469aecdcf01289d24b6179fba343796311d5012748ec57d931cf300a4af6f4ab

Analysis

max time kernel
97s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260808-d4vpvshj21
SHA256 469aecdcf01289d24b6179fba343796311d5012748ec57d931cf300a4af6f4ab
MD5 566594c86078e0a4d135c446389a7400
SHA1 db47636b086ccc21d4bb80230b1d127b9949c4f7
SHA512 e4a9caa923198892d2e51bc1f2999f66b0ab590c6bb95624e395b8181839a9bdfbd3de59fb678d749330a200f332da2954b5e5518ff9b64db633a72ec3bf9fb1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7N:A3k03kHRJs
TLSH
T1F425AF13EB9500E9D10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 39 IoCs

resource	yara_rule
behavioral2/memory/4556-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c56f-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b2cd-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4556-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5236-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-255.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-335.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-474.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-499.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-602.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-718.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-855.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-887.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-926.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-988.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1129.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1149.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1175.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1267.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1353.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 36 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c56f-5.dat	aspack_v212_v242
behavioral2/files/0x000400000001b2cd-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-41.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-255.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-335.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-474.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-499.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-602.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-718.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-855.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-887.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-894.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-926.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-988.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1080.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1129.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1149.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1175.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1182.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1267.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1353.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5236	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4556	2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5236	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_566594c86078e0a4d135c446389a7400_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4556

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 469aecdcf01289d24b6179fba343796311d5012748ec57d931cf300a4af6f4ab
MD5 566594c86078e0a4d135c446389a7400
SHA1 db47636b086ccc21d4bb80230b1d127b9949c4f7
SHA512 e4a9caa923198892d2e51bc1f2999f66b0ab590c6bb95624e395b8181839a9bdfbd3de59fb678d749330a200f332da2954b5e5518ff9b64db633a72ec3bf9fb1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7N:A3k03kHRJs
TLSH
T1F425AF13EB9500E9D10AC1749AE65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 11ff58deae90df06c1f27565d6fd82112faf7ce2fecb5ad60c873272de7bc17c
MD5 3f40e69bf96be82901e90360c4593e11
SHA1 55a831b08974c3d983eaed7167b65ab4de951377
SHA512 00644958fec9b4c44db5c9a5499ac83441300e24bdebfcfdaf5287e14668b3e5c9607bf169b0da7a8755e06aa7e0bf9ea8e889bb86a5e5615e5b5e823adb80df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7Z0Le5ji0hmxNrM:A3k03kHRJ0Pji0Aj
TLSH
T1F2658D17F6A402B5D067C1B8C5D69A6AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 180e6a690b4f8b3d1d1c8efb336d93dc10f51ee6c836cdb9672aaa21aecb1cf6
MD5 c8a089b539a0b3c7c0443de2bca5b436
SHA1 15dad224344c9515ee8ab0c9ed705e129ec58468
SHA512 745adad271abc66eacf388149a94151ef382e4da469ebe25bd9e42936dfc7f994db93cb349d577ded1da9d6fd7832b9f61f1fd75f39ca9819bd2a9e8ab5c42e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7La:A3k03kHRJ
TLSH
T17B25AF13EB9500E5D10AC174AAE65A23EB757C56176093DF2368C6152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 fc567747c822565938d95b93281f941ccf7236c3bb3dd1113a1e85637d95615b
MD5 f8e180997ec89c05717721ee01e9b4e0
SHA1 7a39300ea5a3442af56712fba4f5d6c166644957
SHA512 6f9b64bbf51677c0aefb1d6627eb96bf8539bf165da0aea8f102131abb1791269b18f6eb9856fcaa233104efe812a93cef2945661611890ca3c049c3ad298e21
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7K6:A3k03kHRJi
TLSH
T12D25AF13EB9504E9D10AC174AAE55A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 4c2a018021ac0753aef90a7ab4ac286dbbab96e5e34bfdd971ab6be518ebe447
MD5 f9300ae209aff3d3477f6edc01365fe4
SHA1 532f7760d2cd6d247cd6c0411706a81159f40b49
SHA512 8b435c3a5cff4a5b78c6664e1ac85f1474f203e370a21545a68443fefee9f1530e881a2c7fc4442c04a5c16acf3835675dda2acd0018bfd8beb331336ce3e401
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7a9:A3k03kHRJl
TLSH
T1C325AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 978511707b568e9e7f3312850fb455038a7ea1179c585904e23863653178ec54
MD5 8a2db91b4823bd47a05dcfb92703ac48
SHA1 a0f2b413853c7d62d19b24b94f0bc971a83db8c8
SHA512 f9d95489d966167429fb98e32c81abb9d889e0eb1894fe95f06319a3c2c4b1baea2d49bd12fbc3eda96ff6ea97ffc5a24fc6cfebb52367beb3b2f3648cac073a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7ac:A3k03kHRJg
TLSH
T14125AF13EB9504E9D10AC174AAE54A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 95bdccdac2c28ba0fae2f1fe01b3ee129d6f6dfabba351ba8485e2b48182a3ee
MD5 9cb2dc2a6c33d49263724e5a8b823a52
SHA1 58c4dc1e065d202874ed1f0fcc8c1939b607f6ce
SHA512 35846899c447046902718ee67e1b3734eefacecebbc7f87bfb95e87db988b51508b79ffbf1ef2deee9bf0021632522caa7d0e1908ff2e07eae9773c35e61b9ff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7Tp:A3k03kHRJ2
TLSH
T11425AF13EB9504E9D10AC174AAD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 cebe202401bbd29e20b7d737388bbe13977ec3d0b8c33443be9e30f463d75dcf
MD5 8c97dfed634530edbed3e095e77f831f
SHA1 094ac507d69745eb593160fbeb759ad409595c24
SHA512 80f71a82b59915442b486863f5d87bc2c56420b26fa399f8ee1d49f8c12080fa1ecfde1d5a483b7a20cd558c09887e5d26f265f54559d4367c35fe95f7f291d7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A70N:A3k03kHRJ5
TLSH
T16825AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 e54462fe9de1d8bad0aa047ca78cf4b180a5c8b58fa10b94aa4728c92da5a139
MD5 782283d2b3ee8ed35ef93b15b8214f3e
SHA1 5a0a722b1f8f6f0e188d4cd8f9035dc83a9f76a0
SHA512 f01883c3c5c407e828ff94145a75bd2a5122348870dde2775b0be203d4f7bd2bbcaf8e9f1b5831280f6bd29603611252b4fbba6b626d5015720bab65b6cf9911
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7cF:A3k03kHRJr
TLSH
T14C25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 2f5e83a6eb494ba655e964fe5975411010a89f3f868493a6666142b3656a5109
MD5 c151dc6966f17c6422182116d224e216
SHA1 42f57ad4e9c6ce0080b76a644fb1bafe828aef80
SHA512 d5782573747bb921393df33b84409b5100782d01d2b7294a0699942b4231f985fcb469550f0ebcd7074ae844b9ebf9c0055a35c68ccbff95ff30519ad14331af
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7JC:A3k03kHRJH
TLSH
T1F825AF13EB9504E9D10AC174AAD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 7dd0cd13bbc38a734c26d334dd5ce2d29ac01c5605e317ce2fa6257520d234a7
MD5 cdaf30f97737617ed3f77755d9a8c2e6
SHA1 4f81400b8004902f90338e033b76c8ab993e3519
SHA512 93f65298098bfbc7534796f46723cd52ebc04393207c19810a7cc5f32abf4e2620274fea0001bd5cd87ad5fb7f67032d50fe40b55dee251de4e8ebab3f12ba12
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7qw:A3k03kHRJi
TLSH
T15925AF13EB9504E9D10AC174AAD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 ad06a2d7ead8f030b550df907d2878812c11d1e58e366e02d58e9306efdd2917
MD5 fd7eda1de42cbcf990770b3afe5b070c
SHA1 b33446367d7cf45bda0f8aff3322fc18d1fd0abe
SHA512 a1475d33e8a565916a443ab3f58ebe47b2099ca4687af4b0debec5ed5d9c2ce61fc35163928e508fa6782939b02df5e368d23ca3bb37869fe09d4d45fc2ae485
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7xT:A3k03kHRJS
TLSH
T1AE25AF13EB9504E9D10AC174AAE54A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 17fc7ae9100bb4f5fd2e0118814bb18fdef65383d028f4faac412fc77afd8dfc
MD5 d3d13429f64a237753563d9b9396818f
SHA1 01cf4a5ea7b377390b6eab4de2ed8cdec62d4c87
SHA512 45f60c15ced024d7307675298fd969484900d1ff0e1f6aec7d83e24f3bb25e8141f3be98ea0b62897dd48fb48627983f763b97a34939ea6216e1bb069e9a2668
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7fu:A3k03kHRJd
TLSH
T1A125AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 f0f28fe0ec1e04750be42a7a18314476e31c0bce31e4b537bb667d007a559c2b
MD5 cca0565c702f6db6a7cea2c2819f4d71
SHA1 1f26cf292691ffb806d94169f3f678147aaea237
SHA512 190bf386c36e3347af1c8e826cd8910887d11656989b347fa043a9e557bc3332d361f5af346df10d260341a537c16dddc7d4c2fcae8798a40e4943897100edf4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7Db:A3k03kHRJs
TLSH
T11B25AF13EB9504E9D10AC174AAE55A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 4283572bbedea5e87a6f45157e9ef7e0ff740f1332a56154d588c97a538891ff
MD5 e210785a90dd50ea7e57cf94b0b4e94c
SHA1 19a820a66e814bf3e72876e77c5d9a9e28835717
SHA512 151c7d91d7e4bee0e28b3cba10170b2e03f93823becebec821bb29c4c9355439bf830adc670fba9fcf921ad2c0350503711557d9cbd4e70d8f214d252d73459c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7Xf:A3k03kHRJs
TLSH
T13E25AF13EB9504E9D10AC174AAD55A23EB75BC56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 be300b8fafc1bb9f1eaae80e94a55b01fdd5f4639949d14d803f8399cdc3af6b
MD5 122fcfc4f588af0a7d6e92c42ff73eb5
SHA1 e00c36633e03bcc01fa31264951cf7decca1bb8d
SHA512 1683527b3a2456387583298932d51d5d97618a8c3fddf93e25223488729b2ed5fc7ebcd75737f35da7b11b7a416835ea61ddc73030f2dfe04efdf861b5d2e3fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7gK:A3k03kHRJc
TLSH
T14925AF13EB9504E9D10AC174AAE55A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 44d6d088720f92c2e39296a15f5bef676eac3773803c5aa49fb7ad15ff3a3319
MD5 d6571ecaa8bdb63da3a145157c5aa8b9
SHA1 a4cec544ac4a16a23950b872093fc0e958f22a14
SHA512 bbfd544534d4657f54e4747fffa2f55b1489c750ebf771ef5b787c508630ef195b556fc8b59dfc4768f639d7d3fa3155c2dee3f20db7b534d7bc7d941e7a993e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7dk:A3k03kHRJl
TLSH
T17525AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 e5f648993ab62aed50af0032e0f3999b2c52649c1ef9a096804860327108ddbb
MD5 504db4ac8664467197097951db2479da
SHA1 2ebab891bb32734b66812ab3b1abc092ab20e324
SHA512 f70b3fd89d57c70f2b2f7b1a63896873bd0be24d0f9d9ebb354f0572cf68e07ab492150f47b9f01e1f592e793bc09eae9f05eeb30f5dc32e594c07e63d382f77
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7C0:A3k03kHRJY
TLSH
T13625AF13EB9504E9D10AC174AAE55A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 fcf9109217295bf69d896e6e428dbf79bd25e9515b944d16a0e46f0f0570a7cc
MD5 c366bddb6bfa29a28157e9d0d4b54c18
SHA1 9bf86fcbdada15271f9de22ad8084d896d104ad1
SHA512 d9cfe7255cb9dbd62b24bf858a5b1983b933c0deee652142b963fc3105f6721bb29b41270d44b40358e21cac077de7dd8fb0c4f971fc48134bfdd731610406c6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7Rg:A3k03kHRJ9
TLSH
T1DC25AF13EB9504E9D10AC174AAE54A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 f8fc6b8017048856b5d5cfe187fdccc6d0de13096923f0a0213d2b8f9369427e
MD5 acb96f5790ffb05b4da701a1905b807f
SHA1 2d5a3d9bb33714b75a5024f6dc58a31370c4806f
SHA512 bf36701595a25739fb07ede9ccd0b7f56feaf02de0b26b85fc56d09305d175f8119fda0088f5aea5ce1d5f40c2416372c44ad00389a30c6c5217caaa4e41eba6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A74r:A3k03kHRJ/
TLSH
T1E225AF13EB9504E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 473c86aa37bd58acc288fda8e20488c28d015db148f1a31ef262e1b11d65b32a
MD5 c98428a2fe330f5cba519ac6f2fd7ff6
SHA1 cfba89651a0932bbd199b46693a7e706e3d9f021
SHA512 7387a72316d1da1075888cddc562cd8aa351e9d1daede45db501a9b730b136504e334ef1b281d84018629f79c45df0c1c747413551220b94f250ba9651b86d3d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7Wn:A3k03kHRJ5
TLSH
T1BE25AF13EB9504E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 4e303ab4abc384dbaba25ae6330a79439aea04be3e562d685fc92f7996184289
MD5 af6fb77e0fb26d04281df6e9a0ea5995
SHA1 4d31c77a8325395680d5a971ec52bb8b5e1bc91b
SHA512 e7b88b41feb542dfee47d00e070afe7bb74a91882fa1119164a670509bee6db2f278d13aac4057e1bfa8d23cdcbc1b6beed4b9b1b61e4b4a9e7526a86b979400
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A78x:A3k03kHRJX
TLSH
T1F425AF13EB9504E9D10AC174AAD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 ce6d8570c30269d0c062b8dd25712fd9fd853060f1519eecb7002801112798fc
MD5 98497c61414c449e61be22eecbbcd73f
SHA1 6a0f547f06162525eb7353f12d3af9e6c6cb4396
SHA512 ec5dd4554b88842ade8736cfeb30d3340dd271d26dc0d05ed8f4923f37b56299804430d926c22afca177abadb5926d3811dcef478df1f471a73116713a5f101f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A72A:A3k03kHRJY
TLSH
T17E25AF13EB9504E9D10AC174AAE55A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 6721af340c6e9efc92c0354324472f9691a7145e698e17d770c99d10bbf09861
MD5 8a4146cc659319bb00c653df71305819
SHA1 bc0d39a5e9e32ab8e9707108cb2ff2752f7e1041
SHA512 6fbaef1930d5a8b22de9bc1d726cc40e5b668ded5c19980ec86336386d3d6e33e9317d809ad4a2e8dc676daf91116cccd81b6e4a4e257ffd2d844c61d17cfafa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7v9Q:A3k03kHRJB
TLSH
T1DD25AF13EB9504E9D10AC174AAD64A23EB757D56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 b973c9bc62187bc95a452d45e0dd1a617b4e22070177f193bf237dae5939b0ff
MD5 8fe8ffab6762c06824e2ec8e629dacde
SHA1 5cf442599aa475a47c1cb34dad57b031c0f588dd
SHA512 6b6e79c856514fef6767324574ad5d547738b182ed7765b029abadb8aa07c1b78ab5665c4e395df3f4dd2d13035aceafc055022d982c6e92bede7495fccf1e28
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7G4:A3k03kHRJm
TLSH
T17B25AF13EB9504E9D10AC174AAE55A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 6e8636a49859cd6647fbeafcf6c0038986052c3c5f87b0162ab8bdc1af745f26
MD5 4cd3a004b511e3870adf537de762c4e3
SHA1 30c0b736116e30313bcbfa722967a29c9d2e3edd
SHA512 35a1188da64ba1457632f71905bc6dcfc8eb4416518c936d3f936b5d06af076e90ac6572209d429ccf83fdc00c8deb4c7f5834ccaa2446e8e97ef2fb56cc3466
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7Vu:A3k03kHRJ3
TLSH
T1D125AF13EB9504E9D10AC174AAD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 8e0cd59bef46d33561b2422d33134a554b88805cf25649a6dda937edc7d61e4e
MD5 1bb83c17681fe540464e1969c88749dd
SHA1 052b3bd5506d890602b3dfb8b16ba8a1a07a5d0b
SHA512 84461c3d6168b3abea4dfc8d5cc05425738d3500cc001b96c849bfc1eab12f2da3e9f9a30fb8e49f36267dd76535f6ea4c227f2ef70e57f22bac241dc4ed8d82
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7Ij:A3k03kHRJ5
TLSH
T1F525AF13EB9504E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 7d8e3ebdc0880651bd652e9e06de09729629db5582bba5dee89615eae89ba758
MD5 3094a469efd31043842c95b4846d39c9
SHA1 5d3566c467ec8bdcf1507cc3a5e3be43ee7e30bb
SHA512 48854bc9a8305f424473467bc86642937064438f62bda04e821512a17c4b82233579bb937bce81e9a22c547925588229f7c6339388f094a06eca62d6b5e6717b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A75g:A3k03kHRJN
TLSH
T16625AF13EB9504E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 d4766b00ff125734f850f2f8a421205d2985fa6e2cf1f510159bdfbdba7d26bb
MD5 94998721b20cc18542c60b95d6854972
SHA1 cb445079d7d66cc5d50c1c4a73fb6f88489a6b06
SHA512 97f2ba8e304cbeeffe64671111a102456fe3543e3b388bdd37bf4845f6eab2089c39ae5e0228a49f61c4ce26f2965aec31861e03dc2bc25b85bc561ac05e7f5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7gI:A3k03kHRJE
TLSH
T15F25AF13EB9504E9E10AC174AAD55A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 7f6d9f0bcd37654dae8cf340de8509e49c127aa1d93d28e4788326f2d3356843
MD5 349251f1105e53faaf64e6986d623cba
SHA1 a658ce9b793ec35f30137d613976b8a159b961c2
SHA512 c7ed3fdb0d1c28d9993adc29ac4568fe836d9c7f11888f48c0edf22f519858fbb92b37316ee671d2581c6ca03f9d37105e4121b16dad4a3b228cd9847d568273
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7io:A3k03kHRJ2
TLSH
T1E025AF13EB9504E9D10AC174AAE55A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 352d1db4ba3a69148482c33a2bdb4d387ce26b1d923fa971850d11429f8c01ad
MD5 54f6bfdee93d19c0131ce148df96b927
SHA1 a66d26874e9994fab8703e9b3ba73c93d63b60d5
SHA512 6b6393c24eefa1576f593f92e68a3121e1d100d452a937f56c80cc61dad589bbd1202c850d3497be523edadc7032f509243bbcababba79330a2ac52ee7c12e93
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7Z+:A3k03kHRJj
TLSH
T1A125AF13EB9504E9D10AC174AAE54A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 047b65abd424b949fae096be8b32790aa376c66bb5e1477b51445dcee8eed427
MD5 8918280f8a23af96ed7517bbe2c6ab51
SHA1 7cdcf6bbb7af4fda5b4fe5a35c5180ee8bd66577
SHA512 89439f576c2c7c8001c4e3f27b3c66e153e69a986a401b84c9ae1952aa69b2bc715e19e59616e7b31218655948109138c4a127d55ee2bcb7365a4f18c0fb60e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7HQ:A3k03kHRJ3
TLSH
T16525AF13EB9504E9D10AC174AAE55A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 ce59b0f5aea485b0a226d6d73fc56d2b1fed8b989dae78a73ab968219cf4e78e
MD5 06071a09ec90c7df794d2809b3e4a2b4
SHA1 906bb03a9b72b36fc22457b312a655181cc1f557
SHA512 74c3bc4ae470fc3ec92117f4cd3971e26c0d5d93ec6c2fade5ca63b215045f18a9628a07f9556a5447158c18b78f08004976c89d848eccbe8ded9ab53bdeed54
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7cX:A3k03kHRJr
TLSH
T18325AF13EB9504E9E10AC174AAD55A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 2eb5dc0001ec3bfb1c4ea369a8fea453a4dbc05c78e00017ac8ed965344abc8a
MD5 43e6314d888fbdbd5c37e16736139435
SHA1 0b08b012a9ae5be4245cc45645ab1f6641f424f2
SHA512 8d16d4b6cb0bf791c11beead57250f8bdc1cdb66a06355652778a89ab8794a099099af7f9fce95fe0d7c54f6e23b4bc4160637e76cd0c371153248c6fbdb662c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7aL:A3k03kHRJl
TLSH
T17525AF13EB9504E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 8ad15bdfd461bb62bf6e5dd0d6694cc73526429c6a27ba8d23b22214598c6248
MD5 492c1de999f54598b2f9581d03b96445
SHA1 2b6f97ab418043df24a38bb1e8a8597e2d1130cb
SHA512 4a8c97d98b4eafb573bdefe62e596103d3e03c200b7fe96b1b29815f8a330af002e405c8b35c5b16ee568dff09e14a3acacf531e476c957c28fbdce4a5a3f2f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7+M:A3k03kHRJc
TLSH
T14A25AF13EB9504E9D10AC174AAE54A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 f4d919d7a4664b2b5ff49fbd35abeafebb9cf7f4ed75fd88b4a27d2b99ec51b2
MD5 c879b7d48ef690875c292124f6779a58
SHA1 80fa3d86825d5bfd29f7ef9fbf9a76ff9aabb69f
SHA512 099715a0231022cf2689d93113f693950ea57a8470d3778bc39f5aa54348524c548d612763fb768a6495a32c52792b461a7c99f54e7f6f57b4cda55c43f7a4fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2A7nh:A3k03kHRJW
TLSH
T17025AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4556-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4556-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5236-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads