391faebcff1d24e097eb7731ce64763ffa83466da98187c49ebf83fa850412b8

Analysis

max time kernel
93s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 915KB
Sample260805-c7472acc92
SHA256 391faebcff1d24e097eb7731ce64763ffa83466da98187c49ebf83fa850412b8
MD5 e734433fadc4be80b19f37f181a4cce2
SHA1 e397265598cf244ddd38b0d3709448567b6086d8
SHA512 47df4bb2df90d12c52be7f5bc5202d7fc6d9bf813da73b2ddd9089089798ef14f9a2f643bd1ac6dca0da535e9b370ca03667a905b8262f83a216a8e967bde0b4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5/:A3k03kB56rT/
TLSH
T1F8157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2496-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c624-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2496-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1480-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-654.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-978.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1040.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1121.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1178.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1215.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1337.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c624-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-57.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-654.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-783.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-978.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1040.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1060.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1121.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1146.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1171.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1178.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1215.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1318.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1337.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1363.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1371.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1384.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1480	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe

Drops file in Windows directory 29 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2496	2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1480	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_e734433fadc4be80b19f37f181a4cce2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2496

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 915KB
SHA256 391faebcff1d24e097eb7731ce64763ffa83466da98187c49ebf83fa850412b8
MD5 e734433fadc4be80b19f37f181a4cce2
SHA1 e397265598cf244ddd38b0d3709448567b6086d8
SHA512 47df4bb2df90d12c52be7f5bc5202d7fc6d9bf813da73b2ddd9089089798ef14f9a2f643bd1ac6dca0da535e9b370ca03667a905b8262f83a216a8e967bde0b4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5/:A3k03kB56rT/
TLSH
T1F8157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 7259d5c926fa200e7aeb04a57d4ca11d809cd40cad5e759e98acb34207bd471a
MD5 d86c0321b0884e56fc78023705b7353a
SHA1 b9efa5111cd3f1419a2324a342261307e9ab1a6a
SHA512 05a90fafe5ff619452008b141336830f0a0f7c70f38f4c81f5e98014214b752441421c7d3ee0712ff9bc248c805bbedec28ba442ae6e0bc04be0c493aedb06ed
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5r0Le5ji0hmxNrM:A3k03kB56rTrPji0Aj
TLSH
T176654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 930KB
SHA256 7801307fc1d7882ecd7537b5e2c668d28088ac1a45bd32b75c36c432ae22bd06
MD5 e03d23b85636dde2e0d975eb6450f41b
SHA1 9d17a0051b0430ecbd783d515e5779d3092b065d
SHA512 dfeb130ac04e630f425a18436c4a00cae0fae8183fcf32fdbdafe9a2b505f5e2dc02fdcb16149b3c27b69f6008b91cec91febbfa5f6aa7b37f6de243350c2a4b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5ta:A3k03kB56rT
TLSH
T137157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 939KB
SHA256 b1aa8a2c4edca44f013616ba74139a4308ca14ba58bd212b0250180450f8ff67
MD5 c8b540376d3b368bd08630488a5af749
SHA1 531e250bbb19372d9a06a67e67401064bc410b44
SHA512 c76fff49f28019eb933a2c26dc24bd8f4341f91fd40656e8d10cd9e0147465c6f9d6914f894d0b730870c4defef267540b65eecf9fbdb231bf31b9273cf91e5f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5k6:A3k03kB56rTz
TLSH
T162157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 939KB
SHA256 9f0f68325694afeedcb5673e32817646282037596e6eb3b1e5335afdecf72b9a
MD5 e3b2bfd3236e28e6af4fc841aa9a5396
SHA1 1cb23870c57451d1863d2b7399e400cac8e9f8aa
SHA512 9f7e602c1662385f6526e4c7c043bddd71ea0bce5dce70a03e6b6eb6a1ec844bdc1eaf205d751f440d9c17524e221e93189c2dbebb239c1b374d686a58b11300
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5AN:A3k03kB56rTu
TLSH
T1BA157B03E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 939KB
SHA256 52b4c43d201b75dc9902accd195b64ddc72024d1c6581bccd59ed087e0337f60
MD5 49f54fd059b2dd1b402b0d2ac5046b66
SHA1 258c6593ee86187efb11da754e2478836f4103ce
SHA512 660bcc8f0475e74b04b0f4cf1c0288112813a9ce04810cf8b67d6a28ff57971670c70212069c1732453c232da3ed8915aa4556ac2c822ca43e228c91f3358ab6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5uf:A3k03kB56rTi
TLSH
T1D6157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 939KB
SHA256 17f9ebf59f0bce88f3e796b6337db2ab5f55a38811b50d477bfd9de17556e558
MD5 12b02fda37255a49773f3c71d1b2911b
SHA1 9e90d72b56332f16c0356e5d3f4906be5ed701e9
SHA512 e8051ef48c0daf7564ad76339c5794d202f2a98e71b471d7c915be06689d1487085384bd64f21dcac954a8ba4570bc24410e7ec807093e8bc4f1d1afe4d93642
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5Yo:A3k03kB56rTr
TLSH
T137157B03E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 939KB
SHA256 b39054246f987286ccb5f28e75fb3b5d709fd3966e06bad487189b31a6f1c3fd
MD5 adb84ceeeeb4a8c86c666f70d99e6834
SHA1 0f8fdc102e840c925a5764c21c438b51085a03a9
SHA512 8a86a3f01a1e459f3c1e3298fb25b8d31ed50dbeeddd4a40deeba5467af4cc600291210b101d4c72fe1d9f968c2eda5c08c325c324b15eb84c81503c56c31e54
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5ou:A3k03kB56rTN
TLSH
T1E4157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 939KB
SHA256 9c305ff924a40125500674508db909f2fd05b5bed752462a3b627dfc7cfa82ae
MD5 253b9c5bb44b038cb48ffdc2da53c7e2
SHA1 f63c96bcc851a5d7f84a59358b7e62897b1921ee
SHA512 e705a621390501ebb2ed3f9367b322cdf32257bccec178117b18bdbb0ef52827906df708c00a83e210b860671e23b60e2abe1d3f0e33a2b84de87e40a48a84ee
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r589:A3k03kB56rT4
TLSH
T1C8157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 939KB
SHA256 a3adb6661f2bb00fd6cb4bdbf55fdce190060b15ba65b81bdb0ab19764b19bde
MD5 966d1eeeb9c44c80444c8067c1d09e2f
SHA1 afd2dbea2606c0cd0382d4975f22ca37b2a5137d
SHA512 8aae52e3599cdc24448f4bbca3afdd9fa6aa65a9237f2bce0db4e448df74eff36945b650bf1e603857d010735ea7162e56c75697b0611073a3432599af27fb6b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5kc:A3k03kB56rT5
TLSH
T16D157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 939KB
SHA256 91f14c806d2d629cf4de65f1a4c80aa10ec94f7b92b3a1f95ddd7807767f4aff
MD5 e6049afa8d692f714cd7a197909c4255
SHA1 7289cb26212a79839823b7bd82c8c9fb1a6a9611
SHA512 68b1c1fd3b00bc917249069e2473f069547e1592aa7029ed4844540114139368a045015346f2a406d787fb4ddffb61e1acc13c18c8ffcdbba1a78dcecb00d20b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r59p:A3k03kB56rT3
TLSH
T1DA157B03E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 939KB
SHA256 c508a26a1ddf59712291a20f952d6d92561d58d92828c36be8650c0cdc3b662a
MD5 58ca299486dfa77f4bfc31b0f3ed34e7
SHA1 62f12a875499927b715ce17560095186498baafd
SHA512 e029f20bf94aedabf8d8794759706b1df9be57c6c9c71e09f88ef7e65154692efa3a7270adb24bed579d1116c7059020cb5b343e44cc00e1853fb7f3b88a18d2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5CN:A3k03kB56rTc
TLSH
T1B9157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 939KB
SHA256 6f9bcb709e687ddbcf3fbe2866919815520f45ee019f13d7fe4691178326cfd7
MD5 ffe9b71181dfbcb0fd3819757b745c26
SHA1 f755258687ba42a6ad97323c1f75788b7677fd27
SHA512 3ecbf33da8bac83b38cd3c9264ba33b06fede8834cffae0a670e64954839df2a569b3f9f560a8ae60a8b9e52e934a48a7c6dd177adcb611c718e53911fe0fb9e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5mF:A3k03kB56rTq
TLSH
T1DF157B03E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 939KB
SHA256 ebc6a97614bbf1306185b131c0888db5fb8877a6f38b16b63d35ad9196d594ab
MD5 e39a6b8d24d22167694196c3201ed2f0
SHA1 9ebaacefbd065630a9bd39179fb8f1e17fc93179
SHA512 5d2a9dbd6556bb3f92b48029be3379b3df921897ad17ee29abab205130f69ecbdd06427d454fc46dcc5112ed3e4e5dfb58e4408db91fb552a4fcb2dd62c792cb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5zC:A3k03kB56rT+
TLSH
T1BE157B03E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 939KB
SHA256 bafa28cad6a0ff154118d2dd3c1a4c31e140d785fd711b6259d49913244ddc6f
MD5 7eb5a6614a16ff70dd1769a9b1f3a381
SHA1 c6edcf3e6da43adac26367892fa7d5ce7420930c
SHA512 345706b53f81dde046d44062162b60fbbd18e2a545bf61acc4dfa0bebcb9e084b3c3eb10bc8b86a52249a8dd35dc6ecb320876d516a1615ec5ef2c02e4d35add
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r58w:A3k03kB56rTL
TLSH
T151157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 939KB
SHA256 bc6f5b60b14a3dab43303b1b80010090f9099727a3253edef6bf46303f44b3f6
MD5 66e9d857b17dbc5f37472a7f98ada592
SHA1 065bc6a1590b97c8903aec9e24d31cabd704b103
SHA512 7a0e74b1ab3e9f2b8fdb6b29f21fae0d597f676c7462d692c45b199b97c56ca1ec86b574b053f66a826460036f5a91dc6b7025b88ebe97444b18c607d5d8d7bd
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5zT:A3k03kB56rT3
TLSH
T10F157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 939KB
SHA256 7208253d973aabad95155f52d19483ac60aff252abb2eb461ccc67ed84e6b74a
MD5 b2fe0034836523841f198630dfe5bf83
SHA1 bacdbe7cd376052ae6667d16cf28750fc85ee149
SHA512 e611ad6eab194cfff47b83f7d35e889fe4d0ac0aa757d084b213ca6114c8022f62406cbf65757f7e51cffbc39fb298eaa97cc2bda996b328ae307cab526b4bd1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5Fu:A3k03kB56rT4
TLSH
T1D1157B03E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 939KB
SHA256 d140ecf4de49447f4c3b65eeeaedbe87711499cfd375ce0bd234c3756639726a
MD5 9a5d00b407d68c591678e0a683a8aac5
SHA1 6a52a830296ea6a9294131aef2f96046e2b3c78e
SHA512 8192a5eaaa97c4c356ebcaa70f1339a46031b6ce39e53ce4a7f6fce3623f9860bc1376122144db0cfc48867b260a48a05037863f71316ca79657f9e6f84edc75
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5Nb:A3k03kB56rTh
TLSH
T15A157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 939KB
SHA256 515f7e8c103c5f943122db01e3615933b2ad0a795ae49f9266f7355d209eb63a
MD5 c1dad4912c0f4da0a45af24cbcc6878e
SHA1 c0b4cf96c5659a713ab4c90ece7e6215eb1be1b4
SHA512 df7a761e08ffb6b2845e7a45d902d74814b99dca88e27baa7d5535507c013c8785c51001ddfcceba7c945e030853c805e1a3357a3516382a4ce64481e05522e6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r59f:A3k03kB56rTh
TLSH
T1A0157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 939KB
SHA256 ed64b1b3f2fe96eae05b663e95dc4fd183de544dc86b69d58b265d1089c42ed7
MD5 5db01bfccc5ef4f152dab48d7faa07c0
SHA1 4f0fc30a7e888651e5b6492de5b5bb6e13c9a1e8
SHA512 354d1acab43c29f92817c76617461e7555ef89e5c3fbfe984410a9d994da706c0bf38b491eb7d6f2c51cd4272bc1fc3baee2e9817dcdeaeebde7b27b03be2aa5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5mK:A3k03kB56rT5
TLSH
T1AC157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 939KB
SHA256 13bc1ab83b04b42c77f71a4f7fe1d5193f12e05c053984a9e7fc96558bd3610d
MD5 fc5880da8d7c6aade486641dfbdb26c9
SHA1 99383c3d87aa934fcde4da17060692128ede0589
SHA512 5068f1f34d77548239b89e80fb16980bf62b55f63b79f2abacc0522e64f8ed2fc21146b61fe7e79afc3db9d97114de920ab7a396e7de482ccee5adb8fa154b7b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5Tk:A3k03kB56rTw
TLSH
T159157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 939KB
SHA256 8080abe6b7f0a95630c27e8a69985fcc4e52be837c37501dadad24aa441fd3da
MD5 9a21486c5514491305b0dd3591ed0846
SHA1 057eeface508494b917dc45dae5954dc4212ac99
SHA512 76477db2221cc42b251de0883dc2fa573c4bec00f7a774d4a258ce19499c2347b0935949fd8039bf545afb0821c1206c4be9934cf2bfd75c468b8e15e46bcfb0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5k0:A3k03kB56rTZ
TLSH
T1A3157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 939KB
SHA256 0a48905c49029df46401ecdf564a19767f95291086860af132d85a37567372eb
MD5 374c60cf2ee2cc9a4d55f3f5a480050d
SHA1 3e775c565185641033d068a8fc3cd135f608f800
SHA512 a905ece9da7d80d342dd0322eebb53fe44524d72f767849c9a41957ce4ef99398090205af0dc3d32ead859a97f24c05354389989d03da392621384d536c8555a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5fg:A3k03kB56rTI
TLSH
T1CC157B13E6840FA4D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 939KB
SHA256 960db88aebf2b3e8775c8b8430a0771f857b2e6f06d805c1372d961c357b328a
MD5 465b2ceb9ce2948c94a7372e8b9cd7b3
SHA1 b2130eb237aded5f88d6c6f581c26b95d393070d
SHA512 2abbcd3a224775c1987a45d37c858613f8ef4f46c78ea61c59bf7973e9b582829fa08ffb0d68db007c36b7f9b721b14b583d6b705b493bfd3a070a8ba7fba6a4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5yr:A3k03kB56rTy
TLSH
T138157B03E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 939KB
SHA256 262860106785196e18536c12b3a33bb75d31d3a95be35342f22abe60ab2ffb42
MD5 de369ab73bd9515c7069057159f0ba93
SHA1 d698e12b084745e9f9cd178e990a794acf5f098c
SHA512 2e77c32ca1799cf6066f403c91c71e492d8595d53713ea371fb4f8a9342ac9596364d9365fab7c3c03fa16b3c1f4ddea071cfa16bcca55eb2ed28515b26575ce
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5Qn:A3k03kB56rTk
TLSH
T12F157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 939KB
SHA256 4a6b20160e0e2a716d0ab623e9018389d7a1b7041e2aec610c2416515c59b191
MD5 70ea8d9e30f9bff8ee23bc6d0ab2b439
SHA1 a02e1673a91948746b9fa4c99a5ac0d5d5d1f5f3
SHA512 0748676a1f392b7313e7bd723561efa5f2285606d977352803a7f3da5f6c556dd1c24fb43ff70e271b88b30365f018f927189ff2dae6355c2589b1c5a7e8c3a5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5ux:A3k03kB56rTC
TLSH
T14D157B03E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 939KB
SHA256 8022e1f65a941fcb2f64d835d5c1dd016b86443806f3b46bf36ddaf412ad1f63
MD5 1c6859dca29320eb7dd0a42131175468
SHA1 fb7b20714ecdfec9522c97b3b5dcf2eb4fd6cf56
SHA512 62743676371e1d5548b29be9802bb5f67f4fd43ce793496a16f0541c393bcc6d394595686a2db176b5097a46bdc0ad553f7bc749a7061bfeb82898a14b6e198e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5IA:A3k03kB56rTh
TLSH
T126157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 939KB
SHA256 a660580ba15d9bef1c8b1903f9af61a7344fb77d9f164931362a022e9d5fb4bc
MD5 217bbc86afc22b08f4e84c42d1f071e3
SHA1 152c02d6c54bf025751f427992797461d4e49767
SHA512 beefa9603f2f8a5f713d0c69c1e0130ecbba3bccc3fabb46edfae79f3e6763d9c9bb3de3332c93caac94f30554dc51e86f2198766a716c5b3a1a9249c2736c16
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5h9Q:A3k03kB56rTY
TLSH
T15F157B03E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 939KB
SHA256 1e26c41690157f4ddcfe01ab4cc346a1f372d53f107b952165ee4c257aa854bb
MD5 60fddad27374f686dcef12f4a1694bc7
SHA1 377d2b0c409c8cdcdab5b2c3d02bc7a4dc8cb64c
SHA512 213ad6309225ea1fbaf37c24c8dee5a9c458ab6513082063ce694f3ea46f1be1127053c514e5f0a3d774b811b2b95cc303ca208d4a4e71b51ce415b9375e2ad7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5U4:A3k03kB56rTj
TLSH
T1F0157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 939KB
SHA256 8858cd130b5063ccdec6c991f00fd64ad0acddcaaa366325b0dac2b1949c2c47
MD5 67a956e3eed429b102de91e332c8894f
SHA1 6c9992b12f910404945f340256ee47f343a1a069
SHA512 16a081ede3a0db35d3b1220abf421097ea3858299f53fb5b7f76d0bd7de3d95051a7f4371cb7f9d4ee8c0cb5488e8c68ea6bd6f249bc0d96ddc8e1449b49bb90
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5/u:A3k03kB56rTG
TLSH
T145157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 939KB
SHA256 a92fbf4cccf9bcdd9cb9c158634dfc8b992c6efe3b3ec4eb0e4ab42ce2db1b55
MD5 041d8697cb901ad462722b21d57f5eb7
SHA1 7f5ed6bc5e2d9a029d488a87aae3e6f8c56d7b0f
SHA512 c691fef46e59867d9bcb02e555cf05f5f6d8d2852135d6d0b0ad9e1b19030b782029c825d04766a9993636c9ff7f20144e95ea53ada46aec822d6f240287fbe4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5aj:A3k03kB56rT4
TLSH
T15B157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 939KB
SHA256 d7d78e128c214d0315855915c286d51bc80f9c4f469be4d3598fbe7f9a783775
MD5 abe610b4fd06fb92ac1010297eae96af
SHA1 0421068a2323b4cec2d262b2f1d38e9ed1f724d0
SHA512 2f02e481153198f3bffafb08f118a28115e26a85e882e5e0529c34aa1aa5276db276a85410b5906b1e636139a4c9f074804ce0f0774fb0aa2475959eafa24791
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5Hg:A3k03kB56rTA
TLSH
T13E157B03E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 939KB
SHA256 d26375a9602c856898e9ba77040c427b678b1385a6531a128b9b71e37c4a0b9a
MD5 eb62b25380ab559b885eb4cbd156cb1d
SHA1 1601a4b8e236f387e28049392659314133373c02
SHA512 f2534753a335176fd465048775d46d89a389e7db87177f77e2fc7be26ee88a943e9f7a39995afd33c13fc2b531aa1d806ff7b0b2278e7f606522cd6684292c24
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5aI:A3k03kB56rTB
TLSH
T1D4157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 939KB
SHA256 80c5eff7663c7470e340add432b820f4076a450aef54b628ba3f5646503ab5e0
MD5 6166c5c78ed3a809c8b49d6e4715d1bc
SHA1 0c1a0e18dba587c1936c64a33970f3b09b864807
SHA512 89e5abd8401501abebe1c5bcb9416f9c8df774a91c21440123daf89a1ba0c192c44adb3f2d1dc9b3a037c918f838eb056488c8d28bdfaaa621f8a903ca4c2f4d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5Yo:A3k03kB56rTf
TLSH
T178157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 939KB
SHA256 853caca6e1fc5a7e0e2aac40b2b03bd33aa490ebb4b6ede3efd197cadd08e963
MD5 a6e6124ebde92ac4f25104da0e30e862
SHA1 b97faddc2149e1e15eb58f13271b884a41b9e39c
SHA512 960b6769e5171d835afc24d0bb3ab634e24396ff5d65d1d495a94ab03743c7db6b85fb891640faad68b581ca5878ffde556701145e7a8b8c66fa0aba0e3312ad
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5r+:A3k03kB56rTq
TLSH
T15D157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 939KB
SHA256 b64afe62a818f1e6db8e6f3eaff33a351a73b38cce5352d0de729da6ec8c95bd
MD5 a88ce084bd12add7c475cf7bfb57a5f3
SHA1 ba6ccef1c4d042125dbf9eb51f7e9a5edb6642f3
SHA512 5b041ce823cad1616438340bc95bef45a2512ea2518f2cd41be66041f33e78ded5cbcd506e6d2d51fb1cf7f72b97dbcf1808abbd27b049ffb45cb0b13889d771
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5hQ:A3k03kB56rTu
TLSH
T15A157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 939KB
SHA256 a8e49582603821efbc869a601bcc54437b970ab72b3bd539986ccac7327cc609
MD5 15d954b369fc04764774c1cc1513ea08
SHA1 41e79e185c45729ad444f48dda82c56e30fb4852
SHA512 2f7b02fd99e4ddb55fbe5544d89035468ded68e56d6b6a98b3a964cb7ba2cd13002762bfeee9ca1009b28defc1291bdd5f7bf8d81a9a222642f0a6b6bafedb12
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5mX:A3k03kB56rTu
TLSH
T1C8157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 939KB
SHA256 b3651a4905defeba949460f351ff427075ee4ebc9e3d4243f9600a648a209986
MD5 56fd19344e3fb2558961f0b0228dfa4e
SHA1 47702eaab5a310dc576acc3e81623c63cf8e0c0c
SHA512 f40fed44c40bec3a5e5d1dddd6d465e5c288ec28a1fe0c775afeaad84df8e35885044baaefbb64b62a9a31b1b903e0a2d282be87e36a62a17c4282374fd86295
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5gL:A3k03kB56rTA
TLSH
T1B7157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 939KB
SHA256 ec5ab8b78b0bd208553cfde6bd874da3705a77b02e153e206c7cc57e9448d9f2
MD5 8f4cbd57bc9a7f367fd9c6f02050beff
SHA1 2aa1d34f732ee5f489ca196363704e574a26c504
SHA512 da5dc9edb967a665ff3a187da8d55f005df8716ba7a70324ae3de608b68fbc8c7ef24c1b5688ce585064876f968ddb2fdab17703d5b0f3834feba3a0b51bb717
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5MM:A3k03kB56rTR
TLSH
T181157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 939KB
SHA256 f847e09c557bface0c5e56435b242cdcf5f4e5784cf3e2dd51bc8c02cb25c47b
MD5 25ca2f02a1d3bc8c8815c91e7623a781
SHA1 cf6235a502b3e9a47172d816523cb22b8d19bba5
SHA512 c8b6361412b19aea6791f639b04d74e72ae66b3ebd709a4ed67c5445f49c6b33af4b2894835415c370cf0f3db0865331d8e252537673c7c80335d0a184209197
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXA2r5Vh:A3k03kB56rTj
TLSH
T1FA157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1480-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2496-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2496-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads