a77da6454c62beb18c5193c586cec8ffc002a7751d92ed0667ea0ece0eccc2dd

Analysis

max time kernel
100s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260810-3cshvsbb64
SHA256 a77da6454c62beb18c5193c586cec8ffc002a7751d92ed0667ea0ece0eccc2dd
MD5 f02ebc5df984af3ab48e5f4dd9e79fa5
SHA1 80d0b10ea89586440a7e5beff21154386e88eddb
SHA512 f3513edc6ee5ad4a2335ca307771d6fff99777986eb78a9433b3ae07f489f3fa76c7fbaf23170157738bf8506f025c0bbe1693e4ca814a3986d7ff68f7d31e71
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aF:A3k03kHRJP
TLSH
T11525AE13EB9504E9D10AC174AAE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/5672-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c51c-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001b2cd-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5672-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3276-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f9-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a59-577.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-621.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-670.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-731.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-982.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1037.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1050.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1099.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1136.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1366.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1380.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1401.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c51c-5.dat	aspack_v212_v242
behavioral2/files/0x000400000001b2cd-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f9-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-224.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-491.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a59-577.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-621.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-670.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-731.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-982.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1037.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1050.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1099.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1136.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1340.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1366.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1373.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1380.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1401.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3276	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5672	2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3276	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_f02ebc5df984af3ab48e5f4dd9e79fa5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5672

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 a77da6454c62beb18c5193c586cec8ffc002a7751d92ed0667ea0ece0eccc2dd
MD5 f02ebc5df984af3ab48e5f4dd9e79fa5
SHA1 80d0b10ea89586440a7e5beff21154386e88eddb
SHA512 f3513edc6ee5ad4a2335ca307771d6fff99777986eb78a9433b3ae07f489f3fa76c7fbaf23170157738bf8506f025c0bbe1693e4ca814a3986d7ff68f7d31e71
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aF:A3k03kHRJP
TLSH
T11525AE13EB9504E9D10AC174AAE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 6147408359eda724630c77f5126644b51b3b4c590fe8f458f22b80dbfdc6fb34
MD5 1dbfffeed8046df034d7148b57a9277e
SHA1 53bd060850c7af901f6ecd027f62187e72027365
SHA512 b37b55b695a951277479ea74a52af42fa03b0a61ad689e709c5edaf7cf072ccb7e68867e1106ff25375a3e51288af82acc6c2ab25bd661a0284f6097780dd567
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aB0Le5ji0hmxNrM:A3k03kHRJ7Pji0Aj
TLSH
T159658C17F6A402B5D027C1B9C5D69A6AFA7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 963KB
SHA256 a77ce96d808ebbc8ccc84771cbffbd9ac724c0b054388f28a844e0d90d518590
MD5 87a9e15fddbf64cc79f1f2bd1532f351
SHA1 e63841d16e310667a74a86fcb114b2f652ac30a3
SHA512 599b5113f2bcace36cc223dbcca5a04b5267856808c7ad4b8aba3a2b094c1ce41d46fc3b68948746f0cbd09f8cedc75f273c458285df4111cae2ac4a72b85807
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aDa:A3k03kHRJ
TLSH
T11225AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 972KB
SHA256 0e9cee9194150a8ca084be7b01476f496bb3358d8ac37d16bcc11a4e9cfbdd37
MD5 2c91ce22276f276ba8501a0ed089747c
SHA1 a57b0d8f631361d8f21a9f324c2933eb5d570c87
SHA512 df4164d6a665e3419d8592fbd211f51055dbbd104864935acdd5e4900f923ad6e0c7cd40b2efd8cc2697e1750de2c1a1fcdeca93975a290efc199d9981858002
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/ai6:A3k03kHRJD
TLSH
T1A725AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 972KB
SHA256 dba45a82e60992681e2b78aaaba137cf618fb3c369533dcb628633346037afb7
MD5 bbea1768e5ebb797df30c18ec6d445f6
SHA1 0f6b302f8495672f91c6a13c177c559a845a3597
SHA512 8d8d18d659e9b34e16ebb8ca76cb97432c1dd25934153c41532c16b9285596a149fd1db830b46a7550f5eae3c16eb0181633c406ea3f78e1f961d97271c9b955
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/a6N:A3k03kHRJ+
TLSH
T12425AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 972KB
SHA256 74e0c4d5dc3db4283a504b7a2c6e13213346bdb5cb7ad4429ef5e54ef35d2cd5
MD5 d7a12e4e01152329bd5b663b964afc02
SHA1 084f3233b76792bc5bff659b67d33d9a38032dae
SHA512 ac83651938ae8cff39fd29d026e78964a28ef8d49703ac79cdb57073650d0b231557e21680eed32b17365b267703dff73afaa8960d7c62a1557b5b7e65758225
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/agf:A3k03kHRJS
TLSH
T15725AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 972KB
SHA256 cdca0384534d8927b2dd976f9864c87705a78e97d51d6d99c7e5f114ebbc1620
MD5 ace065f8c7825e00de9b64c94c833b95
SHA1 b5299c6fb5761bfb72a5f38cb2cdba01ede323eb
SHA512 9ab7f2e109083f5b52115363c926f4bd10a453f9f112e261e787f84726aff5ba77b3471bd9024a3b1bee36c326c172ef090ddb46b6149579e9013f0c5a02c315
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/a6o:A3k03kHRJb
TLSH
T1C325AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 972KB
SHA256 0010f2f10338c5e60f261779f4e3109bdf90bce6f94437cc66bd74a24966a80b
MD5 fa081648b597ce88bd065aad60e32cfa
SHA1 b83443732ac8265af737c6a5733c078750f4091e
SHA512 03e047b9f34aaa9dc2105d470f0821523835eee4686493eaff4e6ce44de0c7a824020c3d5ef4ff9517f2990d1c457335945bd00fb898fcae5515e5e59654cf44
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aOu:A3k03kHRJd
TLSH
T13B25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 972KB
SHA256 0ee061e39d6fddaddf33afc0180a99af22c83c661e0dc931ae09a797204ecbdf
MD5 aa5519676fd98ffc16beda29fdcc3c57
SHA1 f0722ce4fc9e112adff6c12bdd30d1777529459b
SHA512 4cffc99290e5cf4287b069b32fb2c6e8b6891bee23a26fdda6e47e58225727a5075d0deb7b80bd493d4e3e3694d7169386f7564433587b401973c74a773b289a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aC9:A3k03kHRJo
TLSH
T1B625AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 972KB
SHA256 505358f455e73e8af34a40002292816b591f58bc8877cd7c9f8e18dcf605dcc9
MD5 b0ca64809e0c94119d423373863ec935
SHA1 bd5dd0e1b41e9d039595730ea57934e66319f827
SHA512 e66367bc8cacf39503bb603345d63a2bf4bc6b0ac3240ba25714e37cdedf0a8b0d6cffb1fe5321e536147e11da03fff939cf1661d485cb0df1540298cf078a8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aCc:A3k03kHRJp
TLSH
T16B25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 972KB
SHA256 8b066d532252fe9eb9a8cb12893f186fd88f09526b6cf0af3e1fe16dff88be3e
MD5 2a5a505e8ad063fa0486db3ef2f66981
SHA1 7768cd2746a8baf3496d54b230299b006a2a0634
SHA512 e65eb3c8abfc9259aaca909d9c261c465827bdd6ac2ed362f67eb8130b4f6332745c63e02d4dfa61d85303127bf5c1da3867eace5d635a71b3df4640a856f5c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aLp:A3k03kHRJH
TLSH
T1F325AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 972KB
SHA256 46d2d609e7a8fc647f3744e16c8f5cda4087f1caf1e7986770092f6ead1f659e
MD5 783ec1b6b98e6048d5e728e3b5baa36c
SHA1 45516506651ff68da21def5c9ecf78fd29c3b766
SHA512 1d0680c0988ac4777abe1095e19f2ce7c1b2b56846ad6195e0308c77e2a1e6b6c8abe0880c738c4db0de3d50be4fbf910f8b4e046a1d61bb75837d3fbe0ef519
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/acN:A3k03kHRJM
TLSH
T1A025AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 972KB
SHA256 ed934d28fada66bbef1f5114df5252b8b5adfdaf6aaad820698771649cdd751e
MD5 9dff93cd457bf209464cde58f26e34be
SHA1 d3699d452548ccf7380a92514c097f1c1536ebb1
SHA512 5094ac80e8fbb6bb9cc2af02ad41bc769a9c4c835975edef027d4d9b94acd638c467bc1948fd081cf1c8c8ea6b5eb4fbd2d27da754b8020f888faeb962856a2a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aEF:A3k03kHRJa
TLSH
T1DD25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 972KB
SHA256 0f2351b6cb0f84e91eedea5f2697d944207459191d319b81178a622747fe5912
MD5 a1c37a28b2f96abb24d385623840786b
SHA1 06bad7b285ad969c650f082af7d95a94bdadd039
SHA512 6b590c33d2bc039e6d7e3d9ea4c63366334a2ecc892304dfdd313f3f7c42566f870aea15774b0afa54ae32f7ae0f1dbb63df26e67501e53d15036c73a00481ac
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/ahC:A3k03kHRJu
TLSH
T14125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 972KB
SHA256 862d0cac5f1c6622a7527366fa3a2a722f6adc9758f79d4b6aef244043965be9
MD5 e8ab17c0817ad3e3df0a2dbc631a077f
SHA1 ff5b078be76d547a166621277f5631350e779c78
SHA512 670e65cfade4947194b472cffdcfd89ac030a643602776b0f614d01ff440ef231fd958c06e98fdfee4196528e3f14a78dbc4444031d9c8d7d995135e5cbcf1e1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aiw:A3k03kHRJ7
TLSH
T11125AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 972KB
SHA256 3041ce6b855cffa146e9f3c365eb2bf785256c4cdcd147fe44fa6697252d5780
MD5 2fc821602a43961b2214f1178979a6de
SHA1 6693df7cad0950a87f9b5561bbbcacb2a859e786
SHA512 024a65637ac46e51dc6e955618fd1391261aa0c22f829fd11e2dc477aec72413a2b17598bacdd6d9b93f2268c2a35e53fd19e5001a36044f9b244b7b2bc87a8d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/apT:A3k03kHRJn
TLSH
T15925AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 972KB
SHA256 7dfb512b9be62b57fa700199ee961db60757b613c7d5904f4de721268dfd88fd
MD5 6f08c2fe67cbe12a58892d71c6d3bbc0
SHA1 dc45c368f20764962a0c3b1ef7e15fc2e9a3b906
SHA512 b928f8842bb4fbe5fe3c5350d3502a39e197e8ba99697f42af417338a09499e3fde6c36ff5548cae213b2dab0a14c67681060756cf9b4b88bfe4acf928514629
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aHu:A3k03kHRJo
TLSH
T1AC25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 972KB
SHA256 d8fd36ddaa07fa2007b55bb902f1bbc2cf9bba035f5198727f3e24087079b4dc
MD5 5a34c0e63ae8f3a5a784512bd1ac8fc6
SHA1 42399333ee77d5f16ed6692878e0d433d3dfc0d9
SHA512 8ebfa04191b767003028fda0a8b2b4998e8e3deddf274f9ebb95e6b93e1af0a1b008dbbf712e84a6f11d63b9eaaab1610f5513d597223aa94f2cab70c4305115
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/abb:A3k03kHRJR
TLSH
T13025AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 972KB
SHA256 aed90f5c14f0f089afe963950889910357e5032953812f8b56baaeab5ec7c862
MD5 f19e00a3f8bdbfddaf7ed14801f2c058
SHA1 c0d8dc21a19df82f4ce23d1e75681ec47963eb01
SHA512 9f1bb3dbca3bdc1eead930427cd67382b2f9a4a129d37939d6cf503854cdce86d6fa9b6cd1194927aec82591e0570d446a608d605e196ab746a1a7ac5c46dd40
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/avf:A3k03kHRJR
TLSH
T19625AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 972KB
SHA256 bf13145ac6df49157b0980708bf24548952bc5573da472bffd986a19825e81f2
MD5 b14edebfbb4c6b73e5fd91af75f9e91c
SHA1 fa64105b6493bc6d6a6cc601412b371a238ae15c
SHA512 50fca80b1d815d375a06b7dc8a0d7d3c2663438b0bedd631160a5666f85f8cb5b6568a6fe8f4d5daa7b7c2acfeabc7e79b1449ce9962f3e6e0fdd45c81a3014a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/a4K:A3k03kHRJp
TLSH
T16C25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 972KB
SHA256 c450102ee9322bfb52c1aefd3d4a828a760f302ffa18a1017ff564399473682f
MD5 0ae99c85903f8dd9e6cd6908cd78fa9d
SHA1 6c7e8e9151f29cea5ac5b0fe9fa83a060487332c
SHA512 c0d76919951962bdc351cdcee75a7dfe3a0544534c59d2d0e3f4197ced1c9905da58fb906a6f63da181cb325cb708b98347681b3e765a63232417d73fc86d557
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/alk:A3k03kHRJg
TLSH
T18C25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 972KB
SHA256 30a2957f02f81dd317d78917bef4bf524ae3f6ba560f433358e133951883857c
MD5 ff4892fe356941bd0588a5959e8a6209
SHA1 1016672b6fbe2181853bb4c2c52fb60304b683f2
SHA512 ff7a38ca8ede353a7c2ea34b40ea3c09b8f93ab1f5b57d196c63daae3ad441ca22aeb4846a1c013f64d5c3f32cd4cf94bb77686e879f6067a1f996a9455e8b24
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/a60:A3k03kHRJp
TLSH
T10925AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 972KB
SHA256 d5b798fecffe6a853f5a06a1b7ebbb95d147e93a5496867310493e4301daaf7b
MD5 bc7aa3808f2a97d69c4913a8d40c4c2e
SHA1 f2346147061cd427a9e74f645e973cf7fabf9309
SHA512 e7c41a1727fcae8b3fbc617ba154fc598b24b3908975836da2b83822f2ccd667e9ed79e0611ce67c7616e10d62507635aada76082a3b09460d93475dd7c31ab1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/apg:A3k03kHRJ4
TLSH
T14925AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 972KB
SHA256 31579eb7a7e723e7c987388ef945ad29a94d9a053e8be288364e20116c4d6507
MD5 5bf539aa9945382f80c5889223b934c9
SHA1 3e7dea33cb3fa4cf36537bd8f1de6d27ad409861
SHA512 b05afc464687d720e3a25548bc51e5e30f8ac283ef3d931893416efd4e81bcc4476022a7bdae0fbb9dbfd9e15864983519e69b9dd6677e9695a993adeffc21c9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aQr:A3k03kHRJi
TLSH
T1C125AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 972KB
SHA256 1577c88f3ddd21c13bb48a02763592803eb05554b157598b511dfd7b7b4215c4
MD5 89168a10743f253e98907c988a5a7a12
SHA1 76fddfa8d989af15a9486810ec473d27953d45d1
SHA512 c3f176d3758dbdc070f1df9310c1f3c6571a604dcb371ba1d07ea7d13ce3d59f36563368c0adba4a7e945f61a55e57015e6e359c9715bd236c4cde52ce1bd706
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aOn:A3k03kHRJ0
TLSH
T19A25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 972KB
SHA256 2c862bc8ecda9ff0cbcd4fc3c22715d44faf20de0c31fab47b3832bc9c0084a1
MD5 31f4aaa2a0214ce32c1b037d5f1981b3
SHA1 070be7fef3b0ab78b225ea80971fd64150c98c9a
SHA512 00587c7722a2889e353e5bb8be4450827121e91c66cb1bce245317fd6e3f7c3eb489d9c62583e6ee8ea401b027e3ed44427f0633de20de49e396554ffb5c7f1e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aEx:A3k03kHRJy
TLSH
T19025AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 972KB
SHA256 fcc8cceca20cff61c4eae35fecf9a908f18ea020f20b0e6f8b88ef6d815b6567
MD5 9bea14052d009df62f6b212bad41ff9a
SHA1 2aa3787242f56a12c21c0ed811928e9fc1a9e9bc
SHA512 e5a0b11c41ee06df60275bdb08ac2202223f5a0575b5dcebb24c2cf731958906dfa5d477fedfa9af388ce21da83519860e6203855f57cebee998daa33566aa3d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aOA:A3k03kHRJR
TLSH
T1B025AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 972KB
SHA256 44dca60e852dcce79885db1537dfa7d3482ca09017163a08ca90f67a80c6e608
MD5 a254876f4476abcf6aba43441a45e341
SHA1 d1c5f52f5f3b4e671ad07072d58d98c4cd0caad0
SHA512 964747e8c06fa06d764c717c40df130624128883be5fa79479d665ad343c16ee245ef64830679d2b9f83f9c4feffe6360120f7f2a119ee7a2520bccc11f84b11
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aH9Q:A3k03kHRJo
TLSH
T11D25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2358C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 972KB
SHA256 c28cdbab5506e0975bc28e6920771a2992e9f85d61a765392139016e7037b9c3
MD5 593f9a401dd39cc63619a520e76926bd
SHA1 1f172b6de9ba702d14e59f445b7b9cc04634c8b7
SHA512 b3d778efab77c47145bc38c5c82920aa7de8e146ca723c1f312487a2f193f56a36ddac022e1a9b7b117482a3cfa0ce9710a3b4ab84f37476f37b97dc09cf583a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aO4:A3k03kHRJT
TLSH
T1AE25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 972KB
SHA256 4be8d7d31ae6314767f99726baa2e290a3c8a52d15f8300f67eb2719950d4c1f
MD5 52f145739517cd761047a27b3e22fbfe
SHA1 edf58e4d83ae483f325d8b9334f7fb741ec08b8d
SHA512 e1132e2615c1980c34ad5c32b09cb705b55dbba7bd85289a6537a755060db09541de77c6136eff456ec81c985652c51311dac817434f13e2c1a8447ba7e00917
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/atu:A3k03kHRJ2
TLSH
T12125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 972KB
SHA256 114922584db2a8a148a98b9cecd97d294b840779c5e5fb8e69922068f4c99e3a
MD5 90b5d70b38e72ba9dc819f9ec652cc9f
SHA1 0abfe9efdcf81d11a243721c0d0255983df02bd3
SHA512 54c751d88f1acac9a15cb5a1b3d157465c3b5fb51de8df37704dc60ffb41f206964db8d433b0d037c277c03ccf7618dc136c9d66e22e8c7916d734f15ab5bd1a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/agj:A3k03kHRJI
TLSH
T12025AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 972KB
SHA256 12d608ef1a5b55e8fd842060d4a15c5eb182a839bb84e116973fcde8ed7bd1bb
MD5 e7332830c19e136b06841294c24b25ec
SHA1 e46722240781c9e1494bb08bd0b097186c33c41f
SHA512 bd92aad278358690535101d228e72b31f4a4ea6c31a6f7e1c3f67225f3f1a587dc4bb52d44147c01b894a02e62bafa6d9ad33f6b2155f4be50667820144f1011
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aRg:A3k03kHRJQ
TLSH
T1B225AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 972KB
SHA256 f140316b660f1a96cbf56029f0ff85d43d69292ade1284c439ff7cc92c8a1173
MD5 8d45d59657dddb8f920d21e9fd67c99e
SHA1 da87a1361cd3b6eb9cd5f387a42143f81e86a717
SHA512 3e783b7f38de8ca90c25ae272cf1126432a0a4029426a854b43998f1ca8d446cf14ca296c1f6b8cbe434a6b5a13b13d9e8956a68f225a4facdb135860770cd2f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aII:A3k03kHRJx
TLSH
T13925AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 972KB
SHA256 397d8bad2f64fa417ec3c5274990ed45439a56d5c510e29452593d376b760f72
MD5 d0256036293cb2a5ac4c573c4fca49ca
SHA1 7b4e85229d499581acb05f93e79c6f98dd9e567c
SHA512 4d2500fa62b8c73cd16c27a3ce99a3f08b6b30309bb07a52f514e68440a9f5a593ebf8167b438a1a7520fdc87491372e205b3a2871e2e6cf1116cc78ebd0c657
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aqo:A3k03kHRJP
TLSH
T19825AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 972KB
SHA256 08eaabaad40dc66d986826d6e78af6cfcb3afc2c59f0bcd2d56f0cf63025e6d0
MD5 0baa34ed570f9ee08bb6e9511439932c
SHA1 a8f1463b06ccd70ea2c880ab083efc9953ed5084
SHA512 844b86946aedd501bd658f0f54ad78f826a42b98b819a08c4599ccc94da14f39a9d54ae3bbd984252334138e2c4104f4eac4fe08f0a2c198d737424c9139fa16
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aB+:A3k03kHRJ6
TLSH
T1C125AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 972KB
SHA256 002013d44d349bc110dd55ee0078d97d4622a4116ecc647483b43fe75b1a50e6
MD5 b06dd417181119d74eea3d5ebac07a5d
SHA1 abad465a95b1c97da79bb724bf99f7166cfb540f
SHA512 53c454ca20388725f217d3efe54073f89b6fc513295b0cb7e521f6b119adaf827355485c7a7ccc70be8484567b52a1c1b25d998426bf34cb2632a2bc75d1b1ba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aPQ:A3k03kHRJ+
TLSH
T19C25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 972KB
SHA256 81d55bdd8baa788cc9c57e008eabb7526c8db0387b2155a45b79ac7f0181d4ab
MD5 6b78420b11e997b055ca11e0c7d8b05b
SHA1 9bbf5123d37c1fc1d819b1ec4231c073ce04825d
SHA512 91235a43540265af48b381d5bdfa513f2dcfd97c3435b30f5e3c128c93d05800babd79da9f2c8de0c71377bfc45a60d8bf80ace977f533e19212bc66be2c6a16
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aUX:A3k03kHRJe
TLSH
T1A425AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 972KB
SHA256 a1b93966bf159b107c35b1e9d97b90deabb4a2e49353a7ad25396f0df0dc6749
MD5 2fef51591a3005f58af87d2933c2e1fe
SHA1 62b6f0761b3d1892f6c65fbb4974ccab3c38b2be
SHA512 78eb17d04544bc774514c28212c55072a365616f5b988349f8b02c4ce275f4b9614113f1312457370e381f43c0f43537b6caeda59cf56097f56f4b6f73fc627f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/ayL:A3k03kHRJw
TLSH
T19825AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 972KB
SHA256 5793f0f0671e4c9180f62fc025087ccd7637b8bbfb22a8c03e99c8dbe467b162
MD5 b5b365bb94dc92a7029e638b831ae1ad
SHA1 11650adc17773c096ef41dcbdc99cdc4757d42a0
SHA512 4b3221e99aa5c78af63356d1354fc5d3539bab50d750bd2ad3747a986d99b96213f51eac3c322e6a0a8c5258ae1348489e0072a22dd18f5cd833f7939fd1a7e7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/aWM:A3k03kHRJh
TLSH
T13B25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 972KB
SHA256 bb5fd132d017ee715fb2ee750119da972b84f0d86ad0db7115d576ff19f08690
MD5 f19215d964629367c2f58dc8b91ee431
SHA1 c11cfc6ff077b55164b4c294f44466fd8b660ae3
SHA512 d861560814e6921ae973b5b8929d4ab17ae6778a4d6e813b8be19df467bddfe6207db7d85829625c829357c30ac3cb21061d6b8f5f70cd1f207cc7fbacb94683
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/afh:A3k03kHRJz
TLSH
T15725AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3276-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5672-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5672-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads