583d2e10b090a8c138108a1033540eb9642e15002023ec180202d2723ef5f283

Analysis

max time kernel
110s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 931KB
Sample260809-t9vj2ssarb
SHA256 583d2e10b090a8c138108a1033540eb9642e15002023ec180202d2723ef5f283
MD5 5e0f8b8663e12ccb1380b35338195936
SHA1 9686de5655ee15a8c5a2e4217715c74063373835
SHA512 ec9983a9b3df8ed6f041bf59fa8570087f8ba66db1ca0523cf2ef0852b0dc005c9dda15cf9974d38731de5559d210ee3363e80e380d3f4cd98521896320e9612
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUu:A3k03kHRJe
TLSH
T13715AF03E79400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 40 IoCs

resource	yara_rule
behavioral2/memory/3896-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4e8-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4e9-13.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3896-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3316-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4ed-244.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-450.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-500.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-592.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-623.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-708.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-788.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-825.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-856.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-875.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-894.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-935.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-954.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1009.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1052.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1101.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1169.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1220.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1324.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1343.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1368.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019929-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 37 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4e8-5.dat	aspack_v212_v242
behavioral2/files/0x000e00000001c4e9-13.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c4ed-244.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-263.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-450.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-500.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-592.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-623.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-708.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-739.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-788.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-825.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-856.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-875.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-894.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-902.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-922.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-935.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-954.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1009.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1052.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1101.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1138.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1169.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1182.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1220.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1324.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1343.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1368.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1375.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019929-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3316	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe$	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3896	2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3316	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5e0f8b8663e12ccb1380b35338195936_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3896

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 931KB
SHA256 583d2e10b090a8c138108a1033540eb9642e15002023ec180202d2723ef5f283
MD5 5e0f8b8663e12ccb1380b35338195936
SHA1 9686de5655ee15a8c5a2e4217715c74063373835
SHA512 ec9983a9b3df8ed6f041bf59fa8570087f8ba66db1ca0523cf2ef0852b0dc005c9dda15cf9974d38731de5559d210ee3363e80e380d3f4cd98521896320e9612
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUu:A3k03kHRJe
TLSH
T13715AF03E79400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.4MB
SHA256 50d760782a4d3316d5b633e3d9a54ad0799e198649f319ad002e129e9ede7dd7
MD5 90a8ee810841bcf463fb2e466261aa94
SHA1 80f504bd877a49a64ff7d2b956f98d4c82c622e8
SHA512 1d80a4d0b10ef453ac66b6c8717a015f6b976ee6a37213ef6e219e6d03199c26e86dc3521892091d2160a265482b0e331ffec4531e9565fd87cb51f53a6db4a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUe0Le5ji0hmxNrM:A3k03kHRJOPji0Aj
TLSH
T124657C17F6A402B5D067C1B8C6E29A5AFA71384217309ACF1358C7283F67BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 945KB
SHA256 e40390e037a2c7b48014b70cd803ba6dbd4b865683300f81ee04256b38f37b0a
MD5 d00ded189b224a70e024fd0e7349262b
SHA1 39ea17e1d6797c31cd78e7205023407808fbf37f
SHA512 84d65b7a4cbfe5fcc618f6db13ad25d689359110ed463792ce1238a84f3f46170f3412f8ec6b22ddca0a63ab5195a80d2ce19c4c06ae68176b07c09f46e3b2f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUYa:A3k03kHRJ
TLSH
T10425AF03EB9400E9E10AC1749AE69A23FB75BC52176097CF1368D6152F72BD0AF3E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 955KB
SHA256 2ea98cd08db68e0697f20541be7fe0682e581fd944964121951d0c18f9a16315
MD5 ed8db86411cd09153870a0b4fa38fd3c
SHA1 32b89f6b33f2a859743d4a25dfd08c8a256ca31d
SHA512 c7fde5f2917454db82540784fc5fe97bd8b56197fdb151c7e31c80b5536e75e85032c9cf1bce817b2800bf33420adaddca8586189aa59de7beef6d45435b3344
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUx6:A3k03kHRJ4
TLSH
T15425AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 955KB
SHA256 52094ba7f7267086dfd04d3ba0fbfa57c1e6de366ffa847a9a149992dc0741f2
MD5 2c2227ffee790f0250d16e0919924bbe
SHA1 bf830a6332bf4cc8f97560acb420f72e412f5092
SHA512 7ce3eb33c8dddf1956ad3114d6b8aa6f892873cd5b6d50a96512d001d525ee01fec1b4365aa6925edc495e86df55f5b69de60cde46de7dd31ad9ddb510a3bfc3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUbu:A3k03kHRJa
TLSH
T19525AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 955KB
SHA256 9e1d23bf09b01dd18765e33d9349f3393bdd2a6a696acb0e215182594718ea82
MD5 7427a0629f63d8e6fbe575e92c1811e4
SHA1 2c58f1bb1c2f2ec8bbedebad19721a0992117da4
SHA512 97b7164ead5d89c89af66caa19b8c14393a1edc7610082aeec3ed5c49c661401e95d93b53e6361d58d9445931d2ac95fa9d9edfacda232ba388cfa3a917058d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUJ9:A3k03kHRJb
TLSH
T11425AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 955KB
SHA256 a06c7eaf76e38b4590979ccd1ab49dc8d914453746137b5078f0f3ede50f843e
MD5 b8f5c2917fb741db530742a3a44845e5
SHA1 cccde0382ac50204c7b088939f50de2cb838058f
SHA512 e1bb0dda694cf28f34034d464fba040f5adafe719dbc8b1b67d6cdc53f82ccc82656e80d072cfc31190f9102ecd8a85495313f2a522d1ac1ed21ddec0574ea12
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUlc:A3k03kHRJS
TLSH
T1D525AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 955KB
SHA256 e3f33029326ce0c91cc170f4ba0341973f1d9458e156c549e81f05b4efd03495
MD5 e0d279457bfdc05d1ef754c4c30c58fd
SHA1 c7a6c75fda164aa60d8d18026fbd3a384e67977e
SHA512 fb835d4fd6e2fef5e229d9f5496cbc502dcb89b7d489bada8855a8662f0dd1e737fee5c916dfbb3d190f4afaf4917ba4a6a8efbd106c32b2badc7ad8f57334e9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUep:A3k03kHRJY
TLSH
T1CC25AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 955KB
SHA256 bf8d2017273fd8ec6798960f9e44836be305239c65ce24e307336a49631d4439
MD5 1b2090b90b9e1a7cb8764cb49399cb57
SHA1 f8d2ada098f97b293fa2c267519f773534eb3d5f
SHA512 a5a43bf2057eb38d980232af553bb5865bf210a478d1ad3a80c4dedbb2c74f563c0e0e16cfe2d75cedc37e4dbd07561dc7611ac272560ec6f24107ef64376d1d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhURN:A3k03kHRJH
TLSH
T1F825AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 955KB
SHA256 a81c00bfa6991687ee08183d8524a37be165c11679fa7305dac47fac965f7c70
MD5 a237271ccbbd36cd50ba8a2a5ca2fd3e
SHA1 d416ab1a1c28e4893d6d1803f7dd7b34644bf925
SHA512 569a588313230279ce67bcf782be9289915a5d9ee7e721658a06bf348f9c42aa36a1081667500c433fb73056cd82ed1d56a507767d69bdd76f2eb7c1655371d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUzF:A3k03kHRJB
TLSH
T1B425AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 955KB
SHA256 3d40c56c9033386f51c32decac187d82ec1541a83037e590271814ea3ef9533a
MD5 c881664551a92fa5ade11bee3cd9bd81
SHA1 b1429625eeadaaaa5b99380ac37904adb2837f80
SHA512 040d5805995d03d463410c81971d98dec5c130e0c62faef5414d21e5fe089e65e6d77e6ad66722834ba304f965206cb54c00db217e820997630ed0562e1e1939
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUcC:A3k03kHRJt
TLSH
T1E825AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 955KB
SHA256 5cada83ccb0d7b85c137b84d98165fff3f7dab059fa7b860f39c110f7863c86a
MD5 6490dfefefbe185b03051a8d2fc636cb
SHA1 9e9f48bc42637229de95d0d55d308198a46e5e49
SHA512 b8cd92f2f076c39990493c54047f0bbeaf1868f4878a35ecd9703298821cd3c849b00bfdb2b1c2c86133dcccafa25dd573dff5cd8bcbb0512a7d64849ee77826
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhU3w:A3k03kHRJw
TLSH
T1C125AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 955KB
SHA256 455fdb4048d6314765619c70db0bf06055780f8973cf24f9b654ff0e3adbef6e
MD5 e88e9138e724050305fabcd19b1d91d4
SHA1 1819b9cf6eaa081738008ac160159ad295e23fca
SHA512 b3d51a44ca138fb45544c0fdd5e64df66c3dcb102047eef70a92a3cc79e4bc7d0118fc0a643e246b481465e8a1b65675bca3cccff65431e5d518a4d3a2e9bb9b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUmT:A3k03kHRJI
TLSH
T12525AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 955KB
SHA256 e8ee3912dc7f16e038ed6cf3b8d7505f9e5fb8d4dff00c1b1b49ee4a28ac3593
MD5 35aead3dcbda81093033f145a1302a14
SHA1 7a8977ad3cabc69c3839086b3e9f333607b85d1b
SHA512 66b4a2256659621bf55c3979feb8be396219b4802516615520923d03c46d8a57d1afda9d524a1bb2cfb306495f0bf8b77786c405a37eed18c81d3fdf8c82f09d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUeu:A3k03kHRJX
TLSH
T19725AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 955KB
SHA256 4967d4725931bdaa5e900f51a011a91bfb795c403510f1deac2e713290b13d9c
MD5 5789ebab61c7b4b4728ffc236e9d80a9
SHA1 98376a65dd3e9e64fed14e3b68f8dfa00825da2c
SHA512 c922de2cffd8903365ba21131d8b82ac5aedbe83b44463422cd993e07b8565034e0ab73274a01a173e60f1b4b83540ca186a4b0b549cf7d44d45799c61aed398
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUYb:A3k03kHRJO
TLSH
T12C25AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 955KB
SHA256 5dbb04485043355f2e94e54bdb89f8d729273b9f19d7bd1f88bb596f585bd0db
MD5 b4e90217285582f548f075a4df47b94b
SHA1 ac74510f3592ce5fab2f1d48fecbe480b7bce72c
SHA512 72d7ba11d51da4036ad24c846cb379d81ee5809192e467c1aa45e277591afce09ea834517118ded953ff502312552f41dca669fc4e63923af0a1ae407b2840b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUGf:A3k03kHRJu
TLSH
T1B725AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 955KB
SHA256 c2f61876d4ecedbc3c26fee06c605c33e09e4459b53d9d2fa989cf9263ae118b
MD5 cdd6b5693556678b231c6ec3d836dabb
SHA1 3deac2c48e0a1c10e2342df08f344754c91aa08f
SHA512 22ff54484e44ee2960d490be9eddd24cb06805fe6a0bc60ccc2f3633fb993e42a1c6e9592fad39a6d1b2e191739aa5e6eff9cfc8e6594acc31f8301782847938
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUDK:A3k03kHRJO
TLSH
T19725AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 955KB
SHA256 0eae0d2c5c39aa6b588ea66dc041b77ae669c907a614bb2d46a83342e690b6ca
MD5 ce2c1ba505e2d21d29a83adf372658c7
SHA1 322ba37cfbc7b0e330d14e36aa879bf9189ca441
SHA512 d57aa312ce90a3a016d6aa3af828d5cfa1f351812f7009677d6b22f7e3f86a0b48f122044a3d9bb592d93c9305e68bea3f828d2ce1292b87873d1cd99d95e2e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUkk:A3k03kHRJz
TLSH
T14325AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 955KB
SHA256 1a4820921fd6a187eab38a7d1dc73080b3e3c591c1ef328fd61226f8a4b8d352
MD5 723c56dadab8ca08ff37298d9b36757f
SHA1 a6d83c4a3c90608725f3332e4e437d77573efe6e
SHA512 8062e007d0821b1c6d54c42eeb030c992f75743bc75e188469440fe587d77140daa277b614bfc37d8a53efceeeee553e4e22f80eafb52e3a84a52a6f768d392c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUt0:A3k03kHRJS
TLSH
T11025AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 955KB
SHA256 29a0e0e491ac4c92e391947c19d52ff1234ad5e5dfb48b14dbc8b0c374118303
MD5 00203ed557abb8ce5b2c1b851ed74eb2
SHA1 f4fff0061f728caf479339c06a1260928912f4b3
SHA512 d2540306cc9a61d215abf0e0d491e57a1753114c2481b658fc56dded2c6f31e75be92f6c2ef07bbb3489525ebb21d3b538bdcd656808551bc8c04d657aa4fbdd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUwg:A3k03kHRJr
TLSH
T1A825AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 955KB
SHA256 6f04f09e76dd7934066fe4b2f5b759161800fe0282f2d2f1e3c2a5780ddbb2e0
MD5 830e41c445759e56b290450baa747ea0
SHA1 9f599b009f47fb7e00fa8894770991c3990dfa15
SHA512 f40e277e237ad71aadbd15768e6d11603d8d763f4e4df7763638a62c416d36aaa0634156da0cdd0ec06e3eb76f6cbe5927115949f7a014d718835615aaf2d23f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUFr:A3k03kHRJd
TLSH
T19925AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 955KB
SHA256 2148580b516e9acacdf7c91427ce29df45d46e0ff385330c1054046e9d2453ce
MD5 0b9e4dffff0e7c02fbe5994c547e76ab
SHA1 d2dbc69ffa409ca1f2c8523e667748ca615fffd3
SHA512 1d68688640cc4ee7a3852c3bf5c4ecf8f759d9fe9bbdea9277542a54bb2962f2dddcca74d2eec97bff23708e8ca95577ee270ca4f43985ecdef462eb3c89239a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUPn:A3k03kHRJ/
TLSH
T11925AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 955KB
SHA256 f692a8f9d5efe613206dcd7c458b6f57f75bedd52e4dbee75abab84cb338fca0
MD5 1434af197885d2ebb0c6ebc45f0500d4
SHA1 edb5e1cc2eb07dec44b10ee5393cdaa1c9ee315d
SHA512 9e6adb3ca050c57221faf85aa5a273c524621fe95834a3ac1aac17b868d97678598c2261170f0293aaf284d1ac12d06f4008d7e3bc15ef49842575404f3ccdf6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhU7x:A3k03kHRJF
TLSH
T17325AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 955KB
SHA256 f695d6b93d0414e15956645e88071a0b96f50f652a611ec442d3460db6f6b578
MD5 d83da193b8314bd99a2364fbab58902b
SHA1 b07ce6936a7b95b1744b8135635bd16dcd46f513
SHA512 962144713082a137d451307755d8cdfae3181b279084209d348d08b0542d5e0e43f06998e10fb918646f2b26713aaa7e126c42c53b7f7fe53b0e31bd537600d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUpA:A3k03kHRJK
TLSH
T1B425AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 955KB
SHA256 48a0a2f9e4a3260860850adb3d7ed51780bb794383eeaac805d6cda2640326a9
MD5 88cde06d95c159b5a016959744d5bf60
SHA1 d297ca75e72372a22629d9ef941f2665c67e052d
SHA512 3970368575e7698916777a899eb118c0c080cb3691d2b1cdfbf52d0ee5e180170a0c2a89b496694ebc85ab96308ad779bfd6b29f1ebb2c3e3bcd0e4844a9ab12
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUi9Q:A3k03kHRJ3
TLSH
T17625AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 955KB
SHA256 db4acc9a41080d189dc68a596d5246d3867f01d358903f3567450a1b7bd83f7e
MD5 6933096871d500e04f912f8c527b55ce
SHA1 8972ecac068159fc85e6a2748670da4724cb4143
SHA512 802f388582e6679155f46ce3b2d289a1c890a5f1d89949c418b64f58f9ecf1ae16d7e81c8f9342e920df4b2200328c5e559bca7a348d8f76c1af7f58b4961284
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUH4:A3k03kHRJo
TLSH
T13C25AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 955KB
SHA256 ff352e3f159c736bd8b27081f4ec920e04f861bd07aeb656fe968f5e12c2dfcd
MD5 43734f9542ebeb2c1b4cb80e1fc04535
SHA1 5c7208cc63beeb974758315648922336fb7797e6
SHA512 ab8b35d7c53a3cb3680c3e5aa33117d393b3f831eeecb1924be5a1b0063fc706c9b46c785d4d9dee4fa3c103ceba0000ee4c2838a1d90d37aa6163a0e91c7965
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUmu:A3k03kHRJ5
TLSH
T1BE25AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 955KB
SHA256 6102866656b722a912c07a3c5735c534de73b99300f590cf22a713ed0b53b743
MD5 86a4500bea696de1c86535ec1ab2a045
SHA1 ee9c1952f4971bb9c7498a8cdc01430c23888ef1
SHA512 d85581a8157688ee391e5b709031765a196c279aacec5c1df27e324f62f148a282b6d041e2a72973b3c248dcc9244a08149d603e90baaffccb4fce0c581a41de
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUXj:A3k03kHRJj
TLSH
T19525AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 955KB
SHA256 7c84069832277ce30ae9b4272443a43566dd2d3f6363b6d7064c995e4200213a
MD5 2b880dc936ca9c2d0aa68110c1c67fbd
SHA1 74126c438640867fd66653bcf768d43a38906a45
SHA512 539bf51581b3f330529004be00f5f893f623a2c59c42ec62197ecb48a567f906d20127780f97d7d474d5b9949f8a7253229a67d71d173745c1d40175257ee5f8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUCg:A3k03kHRJL
TLSH
T1DA25AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 955KB
SHA256 8d04ca4c9b62ef8278691513a941549a527eacd309c1f828f67baafecca08107
MD5 9fafd06e20e0f59ca43739e8a02384a3
SHA1 d4efaea127ffef5f109b80503c46ba51c7b089b6
SHA512 b6148845ed52891413171b189413e324f73fbc33660cbe796a5fd4819c5c709e113a082bfaab8508d3db54b56ef56a4852f6e4932a013733e79a2f9090eb4aef
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhU9I:A3k03kHRJi
TLSH
T10925AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 955KB
SHA256 bdf6192da2bd655395b3e18ad2421e6f24169f0d0d1a3a4cb2e886c6050d2d38
MD5 554cf098447ef1e43290bb6f275b9c05
SHA1 b0c19d696f619289acb44d7de3f5c92855819dd1
SHA512 dbc6790bf9fc6be3e2601ddd6d6032ad9cb19f4f87fdf3741f08226a5ad6d6cdb3974ed9a97b4ee8be8aa3dfef051eed43e7036f7f180696829f80da4aa6b81d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUvo:A3k03kHRJA
TLSH
T1A025AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 955KB
SHA256 bfdde28b2daa0a3acf6c68b02948f6787f3a44929327630716e51a2573a63c15
MD5 311ec0bfe3443d0014e7c4dc8fbfb1cb
SHA1 13cbff8d37398f2c6f9d76f19a254a5128c27845
SHA512 c1c4a0f9fc053c631fa1fc948e086d297e29d9dd04c98765a98e533852b4d80ce9394a8288e50e6c54e0520d1b805aba461ef1e3762bce132c29aa985b2bda45
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhU0+:A3k03kHRJt
TLSH
T1F025AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 955KB
SHA256 733d411d8f55e8ba7ed6a925c16962b8e4cb4216b9a63e0d1c692882ded88413
MD5 aa85cf18c8db8634a0866932620dd379
SHA1 1e8dd51d5a7dddcf5be902cdf94cf0fd70dfb96d
SHA512 7ab852b8a8804071da6c7c943eb410da25978a5ed535b5d8a1deb57f9d0adae3585cee6fa403ae2696835edfe7e962d752a937c9d68e83bcfa6def87147ee7a4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhU8Q:A3k03kHRJl
TLSH
T12725AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 955KB
SHA256 80df737f6a1d9d353341d905fc00123df9052e2276b41ce80ed40540db8d0ea0
MD5 760f60b06322701feaf6f1f3ee12e320
SHA1 09d7ee944e18c31520cdd89eaaceb1eab140a513
SHA512 cbcfd03051e5e6c6c8dc27f67e00a733de8ccfc1a8f37014ec783074a3248ec7e167e3e39f757a3f54d55a134a3cae8bfaa9fe2e822fdb310b85e9dbdbd39cd0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUlX:A3k03kHRJx
TLSH
T17625AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 955KB
SHA256 4fddd6a0392976c4285858ed28f42e848b114d00ddf54c7e90814da2cadadf31
MD5 a6bd8b9cf3d89a9e0cd6581aca5def95
SHA1 68efb47c8bab1a7ada8f2376151cbb5623f425e3
SHA512 d47a5ac10e8726cb5a1ae24a98c83aca09b529153f3640f473d0888d732f4594ceba7f97fde072f0376424e9e9c17c52151ef80cd82ddae2b3bc9d95ecd03a6c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUHL:A3k03kHRJ7
TLSH
T1CC25AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 955KB
SHA256 3f89ee0e7fb0894dd8d777c5a78ebce70b0ca7b5b7e338bdb1e402ee4fac0b68
MD5 23ca91db712fb090b91cfd0ee0b9690b
SHA1 df59cd7a419f34906e6b7501ccd217ff9dae938b
SHA512 c7338d3081195dfbe9f55edeae9f2afabb1760e22d26c9ecba6896fcca9a543ad49cb578822d0114b66900393b6739363e997ce951ae0d7e253553668b87ed58
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhU9M:A3k03kHRJW
TLSH
T1A925AF03EB9400E9E10AC1749AE55A23FB75BC52176097CF2368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 955KB
SHA256 d2be06530db7f903940d795e9cc02762e7702375f8e4b4ca541875e4ffc5f67c
MD5 ca3eca9f4c72b582052971f00914f0cb
SHA1 9858841504daff1069da3ae6de3ad4bc4d0c6b90
SHA512 6a6031b29a0a7da52a10f1dfcb0b2908d11f1b47a647efc1570f6a1234ebb7f1feab60def53b6bf64046592fd28f0307c0a5990692ecbac225f6ee991715f296
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSF/vERaEoFhUuh:A3k03kHRJo
TLSH
T15325AF03E79400E9E10AC1749AE55A23FB75BC52176097CF1368D6152F72BD0AF3E3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3316-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3896-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3896-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads