time kernel
103s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 924KB
Sample260730-m5ppnswcrd
SHA256 42a76d4df7137fe929850c9313ff63235683cc4b06453c48e3db979fd72b5403
MD5 f32b52d4bfaeaf8c55ba090a65bd23ef
SHA1 24f418624824932e9962b4f1984f362c91e3f79a
SHA512 260fd730b728a6ff46af8579377301925bfd19c9002f4105c6125ec96b29d5ea553ba1384a71befcfc4e80b0b7cfd246a5d5e269eea027585b4d8d8f37f211eb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYao6:A3k03kB56rl
TLSH
T176157B03E6850FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4424-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5d3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2a3-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4424-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3712-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c3-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c85-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019845-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-444.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-493.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a55-566.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-609.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-640.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-769.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-801.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-844.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-869.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-933.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-952.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-1001.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1045.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1083.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-1132.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1151.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1176.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1329.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1342.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1403.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c5d3-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2a3-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c3-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c85-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019845-226.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-444.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-493.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a55-566.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-609.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-640.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-769.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-801.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-844.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-869.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-933.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-952.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-1001.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1045.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1083.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-1132.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1151.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1176.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1183.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1220.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1329.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1342.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1400.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1401.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1403.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3712	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wabmig.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4424	2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3712	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_f32b52d4bfaeaf8c55ba090a65bd23ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4424

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 924KB
SHA256 42a76d4df7137fe929850c9313ff63235683cc4b06453c48e3db979fd72b5403
MD5 f32b52d4bfaeaf8c55ba090a65bd23ef
SHA1 24f418624824932e9962b4f1984f362c91e3f79a
SHA512 260fd730b728a6ff46af8579377301925bfd19c9002f4105c6125ec96b29d5ea553ba1384a71befcfc4e80b0b7cfd246a5d5e269eea027585b4d8d8f37f211eb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYao6:A3k03kB56rl
TLSH
T176157B03E6850FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 d91b2aada188977a5ea6b81e58c9422e09f5b7891aa2d991d3f73939a9662069
MD5 cf481cba717976631a933d67045af0f9
SHA1 ad0cc27c5136b9d816df93408dd120ade6bd5525
SHA512 50d40e50789c8c5b64e612071004de444473ddd0ed25779c7e80d6a7ad01a1139073ebc26cedd5f1c46983cfe72e3df7d06f3a612745d9cf37f17a236269dca7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoK0Le5ji0hmxNrM:A3k03kB56rhPji0Aj
TLSH
T1A4655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 938KB
SHA256 73404e3ce6af6138981492094af859fe49c8ad4d9e8aa5d67bea73a71e645963
MD5 40ea16dbe347087eac4c9428f7b550b7
SHA1 4d2d07ffd2ba39c0fdb5dde813c87ca0ca502c78
SHA512 8ba103575ab090dd0f00fec113420a1c5de01910644649551b3b7788904410e982965e8cf994fc264a39f43e5c766e4ce17d59547ffd8f34bb021d00454a42a6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoEa:A3k03kB56r
TLSH
T101157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 972KB
SHA256 bd30d47110a8445d4b6b9f8033bceb23275b41561e7b0012adca0a8204b2677c
MD5 8d3e793d15c51f9d8f3c22952255b835
SHA1 0b22d855a5081b615f2c6e5ad26d5f55fe296889
SHA512 a9cdb5356c027f2df39e5378ae84f2eb16e79e5f025aed59fb421b59c7448cdba7bbf06931a25e51c12874a888199df42cf1b445a63d2db790109cce8d3c1413
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoPb:A3k03kB56rwb
TLSH
T13B258C03E6940FA5D10F81749AA58672EA777C425F2093DF2358AE153F72BC06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 947KB
SHA256 84b448f8f93ab8f6d7dca3d4e25ad4bb7e1741539115ac2a32622a83374116fa
MD5 ee0d8de072fecd3d3e37cf64a02bf846
SHA1 f309f1b5445e2663e8d2904c43447b00b2e077e4
SHA512 c074898cb70023e7fd1a29e6ed8f4c130bb23ac6688466ce558c17979d3ab2e15f1b62db60a3941fc37a24520d8c4308ed9d9ed54b8645fc10d57fc62866aa30
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYao96:A3k03kB56rt
TLSH
T172257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 947KB
SHA256 162a1d2f2c1db3f228647e801507c8bbb7ada9a720f4ae5d81b64523f3a5372a
MD5 083575de974ebc5996888a9de571a6a4
SHA1 8f1c999f1124f1ed13f42e367e9d60df1cfb8fc4
SHA512 76900715f667d79bf002ed2748f11cb08e660144241ee1f13331161f44196353fcae56acaaad7b5fe199c14c1ad551e0635b60008e6ae8f472257c5b29a416a4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoTN:A3k03kB56rM
TLSH
T16C257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 947KB
SHA256 fc479d37f712b848abda6377b24d6697d4feb3277d213adb4f3f755b7b9c4f64
MD5 ab6988c5a0412cf763c582e0eb9ee4ac
SHA1 53ccee1a657a9f6ee6cd2330f4531ef24b7568e6
SHA512 75dd41a756dc32b45f4ca30c5117d02e3f2cc7ffb851d048f2c17a2c1e8315022e276e35f644f93d88c46f0f4bbda7953dcb53861f03cc954a22baba9541efb0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaohf:A3k03kB56rs
TLSH
T102257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 947KB
SHA256 6ab76f7f61fca4ce955398d4b9b074cf622d07ca39c474c53ae818b01733639f
MD5 d361f6182c9b3f36fbcce19974087719
SHA1 24968a345d9a61f9e125b66cfbeec9afc81c5bec
SHA512 c7449c1513773191ce87bd65dba7bede2f6c43124966bbcc61826745266ac036792847f9b2436ee7d60fa598482da0597e7e9acf1a55e07c2079ea5e75fc6b56
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoDo:A3k03kB56rh
TLSH
T1DA257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 947KB
SHA256 5e3368b685e539c36a3878ad560899d21d7ab19fdf0a8c7c1d4c9921aa75c9cc
MD5 d9f52d78fa51e5f1e94255cf0cff2b93
SHA1 0dc7517d9cab8af5c27799678169391d81070137
SHA512 4839d5e34bd5922ba324aa9578aa7a0b86c21f98ff54d6c8f3b8a1400dd0bfb7993e3ff1bc693a8606068056f6b0939f3f8a6c3220f890f9e3cac04eb51cacf3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYao3u:A3k03kB56rz
TLSH
T162257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 947KB
SHA256 4bbe4f9eed475c98a0868df2ebdcdde58bc8106d6933efee2d7b3fc64be8f0aa
MD5 088b258f9d4fe2bd18181ef39ae730b2
SHA1 216381da72d973156cb5fee45dcbdab3c3b3d98a
SHA512 56b92e121e3ceb42bb67ea84e8265aa951ed8a1dad0fb89c3df9dfca95491768ba953e2fa72510c649ceda18f5e250591684f0216e8b9908014ed8477a215af9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoF9:A3k03kB56ry
TLSH
T158257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 947KB
SHA256 b4a68584a637e38cdca1260a796be0eca2933b47fe03a2f1a4525adf51d2b97f
MD5 5c2d471cc872cf76c4ed47023356ed81
SHA1 0764dcc5a7627c9e9f33fa72e3b5fda28c922570
SHA512 0587618709c3b711dedd143179bf94d6a930bd36b426bb12bcc9e5770c068fa98df02f5c6cfd985261e946dbbac397bf519fcb845e3c70a6e9f20adcb3cd31b8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaohc:A3k03kB56rf
TLSH
T184257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 947KB
SHA256 b6d5f5f429079c046144a8ce1e5ffabfb0114279491c991776c3f70a5477dd2f
MD5 83a4511ab05383da1f642a2263c38683
SHA1 ca4a3571a4f26cfb9d848ce5d2533bd3255e635b
SHA512 013b4ca4fcf9e3db83d7cbb7ddbaf04d0b5d28521ee1da72a05d3fbb9b11713d61c6b1ec6119f0a560b5d2bc92717eccb0785cca25c733a9924af653e6c2f6a0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoKp:A3k03kB56r1
TLSH
T12A257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 947KB
SHA256 de65880f5109be16296773ed606e1fd694c02125bec2c3e0ce84b44988212116
MD5 06718d937412da504188ce72583d09f0
SHA1 1c2474fe178ab8060c8b5d279913ca80245d97e4
SHA512 0a28666f278862212d31d5f9a962a8b736cfda9f318d74a2b495bd40bc99351fce6fe8253e0064b28ce6a362819ee741b89c0f518795d0fbced82e2a92001e0d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaotN:A3k03kB56rO
TLSH
T1BC257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 947KB
SHA256 afeeaea3a7709ea7df0743a4a4f48d64059bdca7de18ffd6a70e703f3a8a7ba1
MD5 6de0535598ac98ed612113f268e4865f
SHA1 38eace25069545d5074782588cba68f9db27a13f
SHA512 11fa501de0e64c39fe84c415598a2d7304a378b2da242d17a3fea97b8e66f3513e68a4308a604d0454bc35342996539b9fae1e8dc88e1f033cbcdde421fb5710
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaofF:A3k03kB56rM
TLSH
T1F1257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 947KB
SHA256 07307c643b74f42a4b19480828074e2284937612cf0c380e7bccea3912af95c8
MD5 778d930cff5e6408db0bcb6746d96c00
SHA1 0f3e7229d29a07b363bfaa114717c5e7d0be9782
SHA512 93afc09c20c16cedb2594425877625e7173c307c97a8a1ab53ae7d64922fcf7edb0869436bef44aa030b184d72993c7fbed9aa67944f98ee3f5aad77183051f5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoAC:A3k03kB56rY
TLSH
T1AB257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 947KB
SHA256 f025a2acac761c05e4b86db9b7090ed8f786bebddfe5fbccf63c1940ad546018
MD5 131e5b8ad987f7cc24e07a478b1eb707
SHA1 14bfb8c1c883ea9068bde6ec79783cd8ee3acd0d
SHA512 0fa105648f7172fbe39f4cc38977eecddcc4452d5355384a82924b8cfea3cb14ee6ad3624727bb61da84bdfc6e92a5d0db1791ef63eb2752c40a43913cb97645
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoTw:A3k03kB56r1
TLSH
T1C7257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 947KB
SHA256 1fa5289e7666bf22c55ec004a93765436346ad4fda98157e23a30365fd855080
MD5 f60147254f518206bb24be1884855056
SHA1 5512cb1b1c7083dc93397ea1f997da9a2e2f63e3
SHA512 8d0d2080e7504ce3ddf444eab3f2c89f6327299b51bc61dc5ef6869346316b32867d6f7bab7667fd4454d80f57855f2116c57004146616b44fd5d13afe6d1c1b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoaT:A3k03kB56rp
TLSH
T1D8257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 947KB
SHA256 560ddd73a5f667f81e1c50fababa5f53d0cb03cbb848d2ac231fa9a86ccf8d91
MD5 ae6a6c30a30443b57f03d00554c23178
SHA1 32547a6315f9f1e425b479e260f9e3a658c12520
SHA512 0845c77a18a5969812efb127bc6e32bbaa2be232e8cfe2f3b8bf59f83e74a38e946e1f48c59d63f70e9c1758c11f663c8e1088a5420c7aba78f0a4e6f12e513c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYao6u:A3k03kB56ru
TLSH
T11A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 947KB
SHA256 433bf178447c1e10e8d453d651d149eb5bc5b430027b2d1e45b6bb95594c1aac
MD5 cee8706efa8b4faa91fed3dccfd31543
SHA1 974d7d9ed4d531b168a77eb8b7b91c2c0b1dad4f
SHA512 4c8d14e9ae0be776cba203e3c7133687185675cac0417fe6f0f66a505997c8dccbeb12fb2dc21c7a23aa05d6c418e53ed8cdb4f857fa30019986d99f29b7e94b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoEb:A3k03kB56rv
TLSH
T1CB257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 947KB
SHA256 54495a001b4a885380f2f8a0e8b8af2c0afa957dcd55411f57f01bf6ea5fac4d
MD5 124adb0396e8964ceae62f70e6b1598d
SHA1 c7decbf947f7728e5988287fd8e35ad94a1d8402
SHA512 dd84ad865cc7d9b50e1b1c738d8507fd3275b6f2d3727111a1009deda38d980075028cbf685ad8ec3a20c521bded6238e60a6e4a56157fa64ff75ec43956dca8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoKf:A3k03kB56rn
TLSH
T194257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 947KB
SHA256 853da4ac5aee68ca0265ceb414d20a2b2c1648a670203dc6e15d2ee03594ea58
MD5 750fdcbd81b5cbb99d399984b9aeeaec
SHA1 ade6b13909193650777a54ad3ca3393815f6aef9
SHA512 11c16eafdcf6d8ab17bce9900a470cc1ad253b603fa2ee0f0a86ad8cf6c92b51334a91b13d1d6ec201fc52926e937f7089f97990aed2b9c6d1750a094f8a6a42
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoXK:A3k03kB56rn
TLSH
T1E8257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 947KB
SHA256 0d91a88c708f8dcff1e7d6b9d129dbedee133028fe68f7202bc087e4e00067f8
MD5 12634309cebc7348dc6f31a4320df249
SHA1 c571f0f23b21ee4427cefa7eab21231b277f5b5c
SHA512 0be556717c7f9a3d277a63810783503290f06eeadc46a466d2da0d054afec82de04dd4a12ce04f3ff1145340fa49b476cbb4bdca8556f7888182b4796a0b076e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaogk:A3k03kB56rC
TLSH
T118257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 947KB
SHA256 f1ae91c407b5009fff5cf6d70db8463c1908d507231db4f44926f52238049f7c
MD5 6bb5c89bb0ac24e5c67c8fd3ef911b01
SHA1 3b9cc5999d17b8a64a914ac0fd5c3fa3004e076a
SHA512 844504164c67acd63af8c8dc47a714c1a22e322478daa900bd89ff2733bebcc8eb7086742fc1a4c8ee65df7d2320098502e2e7259f7187e60306f22c174a851c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoR0:A3k03kB56rn
TLSH
T118257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 947KB
SHA256 0c0b42d222e4a2532637d577a3b40d26b34fa2c6c129f09a6df35c55dc5754f0
MD5 5a303229528f5dd07dfaafc3d2ac8e72
SHA1 a74e43573fc4188fbea19df12e5536d63af4896c
SHA512 c393151890bb0a576494ee6ebc016618d2590956d70eb088d3afa58b4a85d06514b2431602c5ebb17d19287914ab1ba03a477018fc4401136e5fc528bf9414ed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoEg:A3k03kB56ra
TLSH
T197257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 947KB
SHA256 d44c9e139f30afbaed73c783c69265c568ac4a95be9a5642610a11591fed08e9
MD5 3328496fc24301e9e9bd93028a3bd19a
SHA1 c95c513e02efd011384178d3e2bd9e8264d7ced0
SHA512 5987a8c5bf7f7860f4784589ab39ebfa92fd1a2414c83cf3cfc37848126b71f8721ad02ae5c1740b9c5ce541ca02cbcbf2b65fb1859a9c02ad953f94fda9a778
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaohr:A3k03kB56rk
TLSH
T1EB257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 947KB
SHA256 2c088cd2b24ceacc8b9fbbc44680dd9e2434ee2939374326f2780da12a570bc0
MD5 6fe9243502b04b33d56decb39d2e3599
SHA1 11f5c81c69acdae2cdcca9f19f2a6b3ca87a3089
SHA512 a2579d33301f54430fe3012ca1a2e960920b4c9d19f08fe584c4855a1b669e586d436cb61a5e69a59bdc418f9dfac06408702bbcb108a241a786420313fb2d72
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaojn:A3k03kB56r+
TLSH
T1B7257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 947KB
SHA256 f235ba08cb79700ac2f5089bc61d673efa9dbc1281ccd13b9fbb4c1a2e530b5f
MD5 78cf2fe0c7b5812473ccdec7b65e9fad
SHA1 0729fab7d6f4266773112e03bec47a0788d4f924
SHA512 9089f7233a92afa98fe52c065f4d4de8c1ba947c7de4abc974818762ed48a3bc8d87fb06e79bbfb63c7543fe8d03507b0a60a65771839d5b960f375a6b0cc27b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYao/x:A3k03kB56rk
TLSH
T12D257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 947KB
SHA256 5f2b979357be1da51761c0debd0e0a6f7f8ce6288b2855dacf0e851115de909a
MD5 fec9bb771807a64f8ea74467843c4c32
SHA1 e8d6ab3a93011ae2ed258dfa8ed1f43b3e970224
SHA512 f0eb79b46f7db76efb38ce29ab0b2dce547dd577700f89f8324810ad3da2723c4ce2b2c3687353bda96795863df2982407d9db04996551c493b0785c7d15e69c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaolA:A3k03kB56rP
TLSH
T172257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 947KB
SHA256 cb5f056b2300abbd3e78b85eb864b66b4d11164d152dce5c48becbd266a20214
MD5 9d77e6b88d7f72256a70fdc1716363c0
SHA1 dadde7ecfd94a5f734c99853d6ab9723617305d8
SHA512 e576944c308362bed20879d1d0b492e8c8e036b99664201eb5665e7acd4d472120f53d5453ebeee5de3e975c68746d3271d15f917dc1cf51ab4eb469081ee279
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoe9Q:A3k03kB56rC
TLSH
T18D257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 947KB
SHA256 20566752369a7afdb5cc797e1f1ee96b50d3d147f47eca49f368f7914b4f28f3
MD5 f0115b545fc346c16595d12995d1c47b
SHA1 4334243c5075115bbb7a83b131c845259487d33e
SHA512 bffa9001801650604c91ee70a897704b84e02ca01ab2d3c48da82c158cfcb386aefe3c73fb320c3e6639d5ba3a83a110e0d8fb8624b1a878bb5c15c44c8d5424
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoL4:A3k03kB56rx
TLSH
T10B257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 947KB
SHA256 95fb6de0e5b39176008b22e51ab1b46e92566eb3730e427502fdaf7bfd3f6419
MD5 5ac87e17e52e0ec4935712a24a4165a6
SHA1 50ed0d3768d220bcd75db917a179dfca7baa1a52
SHA512 0027e783025fee6bc2a87014c97d12544181648fb4875b853702c996f14944756b207e9044c716fe628cd3b3abf1ee241877af79639d3851c4c25e422ca58f07
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoCu:A3k03kB56rM
TLSH
T1E4257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 947KB
SHA256 c4d7c270af672c766915558454a3f4e0242285e88c528e16f6e1f1ca3614587f
MD5 89aef53fb91ac371ed85da45c1da91e3
SHA1 9bb9dbf8d4807571af352c44bd70d721b4da47a0
SHA512 505881d2439f64508c5f793d74753015b8a664847ba577a7dedd8f3b12da1dabc991888c088f780381d02e93023f323503f20b8ea1388d1a89defb857ca07ee4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoTj:A3k03kB56rO
TLSH
T196257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 947KB
SHA256 089dcc7a3abf7f3de11874e4392a7719296ea3fcdedf1252f8eab144e899a4d0
MD5 30e51130366317914686a3b588bbcd4f
SHA1 9c9f148dda157dcfb8ca87fff167c2956c100ce2
SHA512 bc69fa018927ed8a14710864443943ad33aae57095fb8ef6a67c48f9f48708659fa0c1e96077a1af016a0d9a5e4b29cf3c95e40b2a3edd68a56fa6f4b69558d8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoeg:A3k03kB56rC
TLSH
T1E4257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 947KB
SHA256 1a2fe888c6d8a2384ae027f389da1a2ca9c9dd6428b94851812487763f8c4816
MD5 6d8f084ed83569e54d7671f2c1bfb4b0
SHA1 91f9249b7000291a19ac4a7273588cb9a6fecec4
SHA512 2b859e6ae7b290d1d934a0fb765cb45bae95008d3113619629f8140dde0a69f56382f14378944d6cec9782f0e3a633afa70941b63baec324a078340998bcd4a4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoRI:A3k03kB56rz
TLSH
T1FB257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 947KB
SHA256 0f85a280d6a877cab7d6f2cf9265054ecc1151e1e5ff6a5d56b593bb8ea6f9c2
MD5 ba3b633593e74869c5ae8110da2b8795
SHA1 47f4e92abaed90a8ec45dca00bbb4b326685b9f3
SHA512 14a54f1afb4cbb6b18a28d4baf466421d9ac6f3b200c82b227c84de938d8ad7e9273a9c5188aa2624b86058d6abd720ac35ee3dcf27406bcacccd7e6fb6cf18e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoTo:A3k03kB56rN
TLSH
T1CC257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 947KB
SHA256 f546bcf603dc3622336e073bc6bef9238fb53a6c729447af2e1b9ca6d7166e56
MD5 ee66300eaa6840ded6112842061a0677
SHA1 f34bc5394f382cadb3edd0d68135433f7492144b
SHA512 bf7961d9fe8763d1cbd0c51674f79abb83d00edcfbdbfe44ae7d996b103182c532f6366f2829b7095d3083ff8647c8aa1ac04db43c8e63612340846e5cac1204
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoY+:A3k03kB56ro
TLSH
T127257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 947KB
SHA256 ae2593fed6ebacca7453b43fdc16ab5c706c8a4a64c83371fdfbf7d37e2bd332
MD5 efbe22e717543db0eef661e90c0ec1b6
SHA1 aef2291aae15e68080ef91d7a22851d2f3463088
SHA512 780fca309ce6807f0e1019302aaf8ad60b62716dc62410bc1320c85c621c4fa6b864822d7a4655ede2dc794a49e0e7784952e49ae8ffddcc920b2d9b2180ac8c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaowQ:A3k03kB56ro
TLSH
T1DD257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 947KB
SHA256 ca8987fc2ca15f29669fdc40d371cd79413e20177e10d72719b7b7b54d6dcc33
MD5 a8eb9522a49e833cab26d9e681689651
SHA1 1660e5456ea51b405e0dc3c9546c18573fe0a4e3
SHA512 14e98b5ce50f348c1a2c8ef54d2f654a86c473e11f973e36abdda4bdcf28388ce5d4d7a61b3ca892a18c81621efc6df6714f6ac4dc44795a836dc3d55e308c77
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoZX:A3k03kB56rY
TLSH
T198257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 947KB
SHA256 b65f79d940ddec7518afe0f3932793a3234b6f2a0386e1a7f544a3266c00828d
MD5 923208efc8ed6b54d1dba1a291a6c827
SHA1 47ebdd1e00285d5b74d46b7ba027796338f3ba1c
SHA512 0b23573e7f5df6173bb7c2e26ec7ccc14b55898edc62b9002d4827923a8ae6273678a8d7dd4a2a8d89356063b49286f1e12ff8cb901329663712e1d1da21318f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaozL:A3k03kB56rq
TLSH
T1C2257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 947KB
SHA256 bf2926c2dc9e1e30e378b006f60634a3effb1e4cc7b445c5936fed2181c4e1a7
MD5 b4830262b52be142a30528d104a3fea9
SHA1 76ed58758ef3ce91774b3c7c1c32976daf4a6f4a
SHA512 9abb1f737e7d2355d54fcaf487e2c9f55ca31f341bc5e0a066669843bcea05082d1d68e8f45e81f2ef7410523a54b81a1e57d061e06c9cd47e6a78932a8c0e79
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoZM:A3k03kB56rn
TLSH
T16B257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 947KB
SHA256 f12cca1f4e09f39dbd90ab2cfeb96c6eed802d90975244acb61d5ca0c979ed75
MD5 5f33285f677afca4de24c94cb76d4dc5
SHA1 d31e440bd77f11a5cd45ebabd87ee25dddeceb05
SHA512 ab25663418b1853e9c3dcc14fa2a6c6baee91c568e5a2993de2e3bf0543ebcf9600fd9f05c583cb9f0edbd57fbd12f5f88044d2908745e2c2e7c62494f13953b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0mYaoih:A3k03kB56rZ
TLSH
T1A1257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3712-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4424-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4424-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads