6ed23cb56edb04c1d486620c271efcc73f4db31f91897d5859aa31d05b1867f0

Analysis

max time kernel
108s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/09/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260922-vbzxjsag66
SHA256 6ed23cb56edb04c1d486620c271efcc73f4db31f91897d5859aa31d05b1867f0
MD5 dff17d70775c06cf06140c7ab98f7428
SHA1 f2f4c0041de5d513548f7e87f671a2dab6f8164c
SHA512 57f1b11730ca8045ec70bae600abc2e564d5389c1129e320842f1ad5a084b6b86fa8ddac4dbd234253a7f9a70bdbca3892a46d3b5c6d68a12d9026e52b7275c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavC:A3k03kHRJARJK
TLSH
T1B5259D07F79900E8D14AC1789AA69A22FB757C561730A3DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 46 IoCs

resource	yara_rule
behavioral2/memory/3312-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c587-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2da-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3312-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4400-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018987-199.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018989-206.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0005000000018a67-226.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019857-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-241.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-248.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001898b-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-280.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-299.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-451.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-507.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-587.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-674.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-740.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-771.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-808.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-857.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-882.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-895.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-902.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-942.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-961.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1016.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1059.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1090.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1139.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1158.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1183.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1190.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1344.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1382.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1402.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1403.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000000015b-2160.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c5a7-2159.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 43 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c587-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2da-11.dat	aspack_v212_v242
behavioral2/files/0x0004000000018987-199.dat	aspack_v212_v242
behavioral2/files/0x0004000000018989-206.dat	aspack_v212_v242
behavioral2/files/0x0005000000018a67-226.dat	aspack_v212_v242
behavioral2/files/0x0004000000019857-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-241.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-248.dat	aspack_v212_v242
behavioral2/files/0x000400000001898b-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-280.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-299.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-451.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-507.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-587.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-630.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-674.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-740.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-771.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-808.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-857.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-882.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-895.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-902.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-942.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-961.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1016.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1059.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1090.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1139.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1158.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1183.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1190.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-1330.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1344.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1363.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1382.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1389.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1402.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1403.dat	aspack_v212_v242
behavioral2/files/0x000c00000000015b-2160.dat	aspack_v212_v242
behavioral2/files/0x000c00000001c5a7-2159.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4400	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ieinstal.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnscfg.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3312	2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4400	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-22_dff17d70775c06cf06140c7ab98f7428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3312

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 6ed23cb56edb04c1d486620c271efcc73f4db31f91897d5859aa31d05b1867f0
MD5 dff17d70775c06cf06140c7ab98f7428
SHA1 f2f4c0041de5d513548f7e87f671a2dab6f8164c
SHA512 57f1b11730ca8045ec70bae600abc2e564d5389c1129e320842f1ad5a084b6b86fa8ddac4dbd234253a7f9a70bdbca3892a46d3b5c6d68a12d9026e52b7275c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavC:A3k03kHRJARJK
TLSH
T1B5259D07F79900E8D14AC1789AA69A22FB757C561730A3DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 ac4a8989d5c0929098d580df6d00cf2b6d7c9f0b1f71b0052220fab742028e0a
MD5 9ba7c3767795c910fdcd2585e3efd278
SHA1 046990a80421d6c81e7bdd43765b6354beac7f45
SHA512 3b3d1579b37e91fe8c5c0e16ca0ec0edeffb18c1f0279d46a21e79d6f176580ba2e33bc0ad5fe7bb325724ce377113660f62532373aa97f2a4dd740f75753017
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavC0Le5ji0hmxNrM:A3k03kHRJARJaPji0Aj
TLSH
T100657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 963KB
SHA256 f52612ea0e1032c06a408d8012954e75a3382dbf472c5564eb4cf708c93c1a10
MD5 2f27b38836f552deb1ce99261f23ceb9
SHA1 ba79450d88d6b449ee91ea574eba57e95368229f
SHA512 8422de8dcb613f9362e5f980ec60caf028820736994ba8b6c4867679221febb4fb9d69f8a7866ca042e305e17c0a2d59be511e4c746c115fc892093dca7e9896
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavGZ:A3k03kHRJARJY
TLSH
T1E8259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 963KB
SHA256 1ee687115b4619a0aa80ab0fb0ba530920434cad2209b8d44262cc6070da77e0
MD5 902fa8b98850c7c34eab22e6eac1349a
SHA1 56d39bd85b2b13e1d50ec33c3fd12cb0a3579e83
SHA512 268808a060d670bc9065ec94ec0321f558cd9554a4ced520530058ec3b46f8809133a51d76b77e21c8a25dede4d7b863889d317ef0b730aa003bc544b55d9ce1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavx1:A3k03kHRJARJP
TLSH
T159259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 7f03ffd0a8306c19c5699e5a7bd8352f8a4330570c664e3d736d789bcd9c1d19
MD5 7417e75984744d76bb0c629e0a4398f0
SHA1 4b405f834c1c80b588391e16912f02888ace82ce
SHA512 c9869a928b15c51e13dc8e39a23657f82d716326a74658f27cb58ec10a290146c3a19a2b4ec70b73f84e35daf7d954f67e40c82f26868a8a9cd8e495e77db961
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavl6:A3k03kHRJARJk
TLSH
T146259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 678c592afe4ff8fa6e386a821a48d22ea66432a1f00b60e7da9ed4aadc24809a
MD5 209318c0b7fde6f55978d926963b47b7
SHA1 5cf99fee0c6e31ebe31c7d188096823ad979ed3a
SHA512 312d6d0c14e8677266a44bfc4b6451cf45d39acdf392981f6f15fff0e775f257a522930075be2ed78d81bcc221787e4d36f494a14f57892e196deeabbaa43373
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNav7N:A3k03kHRJARJ5
TLSH
T133259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 fca308041fb10c8bb14f40d1f75fadf869a8068224ef125a2d0f094ae39fa30e
MD5 94dd82553f0d225dcbbbe311206bbae8
SHA1 e27cdd5bc1d875cd3245ac040b1d125501e0ecaa
SHA512 330eef48dda4bb1cfa415e486cf13341ec25352778daed5073e276e3545839c1e70d521b1967ff4945f399506814966686363ef94dc583bab7642cc55c3b031c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavZf:A3k03kHRJARJZ
TLSH
T106259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 fd96dd229bc661f4cde284faabd3d9583e41e178bbb7dd57177b1fdd770f1ab9
MD5 844a0c9e4e01081218577a8bcb6af797
SHA1 ec06db53073728e07b5e54191c1e463e79233259
SHA512 5301f0f90a9790979454970d58680889dd8ee47d4a1261d633a975b8f078756d2d24478bcaa07d7f7f554c9f3575f129bf6eb28dc26f9a00fd5b900c1fe4433a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavbo:A3k03kHRJARJM
TLSH
T163259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 30a776c6a31f432f28893c7e8325a59d200ab8aab0e7863abe99e540c82531b2
MD5 0c7b1929ae4c086f4c0d461d5ed1d084
SHA1 61e422243d77a4686c26741c2f53747d272ae405
SHA512 db9f3f93a4524a786d9dd6be1a2c49287565aed9c265669fe3c4b7bd836043cd228cd5a388aa04e5ad454a4ea9ec8b51402320260f4c924dfcd3e8df42c99f74
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavPu:A3k03kHRJARJu
TLSH
T1F8259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 2ed74b4013e20d110ae57af2520a766d2389c90fec46ea6b0d552b531b05be3b
MD5 43df5314f086b5b123863581bae80593
SHA1 d26acf37b2f18162f24c079012976618a46fef22
SHA512 33bc4e647262e6d889b6a00076890f31679d6866f4aa28ad66075939c0be938300e184c0f0d383232fef6cd2ea1a2a4ad95409e52a6cc522d9b9bddcef74c99c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavd9:A3k03kHRJARJP
TLSH
T1F9259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 a8eeacb6591d5ee44adf6b64269255db24489c779e4f06c19a269358125537a1
MD5 ec5dc31899e2a6ca9f358ed1adc669cd
SHA1 7b63a7db862f87b292e7b65d6c49cfd6c566960a
SHA512 d5ea6abec0818414592dcc59d0be4d5a44149b7cddeb7b26fa6fcbbc04cd083be6dc0b91268b730695b56bbcc193cd350f52b1890dbb14803dbd907b8832e936
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNav5c:A3k03kHRJARJO
TLSH
T14C259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 2494895d13ed7d0a918d433540e55e0dc7308a3936997ce27725b977565c34b8
MD5 5a9783912cefdddc5786925c00c6ffb0
SHA1 45b2ce05069765c80cdc8f6438fb8c579adaefcf
SHA512 9fba4fbebf036ebf15917fafa25b8133fc90d33c1483ffb4850f3143aa938c8824c6adbd8daeee351d58799956124076d2653d0fa5ec24831e7379da1cfaf14d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavyp:A3k03kHRJARJ8
TLSH
T177259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 3b92a120b9dbf9787177b7b6945be49b8ba221f5e388a263722a9faa6a4d65ea
MD5 ffc7efeeb6aed81596a767391866abff
SHA1 1b847112f559451a87b3d128f2c37b83e79bb263
SHA512 16e28e2a2b075d9cbd155adbcafa48220aca1db657029503a2dda38012cdff2e262d0d59e9e056130a060565262e4303e743473c87c25e2e2681b1f43a1b5748
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavFN:A3k03kHRJARJb
TLSH
T1A3259D07F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 9d865abf48a78cd7addcee7ca7737a741720c5edc63412eeebe51a8c88f84165
MD5 d11c3fbd99288b75bdf3c6c86dae60d6
SHA1 95d7b3246114c2f3a5ae43026d06d5dca430e6dc
SHA512 5360b6559264edc34d9a79494e3542e64d1d898399361f8cc84b2bc8ee1a93e31f280b13d3b549b40af9980a314dfe28025bd3a0ab562b51c66b334de8924ddf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavXF:A3k03kHRJARJN
TLSH
T1AF259D07F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 7265ced85af6b19cfacda36ebf5ec4ff5070cee5d9c28e1eaae6ab656704b05b
MD5 51e80b7c7dd980158653cc36d459b74c
SHA1 437d15b9af3c8e805a0772b6ae76e56bd622519d
SHA512 4c40317a6eb98db284a90a04f7ac5344bbc0db8cf3814f0bbbace19be6ff6ba1369bf65221c8d8554b442c29db949137dde41b24a26f822bc45d27e59d4c9302
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavoC:A3k03kHRJARJx
TLSH
T107259D07F79900E8D14AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 b27ad858f96f3c7e8d8a7d484d2126c22cafcffcd8caecd434a132367c6983cc
MD5 4f5a1ba5d0fcd72deae7e89420c0e4d3
SHA1 e1ab133cc63a12983de54ac4f7267d7a3a56c835
SHA512 95283ba233d768641e9d43366713278356fe81395b7ddcc208ff21d502b81866cf13bd6353580c349b592d2b222ac3dee84bf5e39c6ae0449318278c77ade3fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNav7w:A3k03kHRJARJ8
TLSH
T160259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 5ea4244112c8d09e8400c2c0494bbe3283f70a19ef15aad9400cc49988007654
MD5 37aee255309418cc7bb9d02acd4f9890
SHA1 8157013ae4e1acfa2e870bcbcd09f37f4e7a6f6f
SHA512 4a8220a80f817242059828d222e3a48e23b70e9301b5dbcd341153032f2000ef6987b44d91b4cc0cf7567697172c15eebad6a51e107b69fb915db651b1735362
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavCT:A3k03kHRJARJk
TLSH
T10A259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 28a5c6000375800dd641962a6d1faa713624780ecb4a90e6b124e854a5e6d8c8
MD5 5068cf9c374c53b86bd168de728f4a38
SHA1 1aa8487c0b386acf9eff88d99d0434777947eada
SHA512 c59101a6631c0c49bced87fa02c2ccc23437c4dc1f5cb211028b087353e059df8ab24d2a74f44362d9a77b116a652d64ded0ee81346fd80bd0ea34a993bad0df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavSu:A3k03kHRJARJT
TLSH
T1C9259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 cb1cde827b3764253a4dcea46a7702766db0ddfe3b6fa886972e16ca8691c3be
MD5 eb8f12cfdab716ecb2f08501c42929a9
SHA1 10d972462882116475acb58dbfeb7278f5ffed2e
SHA512 c674b013dc7c598ea471c8c6f15692b2c4a3b4052e0584215a33f66d98d0249839557cba842bd51563c693a79c6a526bf2d935572bdc5c67c8b4731c954e3737
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavMb:A3k03kHRJARJa
TLSH
T16B259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 573cc647078166429a75e0472fb6c6192729f8d385428e1434ca665102424330
MD5 160ca74befff3db204ff9d425b59b019
SHA1 f4da6766e8fe1684425b80482d8323511bec4363
SHA512 d4bf1744bc8740b1aa7ac8439df7a798dd3a2b07a72b58014a7143386756ea23a4bfb760b5a0f42e622cf0394275f5a03b2568ead3ab583a08572c3274061c02
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavyf:A3k03kHRJARJq
TLSH
T1B2259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 2c72e2ea6cce8721c1fcecf8069c0468990a6cdf3b3108f38d0a8ca327092caa
MD5 8ed734b5609971631eb81bfe4d435348
SHA1 537a8c5e62e3f5bd9bb6e361e0c71d743988f549
SHA512 f517569d12bc6406559739ec907265b7f6dcecd481a2c1758efbe0dc7cfc1cb9375320f8204e84990d571faa11a0ffba924ed43284f6b7e31ec8323c3a61a12d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavfK:A3k03kHRJARJq
TLSH
T1A5259D07F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 bce5b79e8a0f42af4015445a8698294188bbe8f9c73f89245e40b9475e265fdf
MD5 60cb7243f1d9b25e19b6f63fb8fd64fa
SHA1 dbd80bbf44565a4a15ed55292690513316a26e97
SHA512 0a14004f3c761b4c8d74567a688fefc96463a69937d5b5106e2de86d41c197da4a299b6d9f9cda9d825bd9d701a498b6b9c09e18455523ebfaefbd0105d3b812
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNav4k:A3k03kHRJARJP
TLSH
T17B259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 9ce8b5baf8dcd687e4d53547b5cf548cb7e272a85a9dc5b1ae52c445cb597156
MD5 f2e5996fe370ab28f52178df5b292679
SHA1 2a4be34d5ca5488dd1ae30249392d32f1aa7560a
SHA512 56de67200edd79c0075514914c5081559d88b2cbf9fe99c178b9624713f8bd966defc1f78351eef5deae93768db1abb7a5a0148e22f569fa7cb5da8d5a670c6f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNav50:A3k03kHRJARJ+
TLSH
T13E259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 a10c4de6db1c766479c088a8fde81bd6b8d873fc5f386d957b056d0dad137a28
MD5 693ff67491de9e01c978542cb3b5c7f4
SHA1 8e59ab03cbfd079d78b129771621f5bc93848432
SHA512 a34e4ec129ce63f72a402e3b12a049b99a3dc344ae662c8b43e02ffda01591f816f680d17bb70639e0320295b6a4f7d539c0249256e38045c194bbfcc11dad33
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavsg:A3k03kHRJARJn
TLSH
T1D2259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 5ef35443a032c690f1d63f91f76ec2d4690c6b2bda958e2b47ed597d3e9b8043
MD5 f9ffabf0246a056337d3046b24f6da5c
SHA1 8f497d9f844fb45fa3d127c04fefe55784995fe7
SHA512 227d7ef6b08ebd848146a083309c657167fca876f41fcdb170739570e4d6fc874cbc7475c8522d213d5b5d128444210a94b0a3eb553de7d72f538a36d8bd3533
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavJr:A3k03kHRJARJB
TLSH
T1BE259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 92888b20844d83b4caf2ee0450feaff14c1c6506a1f1415b1662030185a4c7cf
MD5 3c27f158937776f83f87866470cfc56c
SHA1 b2c2ad757efdbc07be4907aace88331ce39aebad
SHA512 0fd914bcfe7269ac98612351ad58f6d34d89258cae434e42ad4581ce5ff7a70c0fef8678c02a6340caad947ce47db763ddeac66998f2a92eac70c3f2fb69f621
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavrn:A3k03kHRJARJr
TLSH
T1F0259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 30f92d6d6763a4159e087f7eb5d360e480b5bd47742aa44af9831ef8cf5a3ce1
MD5 103c9005535dcc884afdbefded2d575b
SHA1 9a02f14fe92afeb069d78ac6ccddabf8507a4455
SHA512 c51d0b872967bb20ea003509de94b907c98367d06da22bae19cd68fffc9224aa514e3a86179bafd7f5ada23aa798b05761e89e3a06db2af1a39eb8260fef3c86
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNav3x:A3k03kHRJARJ5
TLSH
T153259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 349035f7573f5c40c6098a3a127d62dab64cc9f1b7005fc8573730ca9cdd5e4d
MD5 4bae14e3a451a77484aa14072fedcd10
SHA1 36b8e77b9854ca43c6e8ab7f4bc6b31ec0c7949a
SHA512 7d7fbaeae4715363186c2f371424de23401ed040c5da3899ec0e356db8a38893e2d44b1bd4ecbf02c65fe75de95972a836a2f973ef45d7d16e2cedd8c98649be
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavtA:A3k03kHRJARJG
TLSH
T133259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 1173cfa8a9b0eb73670e061091d46502ef2ee3a59a2cef7abfcd82d922260e0a
MD5 9abe1ec234b7c6a83e399f0c2fdca4eb
SHA1 467cffe612e1580af9b1b20504c2981405e61207
SHA512 e9f313c34e2d99dd18f6d6926b8da1764a69a074cc7f4fc1500919fb8bdcf4021702e342b060ac826098aae3d5167b29c56a56edb7c53478d05584d97cfcc2b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavm9Q:A3k03kHRJARJb
TLSH
T119259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 0acdfa98c11eac059bb16921f8072e4482c9a44f35dcc150e30e83170c12597a
MD5 8b200b3f0293969cbef8632b06b4485c
SHA1 c78ef553ff6489cfdcb373b088cc29213c988cce
SHA512 92f73a335f9ade339af66cb095449dde7473ca2911eab3fd489169b95a1071165e1ce6985289f731a54e3df1fc804869b91f2cca44fca806ba05fe65a289db8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavD4:A3k03kHRJARJM
TLSH
T186259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 5fe5d0da67356eb4e2ba2c9f6823bd01688ea29de4c005a012a97371104e72ad
MD5 16b156df78ca27b62e389ec0856a70b8
SHA1 e3de3444b52b82d0c2105413fb60b8543a86ea90
SHA512 9c3b3605ba94157740fcfe053bc92ecf923c8d3b81035f630f0bbf24be2ebad612cf0d37deea0fd38d85708153f676ce8bb8c6fad165284ccf9672efd7c42c5c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavqu:A3k03kHRJARJN
TLSH
T1A0259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 5b1db3fb6f313275280f4a6318cfba28fbf484cfde1bb490cd8575921fba0fa5
MD5 cf6fe7372636d1b23c85e18d1488cbde
SHA1 1e9892f2fe80b0fc2c848c7aee97e9e105e5e784
SHA512 784464d31524235e0b7d304a9df6f458090952575c66a01fd47348f4e09e89cd89a77d127a5b73d04981989efdf773be60fe2a4a3e8d0f94c4c0b59cab6e5888
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNav7j:A3k03kHRJARJv
TLSH
T136259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 983149ea779fc78bcb502943df4a9e1e2a9efd5bec3a750e1c4f970b28c7f995
MD5 f6024b1c453533b5772f0551ef91b3a9
SHA1 7bb97cc4d903d70bb91283b3250ea52896c23c3b
SHA512 b078abfae84515b996530e819764aaf3aa2faf3d57ababae4321be7d2c91b9ea49f873a5238a59e905c88ee9ddaa3bd5631d44121208b31d1ee12918f3dcb30a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavGg:A3k03kHRJARJn
TLSH
T110259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 472214bfe3542164950cd497167b15eefda929990f5870aec392c57c9ecc35f7
MD5 f1d18cafe897c153aff53942d8c59e6a
SHA1 1aa6716e1751f84661c4942700025ec659f5906c
SHA512 93b45285d32b5bacea1641075b3371402244dfff3728b92e7a6cfdddca7b9cc719939a6776f37966f0672c4b621ff722bb3da1f31b467281ebf8a9eb4ccdff4e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavpI:A3k03kHRJARJG
TLSH
T192259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 652ffc92a9e5b16e7f368fd85fed2622b9b7e74629e2b0410bbc41179a8c3ba0
MD5 e857fc1039c5d79e80c23189b95aa9e1
SHA1 ca9ed8a2aecde791d0787c607336753ac73eda40
SHA512 3908643ac8392e3807a8f6fb1b64840f1df844a4f148fdb1ddf653332ee243450d2e01db27c0961d4fcd7d7c7abdcef4e089b711e1d855f60de65636f34bfd3b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavLo:A3k03kHRJARJU
TLSH
T188259D07F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 0dbca9645eeac0272b3deb0aa0d52380e20ce76dbed4c7aa4961a2d7ffd8a7b3
MD5 23f756ceaa63de456abf1d8c692ae73d
SHA1 d500ad82aee0fb4f338becb0f00c9478d5bc1e37
SHA512 196187685cca514741c9610551910910090d46805cae7901ec17d1cf65aa3160abcf28b23073844436ff7d2f9cac7efaaeb59f37583a7fd3dc3c2bfbaf4ee144
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavw+:A3k03kHRJARJJ
TLSH
T1BB259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 84f4c9bc46e3d6851b6b80866a5185ebd43485598d21d80886d0488f0dbfd433
MD5 f4f94a1a7cd0616d706de91283da202d
SHA1 aea6bc041fc87099dc2ae4eb2f848469f0a8fa96
SHA512 dd8887c656dab4744c44851cc4ec3e566d715e3ba55999f8b30c8e55e30669c3a3f94092691cc0c60d60410db46818593d0daf64ba76ab85911a81f02c8e77a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavIQ:A3k03kHRJARJZ
TLSH
T13B259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 72b37ea4e93696ce21ed4fa8bd3c69a24f551af0afd9a64b44df19cb16f0308c
MD5 96da5546ab76569c845f28bb1e41d89a
SHA1 618bdc3006416a893d210fe1ffd9794cb461050b
SHA512 252d3fd8cbaa058dda9919bdb8e9df19e6795a97a69a402f823ef49177f931c9de98bebaa45342875997a80bdacf331d480cc22e78b3a9177e922ae244ba9f0a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavBX:A3k03kHRJARJF
TLSH
T1A0259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 a0e60cf1f5efd06069bcc1fdc6b5c8394a57dfaa46d775ad6d33814f1b0b4c25
MD5 f7b3f37ea650e101d4f8c1a03117d31d
SHA1 28c51fc74f38631a96a8b5cea15a358f4fe76621
SHA512 124a7115926277d1b6f03c91696d5b3962d288f07b5b70d2c3580d29dd310396f6ac96be97c4b6cba61ac02ce04e186b1192f1f9e54ffe66a9949d8ed6ca456a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNav7L:A3k03kHRJARJ3
TLSH
T16F259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 d9f2889b18fc3680fab33ae3ab47ee01d027ed6c05663439ac94d414ea419df2
MD5 d97e3b07dc4fc1ca9ec93b2979191334
SHA1 86b1509837e38732cce4b9790a4f1c968d96cf79
SHA512 d8d5f124876db0ec3b44bac3bbc489ad570386fe169d63327ee6a17899f094bd63e313cde1d890028849e5b8bea453d56ae7f5dbb359f7c07824d70797f647f1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavBM:A3k03kHRJARJS
TLSH
T1D0259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 e8d4948182b8f739f3b4bd24d17d0bef886de672f11ae2c0a0c35d1c6995d05e
MD5 a7e521f8611463ad30c1ebc2fb134652
SHA1 e2e491eccb3656e2156ab7628845eee26919b78c
SHA512 876ec98a53e87f182ad04a4221e9c05226545dd58b97f12ae92609150473b0d7af0fb80bc9afc4fc961494bb6947d45dcc39c07bf24f07d9ba7a81b8169f0d70
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavqh:A3k03kHRJARJM
TLSH
T114259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFontCache.exe

Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
Size 985KB
SHA256 ca61d0495c1d34368022a4175202142b9dbaefc194052ff0f6fb033e5ffd7a1d
MD5 128a997a26bb66adf6d8099d478b5547
SHA1 fa6fc0fce39b5c009796e6c9e3d0c7bd7376cc85
SHA512 3d0906a6c7a5fe1cd464277a6c2428fc238c70cf8cb7e1a64cd88b1e9b608ec86a6ccacbf786250b21f18818d08a91c6c4bcea92636f2e6a4d12cffe364ec291
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNavC:A3k03kHRJARJ6
TLSH
T1D1259D17E79800E9D15AC2789AE68A23FB757C52172097CF1358C6162F63BD0AF3E358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationFontCache.exe$

Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$
Size 1.1MB
SHA256 f8c83cf17515e67f9e7e17c92c22adf008eaef16e97e56aa78641d32f23add63
MD5 2750527f45c6750ff04a95e2dbbbd173
SHA1 fef14354283fb77da772303897d82d1855f30985
SHA512 bc5e186d0dcd6c8b8713ec09343ba1a7ec0cdff12378448b59460c344374ddc6deb69b54c6546cfa8fec7a8381aabd485eb173a13cc1451553cc53aef421fa7f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8QuZNaveIiHq:A3k03kHRJARJWIiHq
TLSH
T19E358D17F7E800E8E16BC2749AB64522EB75BC161721D3CF1354821A2F72BD0AF3A765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3312-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3312-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4400-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads