795def389cb4bb522ffc8cd82fc92759a96973856a255a20d7c9a8df3f0e4c03

Analysis

max time kernel
96s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260811-ce7gpashrf
SHA256 795def389cb4bb522ffc8cd82fc92759a96973856a255a20d7c9a8df3f0e4c03
MD5 ff70f8c9bb2a15fc44ebfc2f35fb4317
SHA1 566f7c1bafd12751b053971f62abede4736a531e
SHA512 1070b3c133470808dd264903d6a6b604428d31abc4fc7178c17d8a7229bc084cf0c11c6c5806aa4087933faa408b4f8fb6ae040ddb5ac4c89584cf4fcb746511
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJw:A3k03kHRJ/
TLSH
T12325AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/4148-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c525-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4148-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/352-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001bacd-138.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-267.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-448.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-503.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-582.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-692.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-829.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-860.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-879.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-898.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-911.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-937.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1067.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-1111.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1186.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1345.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1406.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c525-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x000300000001bacd-138.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-224.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-267.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-448.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-503.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-582.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-625.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-692.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-741.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-791.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-829.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-860.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-879.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-898.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-911.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-924.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-937.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-980.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1041.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1067.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-1111.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-1148.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-1179.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1186.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1223.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1326.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1345.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1370.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1377.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1385.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1402.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1403.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1404.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1405.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1406.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
352	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\wab.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	patcher.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4148	2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
352	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_ff70f8c9bb2a15fc44ebfc2f35fb4317_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4148

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 795def389cb4bb522ffc8cd82fc92759a96973856a255a20d7c9a8df3f0e4c03
MD5 ff70f8c9bb2a15fc44ebfc2f35fb4317
SHA1 566f7c1bafd12751b053971f62abede4736a531e
SHA512 1070b3c133470808dd264903d6a6b604428d31abc4fc7178c17d8a7229bc084cf0c11c6c5806aa4087933faa408b4f8fb6ae040ddb5ac4c89584cf4fcb746511
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJw:A3k03kHRJ/
TLSH
T12325AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 56dfd411386bccc5978af7cadcbf0a5822a1aa0d81717af69193718f328ebb5e
MD5 7e8b4f4c5f6fd0928c34b3f8ff55f139
SHA1 8af0e0e0026f06c9abd18f03e6d3f5e5d60e1d8a
SHA512 bb81dfed61271d1c5ab27bf2395d0d8d63768c0688387c55ccff60c029452504a7211f55b894ad48bc70609ffc06c0533b925da8663e417cc4eb1ce08e3bc0da
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJI0Le5ji0hmxNrM:A3k03kHRJrPji0Aj
TLSH
T11D658C17F6A402B5D027C1B9C5D6966AFA7138821B3086CF1359C7283F63BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 f92966f9efd3383d9bbe40eae55fbeb02151df633515e38a39341746b8d7e150
MD5 e5feb339a1db71f9d81f8d293400b756
SHA1 d4f8e4de3b395a8bffcaf5323ac4f226823a82f3
SHA512 1c5a3304c36995baaa0dc2206683ecd4636a02e1d327c717f0ba23b6cd20b462a58b34e4e6e4740227cf780b84bf006d8a9e4b94e785ead4fa4da58ca35674e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJya:A3k03kHRJ
TLSH
T1A425AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 1.1MB
SHA256 12bcd00f65de2bc7092ca6dd406cfe5ec8c1ef4498e92c7f2a7a91d35115051e
MD5 cc8879d0b63a3e1afb4147ab94e03fa5
SHA1 9a0f8cf2f7dedb0afb5cc84e1eaa44319e412196
SHA512 6aacd16dc342c7734824cec85f96eae47396f210939e3a0581b3cc9b2d514ee51ffc2230af5c8b6d8f04b7a8432f3939fb0c204d77f00678af37ff35bf72c60b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJ1D:A3k03kHRJ8
TLSH
T199355907E69400A9D10E8174D7964A22FA777C5657E092CB23D8D23D2F62BC06FFA397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 8e6dccd6a848f4ad51085cbadc0fa587e7b5838349cfb0a18b23adda273cafea
MD5 20b9957e78fd829b1fab1bc291f1903e
SHA1 6b4506c3d513f3e4cf9ba318d4d536ce8d3d7f34
SHA512 e09b215d2cb74b062b55133f73d1603dc203e234ad84781ab550661e5eb2c765d63dc96a37eae6b90c02d573de581372881a3b69d4c02d79549e9643bb8318b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJD6:A3k03kHRJz
TLSH
T18E25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 971KB
SHA256 95440fb5f81c0308e5dd7ce6dcd5b29721483dee1a0434a255fa44feddfc3d07
MD5 df7ae0d06cbfa2758e627ccda3bb0085
SHA1 9f0c8b1dcee91b91f5de5d30251b74ef042f4e16
SHA512 a1d1412017d0a548ea7ce70a0075753d8490196d84ba1b48f12601e137131122a69c87535fc4b3c2ca6bc4eafbe782ba3785209ce2dc7572c0fa3f1c24bb3dc9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJtN:A3k03kHRJu
TLSH
T11025AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 971KB
SHA256 108a943e525c519b44d6468c1d44967c02ef51ab35ee1bb004ba3a21a8a48550
MD5 59badc3c3d828898c1f7ce17b1a39863
SHA1 8cb6f18f71cfa012392c24774c8a3b4584c211f5
SHA512 f7daa3f1af188f0b78807bdbb17d7a47ba4f4973db817361033842dc478f9511f6dd8ff396a5908e71b1b8086d392638bb209157abd49e47dd749b29f67b52d7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJbf:A3k03kHRJi
TLSH
T10925AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 971KB
SHA256 aa18247a80bfd055cd12ab065f70ac8fd27e6182040899a1f746d9cc0e9d5718
MD5 d1846f966e74c0b01a88b90b5391dbc8
SHA1 032c7635d4a7047c89c58045aae218e322417695
SHA512 538d1498bbf71c908c7c7ca3c54bc7c3495ae78c7943add2f03af57302a23d0a63bdedb918ceebea835a06f97628edcbc6467b41ddf73d6bfe86f3ecfe3fae6b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJNo:A3k03kHRJr
TLSH
T14625AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 598ea25a280e5697b73dc873de6e5b0114e902e62122171cc6665b890de53dc4
MD5 2038b26ab9f1bb20bb8be7cae6ae7c0f
SHA1 d1b88ff148422e0a0c83e9cb46df6650e7b5a76b
SHA512 9445abcb7fa1170590cdb93959e41539a6c0339d031158dd1048fbde4c67afe76f18c960835dcabe5b96f597a4eb86070ba6aa27bb32b406e8caf1b7905952d4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJNu:A3k03kHRJN
TLSH
T14225AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 fbbfda50759e7f6f4c85877dbb398263b9a0ca3fc26bc447a52c96ae33056cae
MD5 18e0ea0ccb39a70c8f2f3c0f9a626e81
SHA1 a06a5475ca9d4aff14c3dd2592ceb4687efb87fe
SHA512 fac190a76adc74a82702e2fd4ded741cb722e82c8db694ad07e37d6e0e7f91132186153ab6dc064e88f5a3ba6aedd13710c545a645dfd7b7731a6892045de2b0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJj9:A3k03kHRJ4
TLSH
T18525AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 068fab9441b634b58fa9563d9556d9f2b3ad24ed160e44da1d264414570d0708
MD5 50f69ddaebee7d6e191265ef0e1f4bdb
SHA1 58b49557344c2575df0aa3cc1cfd9c333cb1e527
SHA512 a013e94c753b7f5d0b5920a58b413fcbefcb03f273fd5aaf52f435b75f8114fcbc04b2c5970163b0a3bb956211de93f716a969c8a7df98e64060c86fa9c70a8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJPc:A3k03kHRJ5
TLSH
T1DC25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 e7aa63a98f18d890a30651d9059bdb16b69867e46e4d01eb9d4cd18dfed0b04b
MD5 3c5cf0c57a85ff8da424f7fc0aa85acb
SHA1 08ddb018b716eda39d2a6a9c6724e492a8b8e8f6
SHA512 1841fc3b7f12abc36a13a56fe5a812043d427ca758957a6d00156d037fb5153abf42ed4d5e4440b1a0140458244236f665256f7ff30fb8b481a540d12632475a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJIp:A3k03kHRJ3
TLSH
T1FE25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 d359a1e7349e1666ab02a26a3f9945503c5f513ac9a3db565cde507f505587a3
MD5 1039b3f73c4ab9bca7b76db5b0f26ee7
SHA1 7759118e35a75b4b043edf7037dd04018909dab2
SHA512 fe93605510d9a1c6ca6d55b297965a8fb7eae818a74a6e14e77debf608a7909e5226541f8027ca86486b0ebfa84c9a8a1edee6392c87365e8b2505ec98a9200e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJfN:A3k03kHRJc
TLSH
T11225AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 a25cd81318bcb330185eb9fdaaf47c1caa70759d6e4196584701e132da902b03
MD5 77bf0be4f24caf8725dcfad9d2aec6af
SHA1 7a62799872087cf7d9a4d7684b20e1af999394ce
SHA512 77ef51ed8be1802ff6b4ee92d00254bf5fed1b36cd352933b25668d995f34c88923cc0ba51730f036475665f7a4888d94ba4894c07e4df97d25a2a6de519e250
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJdF:A3k03kHRJq
TLSH
T1BB25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 070e5ccda06ed2979a67fe67948b5d5d9256f0a2457977f5ab017603f258d7e1
MD5 fa62d8d34344db54a442844e38671617
SHA1 650158c3005d4ad8793fe7928278e7c8c0b67dd9
SHA512 3fcef63c8d9ba74384138b25f7128969d07dac22cff344c30d66cebd090f9c5c6d2c815b7a2bec9857abd3548e18a0747a2c7e592aca7e6a53da0cac66397da0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJuC:A3k03kHRJ+
TLSH
T11525AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 021929ec00d2b5f9cae277d82d97fb06c3f2cf71b161064c381c21e22b405253
MD5 6ca26310c1e323c5b1095e82cfe8675a
SHA1 84fa3c58c5a70cc598dd49e20e31bc417e8637fb
SHA512 30130be36e0f43f8e0cadb0f3593e0c5bf7d9d9b09f318e07d43899eb857f34cb84b4b01c9a0961c37b3488a130b43eabc97134eb3d2d6389aca7e1a71f477c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJxw:A3k03kHRJL
TLSH
T15725AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 47c93d0e2cafcaf3ccbed33577969e2c683cd21162407a9271cbce76c44bd1f5
MD5 f1faf6b2f14ea414d79d28c0b3cf4ad3
SHA1 2a1f141567e73512975b364fff196b0f73862f5f
SHA512 dec797a964387587274b28819f1c0e3e6afb93eeb54ef85ac3bf1c433f989ebcc70b5b611219fb378a2c11fbf07e463ca511ca3dfb44ca53cb9e2faf18e812d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJYT:A3k03kHRJ3
TLSH
T10025AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 cfd2cfdd51de90c1d71672fff4b72da4236337f901eef3b9962fbed5e745b203
MD5 f96040efb32631376f72ccd2df0e5f9f
SHA1 e9b40732ad06d4441d721f8516a5267f5ed779c2
SHA512 f95c331eb15d9cdeb4fdfb4be14aa394bb21d0b8c18299ee8aa9a0d1e1d48e4b240157a4c53d4da97aec563fa0d95df40ed2ade7ec9f8feb769ace75112f50cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJ0u:A3k03kHRJ4
TLSH
T11025AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 f8ec64fe3ea898c548e2627b12eb73f0232d5aca57a50d1c57d1f9e9b1ccf7ce
MD5 e23d8153b0e539c3139cf4f0bf7548ae
SHA1 20676f049ab260d1fa84a0ea1e254bf267cfeeaf
SHA512 a6c066eb3510b3a13c120e3bb9b5340da4fc35a44882a202ce17196e61ebc81975f325452cc09a352af30e78696164e4b924938f62c46231020537a5f3deef5e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJib:A3k03kHRJh
TLSH
T10725AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 78cba8d7867e37baaa2e913e840a2b014def2050936d58d141cc2df5286bc15f
MD5 26b59181f66be09dd8938edcb020ea71
SHA1 c7bbf49607106ce414ba7107b58354f7e153fb7a
SHA512 32e72ae75efc847ae2f80e39bfbb3cfc5bf1b3e39872ac3aadd4b6151a09e7073f25c3feb9649e91661e36a2f5822b4248b2f309055091f948785b364ba2c263
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJkf:A3k03kHRJh
TLSH
T16625AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 5299a41b9cd2191b1fb2881a9a7ed36c2849b3bb3426ccff5a42144138cfef18
MD5 014849f75ef0429e0249f67d542c4170
SHA1 d04194f6f1fe322206bb2fc03caff4ffc3b7edd1
SHA512 aec757bfcf44613a2e4bee0b56f64afb50e93d61b0d94acf782e3a2c546db3330c91c7ee9d0832742ee3767ca95b028227002cf9861e6b296a312c8b9993b778
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJBK:A3k03kHRJ5
TLSH
T10F25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 305c139c832ba5077a7b3e127ace16ba6f5df779eabf11f5f0b817b6835ef1a9
MD5 d42601e2b1fdfa69667097528a973a5d
SHA1 e2dfccd14e5cd78a3051bd78b3931d6cb39dcd63
SHA512 9ff70a0f8b05ac41bb48074726d7c510e095d7d4a2c2d6031cbffc149928da2d56123f3d24b19fc3ddfe59b9ebad1a43e79984f16c3acb896f3bc03bc761cc59
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJ6k:A3k03kHRJw
TLSH
T1CC25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 2ec75e2d4cbcceffdacecde4e996650863eddfc7dbd5d802f8cd6b3eac21b0db
MD5 d4a3d66251bce7e3216c4dd4fdbf8e56
SHA1 93a44ec5d2efc9cace5f4ad44b38a3dcee3286a2
SHA512 b6068c821fbc863909e6ba0de176beb048634c57f82021d139abf609b2041517b3c3d6805db63f2ea0c6a8632dcea63b3edecaee4da7c2e6ccda6fefde40ff48
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJf0:A3k03kHRJZ
TLSH
T19125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 5dd3b3fb470b8ed028614d598774312c410df1a71ec9dd5148a21cd7c61de32c
MD5 1f3808ed40401b9eb321523539e034bb
SHA1 74a200c8a1c72c3a2cc251557d7a05cb3f4fb512
SHA512 713261517667d59abb803e881a70abae51af7d8dd21c92bf4fcd6bd369fe6d1f94f73c7527ef3a93575e7507dd3cb9da6f578433183000a6a0ec040f341d138b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJug:A3k03kHRJI
TLSH
T18A25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 e12a8c130643081abd75ae07613dea053cbb27f784c937e213fc1242b1b41b1e
MD5 c61be42b34016c587c0c915fcc57f283
SHA1 8c16e4889049ccffc87b12f260cd42403970b53b
SHA512 16bb0a359ae47996583395bc6b42af2ccc55ba39fc22be7ec761a0d509358cc13c1c40a5abe9ef0a266b39326d732e8723ea447a6168aacd97dfe13c3db5b733
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJ3r:A3k03kHRJy
TLSH
T1E125AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 fd84458b85417b651a7535eaf0e09d68a08e45929e847d734f8cdd3faa03b502
MD5 ab14801e62f85aca51a7bf8bcad834bd
SHA1 263ecd40d53035cbc1bc952d8e78955f5ae20969
SHA512 d4e610f35ee1ff1abee617dd72edc8e9dd162ae8b9e3ea5aa68f74c479e31063ac374f13f07b7a9c78b48607be92b0342737b037676b60f9dde271d11dd15d21
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJBn:A3k03kHRJk
TLSH
T1FF25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 fc77df852a9ec51cda40fb756c880775f44162885ff36bbd1a7bb004d86dc155
MD5 113cd8705bc72bd1572a4823b21d5432
SHA1 b6b98d4f02331697516ffd2c99c20bc0a7af7ae2
SHA512 2bf37a37e6b7ab7acafb51a985bc3f31b4a9038ee1c6eccd09880fd12a598313eab178a1fcf3ecba75dadf354747ced2cf3206254dc2caa8731ec2b8d7991734
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJtx:A3k03kHRJC
TLSH
T1BF25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 8ffee8710621c9da40eefd10302e3f14b6eea8d5f820af972e4f4af484dda88b
MD5 e3e134e240cfd77f16a22bd38e01ec74
SHA1 b224e41a68c26ac9bcf78516b7409bc1a6b602b0
SHA512 6f803b386135321b623beb1f8f740c318622c2896e24d31a79f9e3929f38d485078340e86b89f2254e2752d5df2c1d0da90b070890914d4f5763d2fa6d9dd0aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJzA:A3k03kHRJh
TLSH
T16A25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 afeb60c0ede1d3e7875a48c282b73bcbd93703bb6adf8ecdc7f3bf2b76438ebe
MD5 bcb1b9d691c029600bd80529bf74887f
SHA1 854d93c9cccd3484115fddead507e3733be9b7ec
SHA512 b78cfd94e4c5fe892fd5f1caa07077f95c2d684cfcae53f8f2004cb965a7dc34ef57649a1819d2fa3eb8d1f38a29e642a693fc116fdc176a9d8f3e7b5d6f69bb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJE9Q:A3k03kHRJY
TLSH
T11425AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 8f6c40a61f5eb759ae0f9d69a9d6b7a5d064fc5eb3b3448097b18c8c00cc260f
MD5 44b55fc02bf0d38a7482c6f6152e68d6
SHA1 4811b242b7cafc5d0d7a91975625cd574a8fb485
SHA512 b949f4057a423612f2117cc6faaecce16bed5a85e125640cdd3fe0a0fb70a54afe7d0fa989a2e7358e26e9cbe1304c60f1357ced403daeac8ade10ea40279e4f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJd4:A3k03kHRJj
TLSH
T1A225AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 533113011c77666da128ce9d4828435994c3a46a78007c071e92c480c89e0a9b
MD5 81a0155083ff269900f8b3d1eb9872b1
SHA1 22bb5bdf8937ffe94e83ec26751332fea2ea6d5a
SHA512 b816e7615ca64ec87c7db10af51c6a1aa476d437d590516c655483e56c9f8c0a29d091e86999778344640c7c6e4a68289123a849ac02871ea9e04c0ae5d0b986
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJ4u:A3k03kHRJG
TLSH
T14A25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 003744f18961c71d30f07b4691e43fc1cd2ca545749aeae5600aaab557cbeabd
MD5 2280789e364dcf69b1dad95bb04193fc
SHA1 447c3f3fb633607cd146392763087992bc469f3a
SHA512 a3726ef9491c264c72bd4ada9b0d28d001ab85b49adab83b0b8c6a34f5572439de97cdde0dadd13e86079e9f095a3b02023165d0f188c9b1e12f94935c109a1c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJZj:A3k03kHRJ4
TLSH
T17D25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 14c96636dc4ed8f9e51d1db38fb30383b98d9350c123f49a8d2defba2d973570
MD5 285bba1f7e378bab4138f8d19a31224a
SHA1 a03087058d7f2cc85e107cd009d488744959da60
SHA512 45dccb4875c09f902236c0106e9bf78e273e153026d83bd945b1aa794422562ea1867bcc82b633135f4a94611e828b2ae8d53a626c418828ea21d5277abf1f0d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJAg:A3k03kHRJA
TLSH
T19625AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 03af2f90df44e6817edf70ea9167e80409d9c9d92f8b9c193ca8508e068fce08
MD5 5f3bb346a7daea8c4bd9c19578786f0f
SHA1 c52f257b9f521d22f5b935d2275ac28c06649a44
SHA512 770d36fb619f9a42668856434e76c2db22628f67cc6faf71ad3fb834ba5bd1959f8bfa8084ed26ef25ff4c33c21aeafd9239bf456565cfbaed3e469949c1b761
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJvI:A3k03kHRJB
TLSH
T15C25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 03ceb5f365495321176061ba3ff8be9d63f4f2fd0d99b11241863519b99fc65b
MD5 454f6553b4d83f3bb2e2122ba9dbf52c
SHA1 1deb4ca04d5787f503f341a4d1ed3c1b2f83d3d8
SHA512 bb9474d77cf9a2885f4c2838f5a03c83886bf3e4b10a6d6dc67a6b0f214a8170e7cd3e19740c2f2fe9f573c7a521ccdfa25588ad42076d31bc6d90a3ef8454fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJVo:A3k03kHRJf
TLSH
T1C925AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 94b91ac57511e166f2f22d5a30d16b984b7e8f5df30092cdd4058d63b202827f
MD5 14ad80e03166bf22c8c9ced6d3409873
SHA1 06933da10e32d16b45cdc1b8f33780c36a686e18
SHA512 92c32ad871e6da69835bd7a1354ad6f431b654541fecdf0f2ad29e1aa12470f742f149c8dfa9b17288ad09583efa706785dda282fc41394b8c39c877855c7f92
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJG+:A3k03kHRJq
TLSH
T19025AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 0ba80148be49b6781374d37e7dcf5713c870e706f8007239d8da0c553b7d2cd5
MD5 26bedc5773f3dddc8d723517cdc0df2d
SHA1 618d927e6d51ea1aed69d36b21cfdc42ac3930fb
SHA512 6896b6d655284d9583e91b65f42646c01bc1aedf80db9ef87533eca2442869e02c6b57ba8add7da6f94fd3f68488786240d345f74ecf7132efbff948101135a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJGQ:A3k03kHRJu
TLSH
T1E825AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 9714642cef1cca2302aaff3ff0fbacca7ab8fb702cd48d337275781d31879791
MD5 d08354cfa82261d4727190a2a461e325
SHA1 991900ef810c8d41413a3edf74029609a48c8728
SHA512 f4fce56c2b6f2e5a09a410d76907471058972959f8f7896867bc470ffc92a2a440776e92e6035045f59d2dff34e16254bd58b8eb86e075bf8222e90c3d709a34
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJXX:A3k03kHRJu
TLSH
T14925AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 b8221627fa42a39adb7c79734594eae8bafae37ec01ed54cb87fc33c1bacdb09
MD5 e8962d7f351d92e791db6640b0c43692
SHA1 f8e625e619a99fc4a53bbe9774877c7f0bdd77d3
SHA512 5716128d9f39269f4a1dcc59fcf8bc592ff8b2cce09d6a45fd4de758f9e0fa522dcfbbaced224795d21549d7665afd7460ccc83722976ab5a1250401a49582e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJNL:A3k03kHRJA
TLSH
T13125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 8840d21bbe87173716119b3bd7a070f19d5559d09a51a7affee99d33c471db71
MD5 580362253f2921c09ad01f86a4545556
SHA1 bf8ddbe5f17093783f564318fa03bd0cdfa69b46
SHA512 41a3421d5bab04b3b573056e0ff7ab9c5bfce3fd6cfb760da90e85a2aab57513b1f1e0c37755f7a9655aaa1ce877a4e98532568804c2fd2ac350df6f0093c104
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJLM:A3k03kHRJR
TLSH
T13725AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 d0a3ca49afe8270cd18f748ca880dd776e0229896485b66349196b321182cbc8
MD5 53031a40bf11beccea39a0a3a8862f1a
SHA1 8cac017f5540e2f9bc1dd4151a16d76b5a1d926d
SHA512 1c3bb8f1672c3f072e7c0f5f1d122166be708b1bc5f66a2d81612b23fd1a634eb408dbec67b31a630afe74186938e5fe08b5f7a7800e87ec370b009470bb948d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DJMh:A3k03kHRJj
TLSH
T15925AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/352-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4148-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4148-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads