316970e2402b4ec0a7e6f7fba8a9f609b484fb614190132f12c636cca77f26a4

Analysis

max time kernel
107s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 844KB
Sample260809-rta5csgm5v
SHA256 316970e2402b4ec0a7e6f7fba8a9f609b484fb614190132f12c636cca77f26a4
MD5 49ddb94fb0fbdb02b98102dc08a44382
SHA1 221cfcd7dffe6d02465ffc94ecd5891dbee0a40d
SHA512 14175fee41993745b190661e655d18b41ec86eedacd455a8d4d93d72c77050d3c63f9da4e96246ac50189f7aacf544a57f5a534189976b3fc084ce2fdbddb90c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgf:A3k03kB56rw
TLSH
T193056A13E6840FA4D10FC1749A968662EA737C125F2097DF1354AE253F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/5008-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c54e-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5008-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4364-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c8a-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-225.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-437.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-492.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-517.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-602.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-628.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-720.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-745.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-825.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-888.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-908.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-934.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-953.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-985.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1046.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1065.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1108.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1139.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1293.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1376.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1384.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c54e-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c8a-60.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-225.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-262.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-437.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-492.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-517.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-602.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-628.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-720.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-745.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-788.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-825.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-856.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-875.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-888.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-908.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-934.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-953.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-985.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1046.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1065.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1108.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1139.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1170.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1293.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1331.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1345.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1376.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1377.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1384.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4364	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\DlpUserAgent.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5008	2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4364	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_49ddb94fb0fbdb02b98102dc08a44382_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5008

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 844KB
SHA256 316970e2402b4ec0a7e6f7fba8a9f609b484fb614190132f12c636cca77f26a4
MD5 49ddb94fb0fbdb02b98102dc08a44382
SHA1 221cfcd7dffe6d02465ffc94ecd5891dbee0a40d
SHA512 14175fee41993745b190661e655d18b41ec86eedacd455a8d4d93d72c77050d3c63f9da4e96246ac50189f7aacf544a57f5a534189976b3fc084ce2fdbddb90c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgf:A3k03kB56rw
TLSH
T193056A13E6840FA4D10FC1749A968662EA737C125F2097DF1354AE253F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 82bdb885a199763d6bb9f822763ba4703bea81fa94e9b355415df034f923710b
MD5 c227e2b93c61a6fe9d613483b34768cb
SHA1 e0fe0a3a0fa56a06f8643b1a7b925b5f76dfa6a9
SHA512 f3333741a7f209ffe8c1a2ba87608159731f0834755107ca6e2ad38f2b18b1d0a0c62e55dcac1d917d726d07b059c9fb74122c4bac678c10d99066141e41811e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgL0Le5ji0hmxNrM:A3k03kB56rIPji0Aj
TLSH
T19A654A16F6A44B65D02BC078C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 859KB
SHA256 c493dbbb19487795638a11e850659c8fb5e47f5bbc8919a12d0ef57c5498f5c7
MD5 fa135231d8a6773ae5d48b546dc0782d
SHA1 41f5a9cc629d4a99f099f5f6c0c87ec59fe71cbb
SHA512 0268ca20f68ad2a9ba39f154dcfaab1982ffcb22a8991470665c25e0a2417abfa965110ecce70259abae6c697a2262c5eccc368713924c6a327bb86aa2f76648
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgNa:A3k03kB56r
TLSH
T174156A13E6840FA4D10FC1749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 892KB
SHA256 720c0ee28a167e11b4f4df6044840413c4a5ad139ca9165c30dc0e2d1f3bd26c
MD5 c343f8e722cdb17935a9d08bd65c86cc
SHA1 6e4087fe0033927168d0209d614f53afce5cf95a
SHA512 b2afa74fd0cf1bccf1d53333088f3cc8d0d52af6a20f0e1f9dfe4c53f5f0089b5979b3398d795c38cc1dd2305e5ea8cbedca17e9e67e6b20aafedeade69b3f9d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgub:A3k03kB56rRb
TLSH
T14F157B03E6840FA4D11F81749AA68672EA777C421F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 868KB
SHA256 f58e77d8ae29871dcbe362dafe724e8c5bd1ad6a8a5c6a542b6374ebb53f02ed
MD5 9812428c5d3cdfc82bb73dfb509d6799
SHA1 4e14b36f447be3742e0d03d26a94e06b9c2ec107
SHA512 629397e631afe4d8f89d9b9876f62aa69935bf4aac1bb4ca9f9f70b01775c0b079e1df8c17fa31484d2585019648239306a89de1361e4a2d9d6a07ce0a60a38a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgE6:A3k03kB56r2
TLSH
T1FE156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 868KB
SHA256 2ebbc3e4a4134d06e8cec164ef74544d44490c44056e144a52a7b3ddeb0c451a
MD5 57aacbda8d3589e4e4df15062caa3965
SHA1 4e0d7a5a522c3fce6036c7b1e89de0d8addcd125
SHA512 2df8ffe855582f41ebeed5f7350be2e269f190a1469904ca085d773ae880ddf40b41a2eb78c70c6104b66890ba9f9000ba0ef0d51c8f25ef9a3c46936910bd56
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEggN:A3k03kB56rH
TLSH
T180156A13E6840FA4D10FC1749A968662EA737C125F2097DF1358AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 868KB
SHA256 1e7fc7e07d73c07c3a58518627ab44c2972e8a1a4b9456f449be792679673b93
MD5 1fd673e4ff0a5916d861565f8a979445
SHA1 d9b05177842eded2aa009159ac5e3a0a45cc0e3b
SHA512 77ce1b9c8c7bc50399097d2f079d9813d869986222a81196b94ba284680d5f83d18bea6b27a8d9484ef03711399e0500acf4407a099f4598865f9ced07ac0394
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgOf:A3k03kB56rj
TLSH
T199156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 868KB
SHA256 481601d7d81a1e4bbfcdc94959543aa399f77949dd21087ab85cef487c80b8ba
MD5 6b19e4c2e24afe3a8185f2c594914ccd
SHA1 6a8509dc16c13083891294642cb23c417147933e
SHA512 c4587cf640e09af5eec9ad1ec02e114487f4a123f34312e6ff73d898cf149d06d152130869e9a06e15dbdf699b58d5585a4d188ee48a33cf46d8e46b2525d48c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEg4o:A3k03kB56rS
TLSH
T165156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 868KB
SHA256 02863c12bada4a07e23c0fd7e1dbe5bda2fb950f28a13e2beba9ce3b16ce0c6a
MD5 485774ac79127350d61e9ccd56a37f3e
SHA1 d07a01267ce2c6001fb04328310e70d196ad4ed6
SHA512 b05cb38a49cf6bc35dc9d1c386ef8d1152816a7c7c57b251088fa15729c70e3b953571dff84e692cc17ab2dc209d71d364822fa0fb13de8550b3e4427ef46c66
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgIu:A3k03kB56r8
TLSH
T1F2156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 868KB
SHA256 e39adfed7d5366c5ca4ed0159ec25ee5f96867756b421221f2538153d95b471d
MD5 b0405efc5e5be0a0a3be5d1e9bf8c913
SHA1 d1a08de7868703b8a0b3f37fea8076996b30937a
SHA512 a7a64cf3afdf1ed75e344f9ca27ec3e79ec9e2f1bf1f496bd72e6eae52b083e628a5e1292e074204b5ec237788415e7993c4fb8438351bdab946974fb972b4d3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgc9:A3k03kB56rh
TLSH
T19F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 868KB
SHA256 4736f6ed8ed3020221439cc431cfc7edc324e8f31323ff12a9595cd89d41e6b3
MD5 85d07e7459d48a9314817f1b7990f4d0
SHA1 ecf1c4f13dcea3f477cab0e5ca99554daefd1234
SHA512 8ce60d7fe4c5d07f54a8002d38b30733607a0486f794959a87b3f81ae0f4a5f01aeec7e93e4123804bc2672a75c4baef2be96600faacfe0e6887b9f2acb0fc63
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgEc:A3k03kB56r0
TLSH
T1B9156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 868KB
SHA256 4195c04d37a16ec755d1a85f6e420afc026d8ae6484d69128779c26a1eec904c
MD5 00d10d44a76893275a21e5ad84ba2513
SHA1 8dec3523dbd9dca127f8fb31f72039d9d74e6f25
SHA512 d4d4ebe42be4689543b3c409178ef475ec2e32fe2baa7a8aa5aa6fe9c85300fdc989c55d6eaac24ad6aab013a0d643a292fc14b5f9fe2a07c330dc67128fc5bb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgdp:A3k03kB56ri
TLSH
T1C1156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 868KB
SHA256 57d901db1ef4d3665ee0437361125849014e0e43147e6d00eca1e85e792e6fed
MD5 027a89233bcee9319c1f6087df87252d
SHA1 0d3603fed77f3ec180bbbe41eeb1f1d99b8334f4
SHA512 0445b96df8dbb562da031371a94591b555fe43e44f59efd6c544b410c94ffe00df2b201157d2fca45d97d15fb6195fdc014c95990c2a99cc5aa4f597bb39eca4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgiN:A3k03kB56rF
TLSH
T1D3156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 868KB
SHA256 afc8f0c9b0651d74e5fd91ca2ff4c492d3cefeb6f1d77cc22636062654572263
MD5 f83c2684c222b3efc92996a8d293f5c0
SHA1 85ae83ca081da2288a9b7361cc6b120a767bb346
SHA512 0095fb6d77e4f6a9ba562a25da98b53d045034c1878fee37e50453b111aca19d781c3d636ca7b95af3c10e8b76e4df0c8d45d89a81d8846fff391db009a5b789
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgGF:A3k03kB56rP
TLSH
T135156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 868KB
SHA256 5fbc53ba1152a9ec2d2f0a81ee27bad94ad74234fec517259e566e055e00696d
MD5 9c403e25697e94e515af970069962383
SHA1 6d7ad31765b67f76f8ed40bb06790b6ec833c222
SHA512 e9cd88fe9ba9084affe89fe82cc4d0ab3b9d4e8b131c74042b71ebed10931ae2ed08e9495db5c197f8c2052da744f658253aa548abf0166c145b5a60aaa2df4c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgTC:A3k03kB56rD
TLSH
T150156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 868KB
SHA256 88750c394c68e36b189719063b2fd33f4cdb77aba7cdb4eea59ffac746fdaa61
MD5 be319d4edc38676b73b0ab8ee411adef
SHA1 5c77b387ec3e1c33ad17902ef823f989718671d3
SHA512 778a2089b8435757ecaf61ed9b7384cd963132d5bfc04a4278ba2e390fba27086a3579f28bc1f9460602d01a2aaf2ba239ed90a7ea6acf42d94dc74b0d34cc14
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgcw:A3k03kB56rG
TLSH
T1F2156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 868KB
SHA256 0696fb2a92890db89cceefd7b2053d0a8fcf05371ccb0646580a82e1ca316e1d
MD5 89c11aac42591fcd96d375acc61c438c
SHA1 b5260475e1d9b6ae590df07dd210a0b44057c728
SHA512 69e94c13632d71283c473ebd4fa2685c8d2dab6a22addf066f96ac44cb55278b307d78420bbed0a11eb7db5442757d81f817292f67e4bc9a28f58618dc7810b6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgTT:A3k03kB56rG
TLSH
T124156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 868KB
SHA256 d9d05395caf396b20ce9e365d1d4fb1e0a9677d1136742dfc50cb6c81cd98fff
MD5 b857a35894cea2c6bf370f7f3f1cc47a
SHA1 63a19aa6560bfe35a3fbacafa63116fc91161bf1
SHA512 d15f1e9d696e3bf447098e95de2c56ef83e445f7e5bc0f443f266c001deb944ca9241f9d8b7ec07a76629d0a86caceb4481f29f287ef957c642b1072a0b75fc4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEglu:A3k03kB56rh
TLSH
T1C8156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 868KB
SHA256 d7d4b5773bebeb4f969e28a40746961d2acebee988b02e8890ece556144f899c
MD5 972c012895df0281aca3554f8f88ffe5
SHA1 6cf7dd348c1e513f6d5adcac625db13b27bb66fa
SHA512 bbb549331412f0dafbe187c4572fb766a9c383e99c8d08b42a45075cd87b17c467d654e167e876b167c90abe87e52327004589b4aa0edce10e2271c352ebcda8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgtb:A3k03kB56rA
TLSH
T173156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 868KB
SHA256 baa21602392f5673def72b7fa49706c16e50b957f76df5af1ba0f93f41949638
MD5 769a531d60aa5595bcf81ff448314a27
SHA1 60daf02873ed0ea1f722d1f474992a815a896b57
SHA512 f6bfcfde32f7222939da4301ac65f3760b94b7e777516a08b1993d9dd96ef4637ad7f084b58d48a2ab41fa6015d40cca3eb47240028cb98456bcd6179a4c6ded
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgdf:A3k03kB56rw
TLSH
T100156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 868KB
SHA256 b16ee48d1431a8d0b9f5772ff7181b6b3c48ff7ac5bb5ab80b5c2681e472d7a6
MD5 7e6d0d0fd263f86c9f42b248f4ce90bf
SHA1 a1174636e2fa456821e1177329d990b6a5ccd23f
SHA512 d0536b01643aa541632b1541b83a95cadfa9f6812476443690a963c19a235c194c6e133f8ec97659b01d9ad15898409041d64fd789bd37591923139cf714f91e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgGK:A3k03kB56rQ
TLSH
T1F6156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 868KB
SHA256 33f0c715b2041b02ba3514dd4ca20c12e34ebfb4ec9a5a9c355ea9d3bcd139d0
MD5 a2615dee1752f16abc8f1b0bad7924dd
SHA1 ed8e95334b43f912873172df6aa58b4da4a82392
SHA512 f18f0650b2d699bac83776cec0194be3c0e6ebb01047e030c4f4852a770874bf2b66a66b2f7847a4c26d91bd49e3dc98ce44784233f305f09e688ed6d27495ce
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgzk:A3k03kB56r5
TLSH
T12C156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 868KB
SHA256 b49af81f172300739f4816aaccf56838bf217e4c952864535b13b595a5ec210e
MD5 52cc0ccf468c55e3033d27b8dd7a0ac9
SHA1 03f542212da4ab2ac21bc745ab3464c646e65e58
SHA512 cd6ec70a06ee1dbbea7e176c402ed41dc799fe6de4f01b002290873096e642388efde1c0956dca10f59c2384e14b4c120d26ebc46041e2a91ee2f651dde3974e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgE0:A3k03kB56rM
TLSH
T1A8156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 868KB
SHA256 79a5994dbde2e375e118f93fc1d935c8dde1c8ade0f9f283a658be53fe6c7a95
MD5 11b3fe33ea66231debdbaf605297571d
SHA1 e78a89607041b3ff052f56d7d3d238ec239fb2fd
SHA512 4683d078a41253495e66f350baa84bc07e2078e44ec3ed4763596554d96938631d437eea06fe5dcf323edd1c0b20f7bc90ea913c5b98161184516a802224f5b6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEg/g:A3k03kB56rx
TLSH
T100156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 868KB
SHA256 64f5d5da35a64245cfad8c9d374f01e662f9caa02144a3f64f0a33fd698ceb00
MD5 29ef1ea90462bae3cf270956725f6b37
SHA1 248cb8a89eddd499a10216eb6deee653de60526c
SHA512 b86d8c0b2c5d88dbdee0aae732be1cadd50f4136e2f2a66a2bb5a8b4a4675bc3dafd4d27f5e160bf2426ec387e044f43de5bb6c69123b069a5b30adb732f43ec
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgSr:A3k03kB56rb
TLSH
T18B156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 868KB
SHA256 a32321697870ad4aa4f0b3a59b53adba3d19903dfd6a737f11e05f9549daa92c
MD5 4f56e2f4b6087fae8e93df77f9e9598b
SHA1 7df9c136cb04b0e392eaf4a77bf35ad124ff4700
SHA512 20130c10fab54715bf3be5f9b634fbbf820b4f3b7415eb7754b0754183a5af1bf93f13593b7c233cff8c6adee743a15e8d048addb96c026e15b8a88f8f18f79c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgwn:A3k03kB56rt
TLSH
T162156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 868KB
SHA256 da8ea2e7eabdc3356ee55ae4b84150136308813dbe013caa4b48bafd343290d2
MD5 d1377a6754f640647fd02bb2389a0866
SHA1 916a007f49d4cdd5981a67bf36d267a711d2fd81
SHA512 1f3a35783ebf5c98d2177dccf40aef0af43f1c14b0bf0717114ddd3a1ba207c671129e45072d244b4f30a2d627fa434fe3761ffacd7c01afefe7531f572d0186
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgOx:A3k03kB56rT
TLSH
T1AC156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 868KB
SHA256 2766bc173160ba35ac57eeecd129e5d4042da0959b8ff2682414153cdba91a91
MD5 3eb9ea2f7216e54d7319e8701a9e3671
SHA1 e95e6632236baf4dfcb5049ca9209a2a3209424f
SHA512 ed6d846070c4a87b36b323802f5972d79dcc668e328ec004a0d15304e2cefcebe3cda8e0cd5b5dd77a8c59eec053dea1177dad973e59d6ace4743e3826dbd07a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgoA:A3k03kB56rs
TLSH
T1CA156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 868KB
SHA256 48b3f045a535c4ae3eee22a170e8387ac84089f4ca81df0d13bf6f9fcfc4c860
MD5 83d0b1db3fd63445972818b6b235b6fa
SHA1 c9d564ce7287d59f9467e5d18d4117de3a3a063b
SHA512 9a24e066051681a5a24de8c7357d8ae46a58be462eb78a81bbf9b37bed1228cdf41fb4e10c504e11398c2d471fa2a1857bc12e83d1e0ced1ab0eab7f29add06b
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgB9Q:A3k03kB56rN
TLSH
T1A9156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 868KB
SHA256 fe562f3d56ba67bd5d201a6eebb5105c8e8710f1f16527c1d9758805700582bd
MD5 b0f954de1e34cabcb405daa260e2e02b
SHA1 a7e8c131ca06d3924b71e64f70879918b7167eec
SHA512 93cf5af89f7b03f3836c9d456cb63af225b126b88f0d64bb302e5d2473fd4cc8ae843d2a6b2db6b562940705b81f70c9afe151fde44ed3575b43ebfed00381b6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEg04:A3k03kB56rS
TLSH
T101156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 868KB
SHA256 ab7961c0eddae8064a184cc21f64a38c03cc24063c204064dd8b8a21f74a7034
MD5 f0d941e1cdf2f04eb174b206265ada1f
SHA1 c2d370aeed9ac1ba221c34073b94fd5967887845
SHA512 4c4dabec7778cd6685f3b1dc9d64f44dd780789310df53aecd2ed1c05abaa1a241a6a46901f467e5f0a38fc4b262025d7da433011bb1ee1dcc6a35a595970bd9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgfu:A3k03kB56rD
TLSH
T104156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 868KB
SHA256 b6ca9170864985f01e537cd3531e4cd9149579b9c5e5318c5b594660c8374be4
MD5 7bc695783be5a4fa9cef09fba87e210b
SHA1 a190b86dd944788456e7fce07f359193fbbd9246
SHA512 b99485aedceebb8398abc85db3d3562b122f5b9ae28bb9db4c7aa0a05b64f296630bcc3fa94841c0ceb456fed276eecce3022f9c4228fe8c7500b6346bf3835c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEg6j:A3k03kB56rt
TLSH
T1E9156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 868KB
SHA256 c1f7ed1fef640c72c37eb41f7008d29eca2c191dece7a22280d826e1d8bd0da6
MD5 a4ae17c6f6708b2898c54a5a97f82448
SHA1 cb3a7d93d5590f55947c8110b7997eeebff82e54
SHA512 0f37ebffff69405ceaeb57fcf7fa379edfcf5c513575d5ea76a3d1d55a22089998eea763c4f3d6494260f5137e79f21b5c9eff02a900c050b76be29286a52b57
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgng:A3k03kB56rx
TLSH
T12F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 868KB
SHA256 e9057dd0edda982696b844c464036b84f01f415a2874e01c923a2d2654df5e50
MD5 376f0a0a9e373330a8bf4f8d5d7c6ca0
SHA1 1d406ae12aa8c9f4a9ce135b80cc1952b2aa4b0c
SHA512 95c0967ffa3e61ddbb609ad9a122e735ffb38b85aa3b6c2dad04274f900c91e8314bc413de7a77b11cc331bf556f0ddd484a227ccb89f9b20c5f16d61b270424
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEg6I:A3k03kB56rg
TLSH
T123156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 868KB
SHA256 39e23e47ac89b59124d8babd1d45824a3e6fbeba569e4d85f9b8624366fd19f1
MD5 86694c3830f71e548b1d1f3e5ebd1b82
SHA1 b7f2f2fe53fd6563c9b1c0ce6dafec9ce2397aee
SHA512 109db4ce772f1103491b90cb0666e4733385978b251350bb52c432124b04844bd17bc853b70cdf97c957ce12862766e12156a9e7e317c2accfdcff988d79c0ba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEg4o:A3k03kB56rC
TLSH
T141156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 868KB
SHA256 aafcae71edab850d59f68a8b3f1aa680005cbe47e5bf7a2697bd6c9003250c7b
MD5 47ac96f3cf7ca7cda7f738e63d97d45d
SHA1 e18c24c89ab30ded21d5f18977dda0b26605780a
SHA512 c334e15bde41b605cbdf56414bfd7c2dd083e70efab9b4a9a9ac27cfcbd3cf96b1094aa7476f0ea041a4514b4e6d4748eb6127e6c6d124f1b1c3879c429f3f0d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgL+:A3k03kB56rn
TLSH
T158156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 868KB
SHA256 3bd26e461ac09b3f3b62f3680c4a41662188aae8a31338f742d01b502aa9cde1
MD5 78673d82eccd99d3f727cd64fed55550
SHA1 0a89841f6a9fad5a1f582cc4152e4cb1a9e83430
SHA512 0d936be8f78dfa72643e9c941632d520713861c81ec67f11c2bad3638eca42b089e7719fb9da66ad23efb95be2d65f0de3115b1c99a9098d7fc5246e35bb960a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgBQ:A3k03kB56rT
TLSH
T167156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 868KB
SHA256 a04478e969844cffccb1a6ebfc0608d6e74e9e583bc76ac097a0aaded6b1c76b
MD5 9c5fae4facaee64310d5782154021dfb
SHA1 fe59772470a2c5379c4e7e073a86f21c36e0bfc9
SHA512 1807fc5db1c16d8581759b2f7492b0b65286bf25cf2e79c3a27f1aad4a4002a251bcc4e265b00a70c3bf6c3f11296cc44e776a4956c041aff7df4ab6b189e367
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgGX:A3k03kB56rH
TLSH
T1F4156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 868KB
SHA256 690aad272eb39e5e65d43d07de745adc23f77b374561d0918da726ff2998fece
MD5 40f1522cdda793487648b5203a2008a6
SHA1 a9f45be8e09401d5ecea8f5040b7b4645020c5a9
SHA512 f32c62f6a2a111782f6ab9e028421273f8f023a420e06636d420f4013a0286b78f6d74ff85f0921dd4249ede4d39a99a45b29dd57ae18a807af644dacc8b5ca7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgAL:A3k03kB56rp
TLSH
T1F6156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 868KB
SHA256 0eceba0941bbfb8967d48057d948582f3c453b8c7be80c443bba6c59e45980df
MD5 fb440fc7e713464f7f93a2c52c70eb19
SHA1 b48f855193f6ee95ed10222d984ce3c22b7072b4
SHA512 428d810783cf0078dfb11cb1cbfe4f1bd6df9f48108d8138b2a2b2fa5d6b05cb90acd87db44bd83251957acfd11cca4a3c602710bc8723be9b879fafaf723e73
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEgsM:A3k03kB56rQ
TLSH
T183156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 868KB
SHA256 19dde2e1e8a475153d284630bb874f58e0c616e97bfa3e5a9bc611967a7a026a
MD5 3280ec48f60666d0f21b5e25a74fa415
SHA1 89ee0e2b99c6fd944a5da25fc069c841a5ec1d03
SHA512 fd5c4f3d3afdafa18375b8b39fde7077e2a88f5d79ebd0660c534b148ef79c08ec8e87275e75e74982dff21174032a0cc0fb21957f6d24e2451fbb55bca580b8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEg1h:A3k03kB56rC
TLSH
T188156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4364-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5008-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5008-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads