0d1e2a623cc8ffa5348dd628d22e59dfdfe945f2dfff5a2a034d08ff592d0799

Analysis

max time kernel
116s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 910KB
Sample260813-e53yaszxhs
SHA256 0d1e2a623cc8ffa5348dd628d22e59dfdfe945f2dfff5a2a034d08ff592d0799
MD5 7b35cb34c5aebf41b9ec85db5cb94dc0
SHA1 a28ce9b3f25ea43523c16c46d8aa77fba550a862
SHA512 486a088bbf4a377fe98f607f402cd0de36b100876414115a6a85cd0eb4a62e3a5241adde93fe49a6e72acbc940998679ab3dbffd3b354dfddf551f4f43ebbcd3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJ9:A3k03kHRJi
TLSH
T11115AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 44 IoCs

resource	yara_rule
behavioral2/memory/2408-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4e3-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2f2-9.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2408-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1692-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2fe-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019c86-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188c8-210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000188ca-211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a59-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019842-231.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a56-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-289.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-464.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-507.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-598.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-629.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-696.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-739.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-777.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-809.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-858.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-883.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-896.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-941.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-960.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1015.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1058.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1090.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1159.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1184.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1191.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1350.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1375.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1404.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1406.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 41 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4e3-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2f2-9.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2fe-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019c86-60.dat	aspack_v212_v242
behavioral2/files/0x00040000000188c8-210.dat	aspack_v212_v242
behavioral2/files/0x00040000000188ca-211.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a59-224.dat	aspack_v212_v242
behavioral2/files/0x0004000000019842-231.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a56-264.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-289.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-464.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-507.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-598.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-629.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-696.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-739.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-777.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-809.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-858.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-883.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-896.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-941.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-960.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1015.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1058.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1090.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1159.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1184.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1191.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1331.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1350.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1375.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1382.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1404.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1405.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1406.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1692	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2408	2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1692	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_7b35cb34c5aebf41b9ec85db5cb94dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2408

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 910KB
SHA256 0d1e2a623cc8ffa5348dd628d22e59dfdfe945f2dfff5a2a034d08ff592d0799
MD5 7b35cb34c5aebf41b9ec85db5cb94dc0
SHA1 a28ce9b3f25ea43523c16c46d8aa77fba550a862
SHA512 486a088bbf4a377fe98f607f402cd0de36b100876414115a6a85cd0eb4a62e3a5241adde93fe49a6e72acbc940998679ab3dbffd3b354dfddf551f4f43ebbcd3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJ9:A3k03kHRJi
TLSH
T11115AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 791851c8b6fc83e4cb693de31e71cd69bbaac040869fdc9bd2fece9f9bc68941
MD5 5ad8b08d4d50c371c864946b81b80c93
SHA1 496e51b104cc28d03b10fd3a378753b176e371d0
SHA512 c74123fc53da60a209023ea6a034dc654f279500227bd999967d048e437199c1fa7a18772e05574ea2f7ccb182eaab2b3a9961b0974574d467c24f3d3bd69d37
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJJ0Le5ji0hmxNrM:A3k03kHRJiPji0Aj
TLSH
T1D2658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 924KB
SHA256 af2e9d4d4d7d916b7778cb59aa18ec7b2610db2e22a480d98e791e0583e81679
MD5 29210b476c581a10c7db672b26441203
SHA1 dd91547adf92c13be00b74336de7e6c5e2792f4a
SHA512 c8906f6bea685932ec557cfe79f2ddc80ce8005e3ff14ef2de86ae3ebe7e9aae237e00f56799f427c1f505ac0c43c9650f78003cb049b3c514f74f7cc5104c52
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJba:A3k03kHRJ
TLSH
T19515AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InspectorOfficeGadget.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
Size 957KB
SHA256 f99acd049a7ca5aa9458e1373ad89ef5dd5daf5ed0096cb5fec01a9d9c08340f
MD5 fbc8dc84b257c9d270cf1fa3bb52af38
SHA1 5247d7285d33f58871b636c5b8d536cd046610db
SHA512 d27ecce02aae630b599db0acd6e9057a1df9cf1ca1a4efada4a2c65d30f97b45de637cf7a746828bfda0f27249c3931afa542db2344d60fc07903f2fab427612
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJ4b:A3k03kHRJHb
TLSH
T12C25AE13EB9500E9D10AC174AAE58623FB75BD56277093DF2358C2152F62BC06F3E7A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 933KB
SHA256 1db0d657e4d939ade1d249903d878f5f0ed4ac698a3d5d9bd3d2819631eede5b
MD5 a6245a4705956d8165efebb7f5a9fe76
SHA1 c1caecbc6846e69f2ace79ba2ae9d2a51076519a
SHA512 4360827ed0985bc97f2120a59ace680654f1b1dddcc2d7642119920b70d47ad40c86af770b11c2788c71c61cea78e7998ea42fb8549c82438927ca5d0794e4da
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJjZ:A3k03kHRJQ
TLSH
T1EF15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 933KB
SHA256 ad952e3c895642db5c1276012b95ae99a24cf1eea19dfcc2957cd0f700a868d0
MD5 f6cc70b1d24cf8ebab33735fc0c3b3a3
SHA1 7f787fa3449aa35cb1c392d213c36f953a4e73fc
SHA512 eae323395a386d63917ff344c547601c72a72ecd820624222fa152254a8c7c0e83b91bd3f4ddd240c13c96875e08451d592b687c09f6d7808e0df021b243bdd6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJY1:A3k03kHRJn
TLSH
T15515AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 933KB
SHA256 bd03feab225f60474a84abe4b919db270bb57b63d932660cee8bc75f0b4af66a
MD5 c2a89628c888c6b1987bc6790d4bcfb7
SHA1 4b95e26becd89e25be637505be1f19cbd8790782
SHA512 6a5523ec52701473e643b65b7f76f08cd27d7375b1649634e22a7b49adfea730683bbf311fe47cfa8614e6c9c656b78380b72636782dc91baba9eabd4a19f7dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJ66:A3k03kHRJM
TLSH
T17C15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 933KB
SHA256 0357d53b16ec79dcca285657c94466ce7ab621e9c6ff6b5d600dac816ac8837a
MD5 30d05fb60ba4f9ae43705b5bf8b86b19
SHA1 ae1f8033519c58671f3ffeb2eea29d750dedde38
SHA512 a479d8ffb17fb5e1ab3de821bae6fe78194c843563031f568b07a5d1e9f7346e00ce561057e6be1b748f80b84a11737868cf1a6fd0acc4f7104a742bf3d90454
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJyN:A3k03kHRJx
TLSH
T10C15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 933KB
SHA256 0760d58d58a12fe45bbf9b4b96f316e4fa307032ce59d650ab2164ecc5a0d75e
MD5 a4076ab6c7310cd1cdc3bffbaa0d7191
SHA1 ef1eb2ac859e6ce9b017afb26b96957725cd1d79
SHA512 4779a54df76b4bb098c668eeaaaf20ca1541be391f8adffce4c94fab2870b9969bd9231e766a5c71f2b21c1dacbbe8b2b908e6aff4512c6035c3d7e8cd2fb503
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJof:A3k03kHRJx
TLSH
T1E115AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 933KB
SHA256 719f2da9ea8514e5d6093c1d1c31eeb20b7ccbf2d31ff6fe6f71047775da1fad
MD5 5c415f96ade557550229f5fd9a768980
SHA1 8d733aac7135c06aad62b3a27975e7fd9d09bac0
SHA512 10bf6e97b22cb56d5f85b1ca61bab152fe79c6b5fcdd32aa68e9615fc1c98ab12391bebeb8df033b404767d7a2d7f8f5ff7a1352c63836e85ea1ceaf38ec67b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJq9:A3k03kHRJX
TLSH
T1C715AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 933KB
SHA256 b2c4b906b8bdb3b9ba0ff91f5e378d7f407e5a19428f1a1d9d97138d0005a80e
MD5 8b77127fad5c668e635b1e5daeee757c
SHA1 b2a923c6ebf65c117cf1eb6a864f717a2615130c
SHA512 db6d8d4b365f7177c834c66692ed5630b189b356abf041c68139da9383235968ff3711f8391d56a0e6b588ccdd0a93d99f7e7d22f55e002c6e2ec8ab5bc65dbc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJqc:A3k03kHRJm
TLSH
T10615AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 933KB
SHA256 3136f9d8c1c2467fa8a48bc4d553d7e990e81a864e9db76b71d198fd93509b0a
MD5 61a0e2f22de4f9a847429c610206ae66
SHA1 df25692680e7370314a10eb7e110e2fa60914b04
SHA512 8bcbe618fdfeb0c50918dfab0eca2fd1ce29a20a33e2690fb89234b4ecc9702f154b5c70593a4c82db3e2066af77e07a8b5fe0990d8d4a581b231d0fa1e5e5a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJjp:A3k03kHRJ0
TLSH
T11515AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 933KB
SHA256 ac88e1801a625371caea729b02fe8ce64354cf2483b2f3a9b99ea04ce29ee953
MD5 a3a9a1e5162500debd0f46f2c66a92ce
SHA1 c89a02874df550e9335f35084e522f754fe0d8f6
SHA512 0d03f3b4df2dd4552f7437910ade088ac820e9968fa757defc36ed001313e08f6ab147cc78d6b54fece014fa2b3ba058a81135da90f26deeaf4029ec239367ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJEN:A3k03kHRJD
TLSH
T1C815AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 933KB
SHA256 6457fcfbd591dc34b1e2bf8df15b972757e2ba27f2bec669af21b9902bf1fd5e
MD5 069fb30b3192190113a722630507fa71
SHA1 2c930c094e0bc304fc2ef41e4250706bb5531f6f
SHA512 6af2c3a7a727af5fd1b3395664faf004f9df3cc846c05f975b0885e60d096beb4b1884a665867edd7e77c8d89310b31a17c8afd19cf2b941e9c4378e80b25196
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJsF:A3k03kHRJV
TLSH
T13115AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 933KB
SHA256 547d01d118b0f199d1678e6b42b8d739b578fdab13646e9eb71452f2638da15a
MD5 036196cc920f5da9ae5354241d253650
SHA1 111a6f80b3bda84a6f41600240f5903bfc1e7f6b
SHA512 825f4f4a094f920330f1c913f9e798e1f41ff8ccf140913fee3b51a8c9e94b8224e1d7d15988d3512efe9b7984ab2e31ae0c153aff1f39b2c67faf1ceaa7ace3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJZC:A3k03kHRJ5
TLSH
T10A15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 933KB
SHA256 07df985f27118fbbac24804fc251b8741e8d1265484e4ec85f60b717586dfc4a
MD5 5ac2b473f1815a6880ca0bb3b93647ca
SHA1 7d49c5488a7e43a911dcd7b12e6d23fb370bdce2
SHA512 a671558515dcad45e823208e6b327a2e54d36f61a7361b180e4613c40d612ac339150da3c07fe5aefedf8859793d7e3c1e953f02f8b8cc3f0ad81e795c8cad6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJaw:A3k03kHRJk
TLSH
T13715AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 933KB
SHA256 60e2de0e92b4e97e51d78516ae8750f12d0c7a2a211d1a93a847d6fd8ef517f3
MD5 8aecac470af47a98fd508c54c4ce146f
SHA1 b918fdc09ba09de4c2f9b7d3c8699d4ac0c49a7e
SHA512 08439e8b6a39bb519d65b7d93d8e37087c4cb11713fafe2cfddbae45b37f8ac994efa8f7008597e211d93ad7cd98dd8b55a852f748a1beb9a629bf4a828dc3d9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJhT:A3k03kHRJM
TLSH
T18E15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 933KB
SHA256 43e64fd1a55b7079d266ace08e248886a60c440bdbf27b59cf1b7bcfb1a10daf
MD5 412b1ad2eb90dd758d9f1c8ada8770eb
SHA1 8acd04c226ac9c26fa9575f42c53963c7f259691
SHA512 1ce446b6e32129134b1578ed3fd0db6e4068490e1c094757e243bd0990237e2db6548ae985942dfdc9d39682825c79aa7586c4f9b1e37dafd793daf2929bb94b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJPu:A3k03kHRJr
TLSH
T15015AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 933KB
SHA256 7146e1cdb30cce4e3de7d3c257efde77fc3ef24f5376e8d7e26f0a48ecf8543b
MD5 cd3a79fcbc338166b8ce5e01d3d4a8e2
SHA1 78b520cefb2b409fa8266d6c896bc5bb5facc9ac
SHA512 758407097918ea795c5fe39afff36b70d06205804656986821ba18b4169362eb907b7a1cb4bbdd3c075955f211045ed221c3c9ea38c255a9b2da6d96ab83f2ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJzb:A3k03kHRJC
TLSH
T11715AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 933KB
SHA256 6ef195127803dfc15e55e3f7763cbf47ea6677ac39a3436b8668a748810ee368
MD5 6f8ef26ee087c7fce28e2f2b1bcea400
SHA1 32f4edb055f511d5afff7a0ffedcf2d412cdfb0e
SHA512 d05316adf72f5803cf5fab081f6252ba4ca72e45e25fcf4a48301ad5017f0b8cc8ab5c667f5f5874dc3d96cbfee14ce65fbdfc7e55ee085b09fa7d803384ed0d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJHf:A3k03kHRJi
TLSH
T13D15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 933KB
SHA256 57e4d53f01b0efe67d5377ece1c8862933c0857105f08b4be0029b811ee63403
MD5 6732118f0b872306485739b0b395f356
SHA1 325abdfb759bcf385277186d975a55ed4d380765
SHA512 2f31996ab960196ae64165bbb24ebf252c2709f0ba24a42f84018fb25e58d78cfed88d9e977e656a30947437b604dc8e6d506ca77ce42bc5aa6b7795499402f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJwK:A3k03kHRJC
TLSH
T11C15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 933KB
SHA256 99035ad33017e14b06db409fb6160c1ca6135db11a3663549e3cf1f02977f10a
MD5 cd805ff944e51b5986d2d7548dbf355d
SHA1 f6c56c155e9e64fc3597de9b847cec93df084b9c
SHA512 6fad4499f2ab4675f2ee5abb22236e988c14ebea3cdc69dda332c8c2fe1df3f0e1d3d8f8bfd7cf982d306d0ee306a4927b46708bda7af9297223fbcf41fefa02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJtk:A3k03kHRJX
TLSH
T15F15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 933KB
SHA256 85d408c1dd45faf6dad940865229b12905fe2f7bf0e0ee66d2cd21223bb48d48
MD5 bf6eae539423b870f072c70e7761caf4
SHA1 e41b5db524bdbcb2ede0af57c5ce740feac8e0f5
SHA512 9dcf7fced1e196db3fca059e940834a31b740c3010044c125a25e7bfef8e5a61fa841546573666cad1e0e546fc48e3f6a3d327c7673fa1f9cf1c34336caf0492
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJy0:A3k03kHRJ2
TLSH
T17A15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 933KB
SHA256 f88be33fe96cdff8ef6505a1a6c8a119001d379ded0deaee61822ed3836f1c61
MD5 ec0bccc48fbea2a25d30a4da88b36b18
SHA1 69321ec93562d7b28760a5dd1c328eef65bc5e87
SHA512 2341730304349c92d1682da571aa559614fef2484f1c923f8879a8ef1b9aed623408d9906d3488a4bb9963b2eebc2b4a610afce83bcd2fcc38d1556ebca6d667
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJBg:A3k03kHRJP
TLSH
T14F15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 933KB
SHA256 f01ee27448d1d7aaab0239bb91ed720bfa49e63afecc75a2599c2582646400c9
MD5 9778be5d26c844b3137611376cf7dc8e
SHA1 e86ebf3382339cc65787822e7f0041ccd0e487d7
SHA512 315845a224521616f2af99e0d429f836b34875da8d3b2a05654ed78d5b2aee2771fd33fbab72e91493ba5cbe399c672b7e580177565e7dcd50fe38d68c0fe3bb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJor:A3k03kHRJp
TLSH
T17815AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 933KB
SHA256 782d21eb8412fc8763a8111ca1bbe20ebb9fe32e2d6edb23afd64115f482d557
MD5 e6260ac15d6a24ae2fa58dc51d43c21d
SHA1 8036d49e92079167631348f873733ba6777910cf
SHA512 46ccdea00a29c0cb81fccfc9c91e45f27f3a1aee7db8c46810ed88324db831b8d83a5ad5bf942b3439ef5e4d2537431c1324dc9145883b340194f975a4d5a390
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJGn:A3k03kHRJD
TLSH
T1C815AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 933KB
SHA256 ecd8619e66e39336c7e76f888be3730cc9a5576c86f75be53133fa030dce967d
MD5 66fbee6523052ea0002fbf678f8b162a
SHA1 4470d0bff9843f64eb947c790048d0f1c4b4fbb5
SHA512 1d3394d9a2e0dcde2b533bb8547cce32a77cf07b79841b89857d1a555e2f207e3983e306ab29619a0a0f1b94a0b94890983c26a711185d0fcde272bfd15696cf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJMx:A3k03kHRJh
TLSH
T11215AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 933KB
SHA256 79f284f60fcac819dd524cf9e9c1c9474b75e748aae7dff5d8a68cd3f751d46a
MD5 56248d3f082ef11274cf3edb1fb25e43
SHA1 ce2f3de030ddb0a36b2904201da2dafe11f298b3
SHA512 f1237e8d69eb3dac4afcaa298ae77a3a3e71735f3db47c987e49d3a28735a6a7fd1eac9e5a4fc61a3aedbec39b07739296bb21785e72ffb74c7c06fe9d420b06
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJGA:A3k03kHRJO
TLSH
T11A15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 933KB
SHA256 4e956390d73b9097caf303397ddc67f4cd8c13cb17c3f3a7938b2112ff4afbe6
MD5 28c3e923ae799cd6edd93b0453053b2f
SHA1 b3f338abfd912d44d4998c614498ab87ff003a92
SHA512 2dac04b8fc01a5515ad7740a722b0ca4adbf4205e542aca88071afbaaaf6e5920cd3180f7b55c2f1f95c56025f9a87c384016b7d6dd484d83b209b7e5d3d4af4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJf9Q:A3k03kHRJT
TLSH
T11F15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 933KB
SHA256 65abac6dd123956138ecac080ec5c70932ae9f22879b296b2008ccabd83b03af
MD5 3b2eb4c68c4006b13d4ff056f86a6ea7
SHA1 dcbfedce9ce5430804a5963a7ce4712a439bb154
SHA512 35cac9afef72955b1dcc2d2efa434d814f204b1ed3d9bd844bf35f6e8ef72244b41c07436609caf238bd5088d9ca472edb4e8eda321d7d3a8b0aa232e6bc10cd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJW4:A3k03kHRJU
TLSH
T10415AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 933KB
SHA256 1d8f94840895121d5c3d9fe532bc8d689d5e5af5972652c6e3082901091c78ad
MD5 3145119c25301e5d989eedfcc35fb6ea
SHA1 4e8f1867cf9a005d440100be1c2c8e7d3abbcf1a
SHA512 761fa20cc58917f1f43098b6b3c9d7c4b5984fd411a6f37bf0e7aa71eb9a302d5c418a569f18d06a154f7e48973773a65947f2e6409d804b23c10546bf994c82
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJFu:A3k03kHRJF
TLSH
T12215AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 933KB
SHA256 22962b0837b18d3c32e7bdddc756603800709789568344aca7f1d76c7353a6ef
MD5 b8affcce87ce8774ed9a83dc67455ba8
SHA1 36c0b3604a14b940dda5b44ce43255aad90bfc74
SHA512 0b426aa20cb0aeba198c92d57399c75aba21bd95ee1bfb2625c0e4576bc09cf6ed9c5316baa3ae017860dab8427556ec80cb3a73f458dc97f9a003e7b180a52f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJYj:A3k03kHRJH
TLSH
T17615AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 933KB
SHA256 21760f1094d1cfd0f11f0c7837ee276719b5643cb8b52dff989c9256be1e9e71
MD5 f789cdb5356dc4f468f5f76dc95272fd
SHA1 49f3adb74714f12648d41832e2f9c639859451f3
SHA512 389c23f7994265782469f950b8ed3ddb0bbb56544040a5f3553ea903e76baaa2f5cef2de06f15fcc8d63ac501fdc946cc491e8b1842e3428d8263c588d3ecada
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJpg:A3k03kHRJv
TLSH
T1BE15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 933KB
SHA256 c8550b631401d4f910fd6a5c2e9a70fec6ed5ac3633553352808cd6e8b6d66c1
MD5 96e6d31d0cc71af2f94ee214662ca4b3
SHA1 2844d0e2cfc9a409fec39550e040489686be6e59
SHA512 a09e6b6431ebfed6206b4e71db4b74fec0e53441ae806bd415de1d4d654853767c069f0cd84dd8aa605fc692b06c381c59091e29a49c7506561676c5b94246fd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJwI:A3k03kHRJ+
TLSH
T1E115AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 933KB
SHA256 d135d227887bb085f692228859cb2e91965a48d28496782737b3cbbe24d35c9e
MD5 84698516f123fb4f5f1da60990b7feab
SHA1 9bd06bae681dae60c381233c63de777e48040f79
SHA512 46759358aba55fe409b22da22252b180e975d76d916b55d4ffe7c8c82e9ecf57314ddaa5770a5d4b7d4a3662bdfee923050c0d34536ab47353bdedee6f953aa6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJyo:A3k03kHRJ8
TLSH
T13D15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 933KB
SHA256 74aeaacb59d472735da8ec84ed2e4fcdd59ba821d612c32039362a54fc80b8b3
MD5 95a938b2da097abc428b635737c0f4c8
SHA1 91e86b142260afc56a413cbb682caefca3a26efa
SHA512 07628309d12de628887c7fe7a8ce5c086f8a9cecd33e1998092e03a6790bcde640a173a51c8b5052b3ef3e60d76712302568e3545815f2fac9c3743cc10253be
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJp+:A3k03kHRJx
TLSH
T19215AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 933KB
SHA256 06b94e5deb3ca756579bb9378e7f50d4b2f59526219b97ae01c25d659ee20aa6
MD5 f1571323dde23e0295c6c1ece914d6ad
SHA1 8e24190e36b693087d4956229efd209d6fd58a21
SHA512 1ff7d0b3c7e0520339cf371487ecbd340a5ce8369c5f3a6f3a9c9a9d893a8d0f8c9cbf32039919942959d09f1d9212021baa6e6ee56f17609071a28bf167e7c2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJXQ:A3k03kHRJx
TLSH
T17D15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 933KB
SHA256 ee1cd451f64376d9402fa63680add48e2b6e5feed466d918a9015a3af744dbc8
MD5 86cda2f0a7196f5c421375b98d2f501b
SHA1 ef601ec3588e6274cd4c5840eacb01a08089db16
SHA512 454f916eda652b72117b4c1f07ff8c159d56eb2c4a4b4338c95b5f38b2cbc0ba65698b447741d65886918e85c14e668c0b9315278c8c24039dafccac45785b1d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJsX:A3k03kHRJ9
TLSH
T17315AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 933KB
SHA256 a5a23a9d14f8360ced06ac2e2f150d183ad996a51e8a0a716215ed63f5fcd20d
MD5 175e08c1f33d4739466f12bb05510e32
SHA1 cf4175381a1d67f9f92326974eb46a3093b7acb6
SHA512 94c2767d8be6319b5b8e0ebbe5388dcf3a479ee55e67a1b42ca6138c809d66591a29adefc7165c2dab257fd4cc032e7cb46493bec899a8fcdf9557796a2d1689
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJKL:A3k03kHRJ/
TLSH
T1CE15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 933KB
SHA256 6e2f27d2b0c1f1c91602d9e071b694cf9b24c22fef5eff7d35947487f2b7ab93
MD5 34e51177c7a444b1bf255c4849f0ec57
SHA1 25902ef6b843a1b67a09ec32e40f5896c4712408
SHA512 0df1d844ae5e2cad55c2fb3243d5f7b92a57f0ace170d1d5c8825a140c3366bd321f0bfcade21cbbad05dc9451bc7ca1eff49ec6dd488c6eff42ad1a597502a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJuM:A3k03kHRJK
TLSH
T18D15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 933KB
SHA256 869a4f9c213aeb565ffaf155b3f12e486156611dd63811fbe636aea41a452e1c
MD5 59d7ffea873c97c218dc8257c04884f2
SHA1 828fcbfd87b3ba525b858186b5bed8770a386b97
SHA512 360333459816a19b4c3398656d202871ca96f7c4ae52dbc129850b760c0d72e5b44fbb7158cc7771d215666284f131f5ac9275204ccd0224ba7e3021fc2043ea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCjNSJ3h:A3k03kHRJE
TLSH
T12915AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1692-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2408-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2408-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads