be9d14bdc6262cfbfcd3066adfe05cd591975fba960526a9263b37a863dce8e1

Analysis

max time kernel
103s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 940KB
Sample260728-2wvxnabm31
SHA256 be9d14bdc6262cfbfcd3066adfe05cd591975fba960526a9263b37a863dce8e1
MD5 5d05ed13a5a0fd8659fc7298da32eec5
SHA1 04807ce0e5a8966eaa0cffd4871e2eae08e7846e
SHA512 af69d0eafc30e19b79122982335551d76bea02650cf96d3b2f31749a6e614b5441bede3f7d6aa9ad7b7ea36fe96465d83d60a192df90b76bb7d0b18ee712dc16
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT26:A3k03kHRJARJf
TLSH
T1B7259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4456-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4c1-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4456-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5644-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-448.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-704.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-879.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1023.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1061.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4c1-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-448.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-588.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-704.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-879.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-980.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1023.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1061.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1123.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1148.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1217.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1326.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1339.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1371.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1379.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5644	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\VideoLAN\VLC\uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msotd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4456	2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
5644	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_5d05ed13a5a0fd8659fc7298da32eec5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4456

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 940KB
SHA256 be9d14bdc6262cfbfcd3066adfe05cd591975fba960526a9263b37a863dce8e1
MD5 5d05ed13a5a0fd8659fc7298da32eec5
SHA1 04807ce0e5a8966eaa0cffd4871e2eae08e7846e
SHA512 af69d0eafc30e19b79122982335551d76bea02650cf96d3b2f31749a6e614b5441bede3f7d6aa9ad7b7ea36fe96465d83d60a192df90b76bb7d0b18ee712dc16
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT26:A3k03kHRJARJf
TLSH
T1B7259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 4de66750c209d8cb6d0f52f9c980ad32fa7532b84c760a3992ce9fcbb23f96eb
MD5 4bad093327e38b3ac57635ca37009a87
SHA1 65ca4daa1f59f613872666a605327067de17a5e2
SHA512 f8e810696b8c7437036687f86b493030db492299892781fddbabf4e01f889026e36c444584cbfd667df81e12ecd8a779b6714246374687d81a19d0778d4389d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2K0Le5ji0hmxNrM:A3k03kHRJARJLPji0Aj
TLSH
T11F657B17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 fbd1ac20f6aba5886410ef977d289812f65395212c192e8fa7d855d9e82c9b52
MD5 4c9ff8df5619585da307600cd8b6d4c5
SHA1 24e824428d7fd92e68905308fcfb92928bcbe073
SHA512 c8fcd8352d5ae63326536e116408e26843660c8241aea37856b156830e33c01eb749da03f20bba8546bb0bac77929637ed1dedcc5c0ba6a8b7957a9e7add5878
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Ea:A3k03kHRJARJ
TLSH
T129259C03E79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 e85f865a92f6a67fdc585d02876e670eeca0beea188f7b4a1d27d06fa689d851
MD5 9894fb784755b06f4162eecc7d0e088f
SHA1 87f19f006820ad257d444408fabe28bf0abccd3c
SHA512 aa55156746dbe0e98387476d08c72b513f29197212435284b55d21c5f103593c4d288e728179a27eab39ead8ffd06f84ff56fe9f4fb1df10f2d68fa418eaf016
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT296:A3k03kHRJARJT
TLSH
T180259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 4ffada827e2dfa9133d523b32fa33079c42fdfd9aca3f4d6ed6057badbbca881
MD5 81b13e325b7021172d736c13163aec7a
SHA1 c2562ffdd7a0758aa8790da23e6cc303deddcadf
SHA512 1a6197f0d18c70fe91082ef4ea6f92c270cce0e5d3534d61d5630b04c8c4725a42449673e389be50650dc3cc2762c7cfd40d666c500eaf8db244f5df4e90ac9a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2TN:A3k03kHRJARJO
TLSH
T10B259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 75f071e48afda98c20dd0e861c274ef64ccd6a4e561fbd3915b53008e0cb876c
MD5 f6cf926f6aedc16c8b4ec48dff5019a7
SHA1 422e0c6f8e5b2e2a897c1939451d9dfdb659ddbf
SHA512 c0051bbe109ed34828f3746fc875ad65f3aae36f117e88ce7d6d6d31d33f8d83468d5f3ee1b21534e6dc90d410e30207d51763cdf439a32771d23e2a96111d0e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2hf:A3k03kHRJARJC
TLSH
T105259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 0f72e26cf2ac9b2d4eca48eb036004fbb1d5d5bc1b095a675c44aefeea786e2a
MD5 144bfac5624dc95d265096d9837e4b0a
SHA1 7a42a8fcad89c39d3b54120d2659c85ab53655ee
SHA512 54b918b3b48a7908b8cd25f455dcba8a6bc229ab8da79b6007d954859d943a57e5de4bc8fe36e44a3c5a05afe470da2a0bdc06a44f1bb527230166872dabb0d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Do:A3k03kHRJARJL
TLSH
T1E9259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 2fb0bb568a3532747de0f63925b870395e7165ba0ba60bbfc131928c98aa4963
MD5 3e0dc2aa889b6fe3987c423092e84cf7
SHA1 a99c12a12201133b1d4f1ba3fcc4fe69cd145838
SHA512 6200328329ebe4aae0ef9e4d7f6343bbd81461cfde7586e5a19915cfd42d1eb86ff9cd973a530c636b0d85a0a671159db1752fb7a152eec3f55f663cdfdbff3f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT23u:A3k03kHRJARJt
TLSH
T178259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 2d690ce812e700fcda8ed1235e6cb391dad643d821d7a3c1996758121c25bb3e
MD5 4468d96dc2f9920aa7d37cf957a17da7
SHA1 0c7f44b0f4409d3a4cb32736336431d4cbc5d26c
SHA512 5573805d8a4e422461b90604a854bf31549bc071bee251ee5238909c08b993203eb21888a7e1335d1784f9fbbaebff8d2fffea4207e618e93f1bffde15ef3a38
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2F9:A3k03kHRJARJY
TLSH
T102259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 ea6007952adecdaf4026d9ef1d6c11cc1222efb33d79e5483d6e688c045821d9
MD5 a11f5ed1ac34dca1421e02ccc22ec964
SHA1 334a1e83fb49802d1eab71820973cfaff2b346ca
SHA512 39188b90d957b4f8c45c8d05369b4e052fe2f174ced760d72670027b583375e0b7cd7ea0cb9f3bc5593bc2cd8978b55ebfc84a19fd50604b920b574058b872b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2hc:A3k03kHRJARJZ
TLSH
T120259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 37920c1c521cd16bf03fad42f1a8e7e2f8761b7c29f2cf64d9bd2950674c580a
MD5 8a7b2720dbb30eb652ee9d4b9ddab33e
SHA1 e861dac6514ee48e88e1b4181b07ca5cf4493a29
SHA512 bef8131d191e9cec3a022b9f86028bf45a95dbce74a45736cd7163d8182c4fcc27cba0bf5c31cd7ca08839c944b7526bb12fd19b70965c701cb9e67ab3d63f4a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Kp:A3k03kHRJARJX
TLSH
T183259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 fe4bd2a4191ec1d5bc409639babf273dd9f6e90cc484bbfbcecae3700b73e640
MD5 d05e689b1083a2e231ba68428b40d807
SHA1 1642cec311f4c7316d3f2226b9558f8998c83048
SHA512 8af306db5d813c3fb648c4364e533fb10a2c6e0a3c829aefd346775ad71b9fdc55438e5f2228092ee6798cdd189849fd395de81dbd4395bd4b42906d08488fd4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2tN:A3k03kHRJARJ8
TLSH
T182259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 6181261388880b70a4b2d130bcf5f41db81ceb7caf214a3aa737484913114f47
MD5 95fa47802a8af4d7bf9cc0f0176b3cc7
SHA1 5634b76ecb598bb594cb85eb21a7e2e64828eb54
SHA512 8856f1aca0b111abf18b8a53d8435df1fde3442b9ea27a3c55c0c6213f12fef16fb8d1b8ed358506ca9a16174f6f9a67ab1391c3c37fb1432b742bb287900ec0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2fF:A3k03kHRJARJK
TLSH
T187259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 0bb8c03eda3341b65f928d6291c64aac93076579e8e39f2ce75868658ad74659
MD5 1a665c959a33b11253e5eea8ed9f3c2a
SHA1 2381afead49e425429d3fd06573c3f1323bdd0f4
SHA512 7e4e59b5e8d6ffb847022438fb02a99f8df53165d69e926272b0b954f3215b5f5b20f9cbfa5c380259772bb8b1c4afdc21a53c2cf18a415bbd595786abf7b45a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2AC:A3k03kHRJARJe
TLSH
T1C9259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 3f000e4c306f48d9018422e9a6177b37475a8df9a0a9b74e2edd073f8972bfe8
MD5 5782cb164460553486dd5fa7799498dd
SHA1 2e6c45dec4987eb254149090d304c95ae2c7816f
SHA512 b95913cf32c1583abd5efa66e42392a165754b536ccca13e2d9d6eaf37e4d545b5fad37c329ecfece258847943c88c6337bc95337dc1f8f2804c065b5f3bcf6b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Tw:A3k03kHRJARJr
TLSH
T17D259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 68009ea4cf35457c5d5ef07221a890606a1275012e04418aa7e6df04311974e2
MD5 3996c0dc9e959c15b6093a83d62a8779
SHA1 9a9f34e1047184efb7741ebabf4ecbe85553be94
SHA512 93b20de2b9c7492176eb9c89ac3b87ca0394638dd255b5913d29069d790a39b822b1d601e6eaa5a6b28f9d4991f73b515ab3b56a2f4263370e8091925cde2ada
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2aT:A3k03kHRJARJX
TLSH
T128259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 904cf35d754e7209fad62bf1fca953e2dd020dd9538f8474e3a1c0d09b9f664d
MD5 e79d7fceb17fc497fc5959198cb55327
SHA1 4039a99e1ef78c4be0c6cd7d8fd5ee7aec22ca66
SHA512 7313b096cb66bce4560949401a7c77ac8021cccdf2c19dc4ff62dbade6a46e9df645ca133b2e57280a19e7b5bf053f38943603bff3d1ae030cc20f6b31c7f8a0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT26u:A3k03kHRJARJY
TLSH
T16B259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 4f2d33186dcf8ca39e06920a8c70e57b911e95c2b8ec8fe98b6bfd1cd41a99b3
MD5 5988b41cc47045376c973080b7c26a0c
SHA1 c910793d9cc7759288e52684a18e8d3c9fa65a8f
SHA512 627915ae24af3c770367b7298200fdf9f6a7d17243160c4450a6766287b9d4e472df00afe6434aa6f438efc94ab89685648ca21ae096d59fc6a98aade70c2f97
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Eb:A3k03kHRJARJB
TLSH
T10D259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 ddc8dd9a23c3feca39f67ffdd828f03b49c824a6e5133313ab3ad67be2a6712d
MD5 e4e0729d21a6ce0bd76873aee3e86817
SHA1 f46a50bbac241a69b7d35522e9dba4f65a9dc407
SHA512 d35c859cc08e8a087c90026540db9f9e82b9f00abcb5bd9cb93cf17f1a6ba08041a60de8383fc4bc4ff6bc0c6d1404b790c6bd55fcbacb110761bad271c8a804
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Kf:A3k03kHRJARJB
TLSH
T137259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 d3fd149d7a5c5bda090a7525315d0057bacfb2f17715cc3168af7fa624d0d1fa
MD5 b8a8eea76e48efc6910c4bec5ed0d056
SHA1 5f766168ae1acf60b338159f9e97a27baa9f770f
SHA512 9be997fc28e43c4e3eea83acc16835e9055dd396df9b8920d9acb9e7bc35a87c50be5c36dc8cb0401f7eb684692534fc1cf39f5610503983240a04d7e522cf29
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2XK:A3k03kHRJARJZ
TLSH
T18B259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 23bfed6b0bf1c819f2737a26d836b9d96dc52d3ab5bc75b3606c835a8b9c7cb0
MD5 106e8c65e10f0fc4c8944a8ca98d1067
SHA1 37377d0a229aa2fb6c8876cca749926e88401391
SHA512 f3b559c6826b3f58bc4c5cbdcd579605fc58e2b5a3c05ae3d9b70d5bc35c05adc2784962b6ebe5921c68890d52c9505946e1f2b312a4a5cde33e6d3d5038eca0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2gk:A3k03kHRJARJQ
TLSH
T1A9259D03F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 7635b4aa23ba4a150b3b65d560c0cf11ced56300bc61af577c2616e6b3ba92e3
MD5 1feaf1a84bc42d3f544fbd36594103cc
SHA1 39fb16c9aef07d699c94be16aa8b2dfdf8135454
SHA512 93c4f619e659d58c534909c90061185c15523f0128342480cd58fc6073f53eace49ff9f77b85b0e43c3a148d5b2824cf839f0a63e9fdea492fd05e15790dcc50
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2R0:A3k03kHRJARJ5
TLSH
T1C1259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 c14d1bd26f2d6b376697b80b60dd4d49f61f1e6dff9db9853be013efe492a53c
MD5 87a6e31de49e263489d0a30113e467e1
SHA1 0fb378e411f6d1bab07dbda10a901470990e99fa
SHA512 7e449bfa387c7ddaa19be49ecc5c631187bdcb2870f5880ca9905e93b0df2033a47434fb362870e19982882f99ff892981c338f26d518d56512100d7575d08cc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Eg:A3k03kHRJARJo
TLSH
T162259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 b24bb02014967ebaddef0851282a8dab250978343fc9c80fadf75c5b3e2e5d37
MD5 97d4030e429c98d047f9e739c3a4871f
SHA1 019c5f17131b43db6b2437eb3a708f8fd64521d0
SHA512 caaff0d1d94a4b5b132876e6f846c69aa4f4859309bfbdf2a32290deca87d0f468fa359decc27bc038581ecd391d9327b681789eee39ad260e25f790aef5b82d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2hr:A3k03kHRJARJS
TLSH
T1E8259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 83958b13dd70129a06293f61fbf39de3b1c48c33674a849744d414a93be697ba
MD5 24cf4b8958607a03fa1889a43a4902d6
SHA1 9f412236d3eae84873ca93cc8df5d9d122c4736d
SHA512 6d2ef78b1d776e2a7218d86392ff8842b833a5b5236e20c42c0758a80f9795484ed48743bd4f3e9725e2b111cc7a560f7e00a02fb8211b09b854e5335c0192ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2jn:A3k03kHRJARJE
TLSH
T17A259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 54d2fb246cb0c56c79e580025c2d037899bea28fa7405f8dff3ab74aef509a82
MD5 92b86d1d5ea4b82bb32a7989424c5e6e
SHA1 c98a2761c89f7b0e9bb8b4bc95d4c3b3601759d3
SHA512 1850d71e7e0226d7a8e3198e8b99500bc8a9805d464261aaba44e32f4ad1e9c35ff101d6bdad6c8a6adb8e0bba0a8669de0999e2c8bff787b13bab91371988b8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2/x:A3k03kHRJARJi
TLSH
T15C259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 ae81c8027f0b042b129d30638a00af8807ce491107efc8889ae84bc150f3d5a2
MD5 6d826ba02fe17fbd809a673161dbcc2e
SHA1 d54cba1b389f0cb243963a84936803bc6c87e0ac
SHA512 9182facf5235d4df661f0a6b37bba8884db71d1fdee37473050af8e8bfda300be78779f47e47a3113c4f49660bf5af2908e420f3e7876dc84cf40df9b6067dba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2lA:A3k03kHRJARJB
TLSH
T1D8259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 ef7eed44d50dca576182475d11d408202365e7b81669bb535eba2928d978a4f2
MD5 811672b68f4e7a9435461301bef3e8a0
SHA1 22cda7d6a4b1be22fb203457781aea2c51175ac9
SHA512 b1d395f61ae122890a4a12442e7c9bcf614d97b85df0fdf9c0f4bbdf801cc5303fc5135f109d8a928e979931dc070e3b5e19df25520987ece34fab3006707eb6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2e9Q:A3k03kHRJARJ4
TLSH
T134259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 dc54b98776c5fbaa4e17a70e32df81a48703f9f79141b67774f253dbbe9b4fbd
MD5 625e8638cf99a70609db9e7116d5e088
SHA1 e1c35db1a334a62d333ae052d6e800dd1eda5ca8
SHA512 2e611b5959765eeeb0d948d85b7b2ce3801d5bbab62ef1ac1b4022269f80b9eccd88bd05674e34a18e1ce2e5b865f288c04d1fa3df437134f5b81777f43a64c8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2L4:A3k03kHRJARJD
TLSH
T1A7259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 683743104cbffc853ca918e619eab2428b51180dd8b0dc143ecc5347cc2fc230
MD5 1dd8e83b9506ab20872ca02f8ea8abe2
SHA1 4a1c284384a243bcc60f7ce4995ee581215a1478
SHA512 4ee0e259bc11efb844f2192c85ab980fe93a257d9275b2269f67eea6d30e6c51c99ab5a10bd1f7a490dfce203d1b7746dfa656d0a2c8ad10143b980c47f6db17
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Cu:A3k03kHRJARJm
TLSH
T110259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 7f101b6035a965ccc0cf828d8c4b7f92dd07297f025f7575d333a60961f6ba53
MD5 6ee9d11ec8e9591689b06a8239412b10
SHA1 60af9a02a54a1fb14f20a95fab9df68875455015
SHA512 efaf91b60f49340f8398b2bbf59b84b24abdf860e82d2024a2fc50b5b4040de18cb8c4ea2ce82e1c185dc1e12805d793dd01479db65da74f6902743aac32e709
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Tj:A3k03kHRJARJY
TLSH
T185259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 a92572a212fc01f8df04006991d15f383c94dc0efcc89595c4f520843be23768
MD5 d22e0b957378e7e4c58f6f76c75fc8ca
SHA1 915b892e6f7b259b2672aa394af24ae04349b3f4
SHA512 fe750471dee4435f36757d7a3a1ec7aac66578489e8936d6def019144a9b571915dcb41df1a0c00adb5bedef80b6a20065b90594f45d5d2890009025ecda5195
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2eg:A3k03kHRJARJg
TLSH
T189259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 5e8568db4ce1503567c153fe6706b5b4e7fd7fe2581ae48657cc31ea012c39d4
MD5 a4478e6f81e317f3d7d97f679bec13a9
SHA1 39e863c74c7c665ecc21e4b5cd9cb96f04fd18a4
SHA512 6e950fd448c2afb621986d6ab336f14969715bf59d4eef235e3da961da619589be6b04f7c51182245342d41b142c9afc716c0a8a7f522ee9b56055d8d9452bfc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2RI:A3k03kHRJARJh
TLSH
T11B259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 214572577f2f3c40cf548de573cd87613316e106d80ada6ff111d92494e10975
MD5 2f4cd35213f1947b751cf18546d46931
SHA1 07d7f6daf37aa56dbd80e6e8e0596055a697ecf4
SHA512 900194ee739dfcc49791545977acbbe2eaf42a899bff22c366d24f2bd1034b7ba7a7cb1c0724ff0ccb66349b4336c8529abee2f8999f2b4e6ea35e4d1eaf5e9c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2To:A3k03kHRJARJ/
TLSH
T199259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 cc83d5145b443303b0ecce6822c278171b63307993f52a6d0b031cc59589664f
MD5 93df016842c4de87a04eaa2949002563
SHA1 578bfdcec09faf0fc54df49cf9645249c89a0c72
SHA512 06d0c60cc238727ddbf8722d81e98b871c2cd5953ded959149cf32afa941cd292d23e7d90b7ff32e47e1fe01e66ec54293e3ce8fb839872e77417dd3f1144b12
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2Y+:A3k03kHRJARJK
TLSH
T1B2259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 244e438d0e022a79939bf4d8b2d58defc2631088f003fa379106066406d16751
MD5 a34d76c20b2e440395a60d2000d97bd4
SHA1 6183c815ac631762aca06c255f426f5dd215c243
SHA512 49769a75908cdac26d3f7b19893a6e9b13ca338bcca42f24645e43e42e90b831db182dc3c524303c3a928c277f5886645be42c763030cbaf6e6b3d5cbf7521f2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2wQ:A3k03kHRJARJO
TLSH
T17C259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 32600a4c1b52ab92bc760fe0deebcd047301a2dde1d711f7d13fd930f8f2e337
MD5 86741f15e5ed8be6c89e3ad08029489b
SHA1 d6ecf188eb35788de01d3c6c5e4ff99984ba8936
SHA512 ac34c092e1f128d19e21e31ce2bcda997eddaff09a6337ac751560d29596ff7d7b82d968aac0d9f919b534d0bf40bc4b1a702741d3d8ea6b2dbaccfc6b6e5c6c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2ZX:A3k03kHRJARJO
TLSH
T18C259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 4e8082992a4d815082bf88e5d4dd740756a6ccd59e2dbe7408c4b97b198c3510
MD5 6fb6116f7395bf050793e353d5a4abb9
SHA1 284636371d7c9fd55c4ff88c9a3d107dc5fb9b48
SHA512 3679f59b3f0bb9a3d62a8e5c70254c5c7ee7a5344d49ced889270b1fb831fa973b278874b471e540dd8e89f4b8fa3d73e55d9a01718b1643cf18c107edd6da9a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2zL:A3k03kHRJARJg
TLSH
T1DB259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 e9ab7f64a050e33a25c3921d824bffbd35641a55b6eed23cc619cf4a4a30cf99
MD5 4c8a52323b48bf01601aead7133c5628
SHA1 d1f63b78f3a72567f5f581767346140fca5d45a8
SHA512 8091213acaaf4c986bf76ebb56f43f0b8adb63422ff705dadd430d849dc6a8f76e2aa11067a271a39040c741604e657647c04c974e7528b2508179e90fbb374a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2ZM:A3k03kHRJARJx
TLSH
T19E259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 1ce10297d583c0ec11292bce51dce09ad270c4f977c46056e14a107a7528e67f
MD5 eac5dbe309e401291b5dcd2f5c500bd4
SHA1 5668e46d5c14a5b05c47c63c33b9d7de393db503
SHA512 6a6c588b340355ee5b5e1535ac9bbb387e5122dcea66de7d081598aeb12ccc5a6585791d0fcbb06c34ad53c068252c27a94ab7a0def2740625ecb7e5223295e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEp62iT2ih:A3k03kHRJARJD
TLSH
T15F259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4456-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4456-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5644-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads