74ffd8856f4d53f72c202febabcd93ee2abde5c7e41560dc4c60d84aaa2142ff

Analysis

max time kernel
98s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260728-3ewnasbr2v
SHA256 74ffd8856f4d53f72c202febabcd93ee2abde5c7e41560dc4c60d84aaa2142ff
MD5 20574760971091790de78dfff34b20f6
SHA1 c3781c1c5cfa64e755b425618f76d4f3c437d2d6
SHA512 59604f48bca43783ef77384c69e3ba30c1e14973a70db76ccb80f9aa4145b4a9550fd9de69401d149266b8467916a634ba505a022d37182a584f0cd8f33c3c93
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEN:A3k03kHRJm
TLSH
T18D25AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3384-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000c00000001c63e-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b301-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3384-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3372-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30f-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a65-223.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a63-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019851-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-491.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018989-570.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-619.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-638.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-729.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-773.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-822.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-931.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-974.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1017.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1386.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c00000001c63e-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b301-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30f-41.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a65-223.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a63-261.dat	aspack_v212_v242
behavioral2/files/0x0004000000019851-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-491.dat	aspack_v212_v242
behavioral2/files/0x0004000000018989-570.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-619.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-638.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-729.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-773.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-822.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-918.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-931.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-974.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1017.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1123.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1386.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1393.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1394.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1399.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3372	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$	patcher.exe
File created	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3384	2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3372	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_20574760971091790de78dfff34b20f6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3384

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 74ffd8856f4d53f72c202febabcd93ee2abde5c7e41560dc4c60d84aaa2142ff
MD5 20574760971091790de78dfff34b20f6
SHA1 c3781c1c5cfa64e755b425618f76d4f3c437d2d6
SHA512 59604f48bca43783ef77384c69e3ba30c1e14973a70db76ccb80f9aa4145b4a9550fd9de69401d149266b8467916a634ba505a022d37182a584f0cd8f33c3c93
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEN:A3k03kHRJm
TLSH
T18D25AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 a70529c9fe4edd4e7133ce62d43e1b03ddb10ec8dc11915e995943d07bcb7ba6
MD5 0e62d9fa9c014b3422db9a6a2ed20180
SHA1 89599160767f5767a0277b92f00f50b34c4ce430
SHA512 b48bfa3cb19cfee689c76c595f11bf9cbb2ba3d32a125bdae50b20a1091387f493592b590d24b5834675380804a9fa1126c70a2b674b6c099ea50931899ec2f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEZ0Le5ji0hmxNrM:A3k03kHRJmPji0Aj
TLSH
T177658C17F6A402B5D027C1B9C5D69A5AEE7138821B3086CF1359C7283F67BE19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 fbcd86352b6c939536b71097490a12ef5cf222374ef23de80f955b5098389350
MD5 fbf9ce7598b17bde706327d8cd48077d
SHA1 d927151ceb0bec4d1306bd66b050a036dfbb1dbd
SHA512 048e5ee1a2070d8b611bfe8563ad78a6598fba69f63a752fbe64d91f8fc15506ed148574538a45241e43d2052ffb679972e37c638eb3d54bbd4806f44204b73e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aELa:A3k03kHRJ
TLSH
T1B125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 8095b0066d1a6bb093791565140e82e7913815352d8b83756c686105fe8c59b7
MD5 47d42bc1c82b9c8a8a85bf0915703733
SHA1 7fcc40b233d9a5419d225f4ec4b66941de018f1d
SHA512 624851f8606fb10fb7bc1ad81c487ec558c09ce60dec3f815d095d96142d04d77b16445b037508b01d409617615419b999ea0464284dbafa3213a7182d53dc42
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEK6:A3k03kHRJQ
TLSH
T14F25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 971KB
SHA256 4b3eea4896ae1e8a4685619f9f9a17ba617fe6e1a9b51859b970f7b4e04d8307
MD5 da3d2c458653d2e474d660e2077bb177
SHA1 e8d0ca5fbe4f59d4498ba769051ee99beff09484
SHA512 dc7aa90176bcb10246e5094551c7c685f390f26985e5138d7bbbe11f32f514f3a3bb5a5b77e494b37839311889bfd40cfe3a8ed026cf99215ceefb1c8e2e7a6d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEiN:A3k03kHRJN
TLSH
T13825AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 971KB
SHA256 c372559edc30fd69d8a535af8ea5e6325ef2ef458d50217a1c53351f251d41bd
MD5 82c3b6bd1a3cbd5f767ea010fd05aadf
SHA1 a08d1bd83eb18418115898d90e14f36dbaecbcc4
SHA512 7cc91eb7a35d9abfecb11e7ce02f3f941c33baa4e4239f021f85983f1f4bb9dcc02551d6a5c9d16382ab5656510c4e89b5f18ee7e31404be5c829048acdb0012
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEYf:A3k03kHRJl
TLSH
T1EE25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 971KB
SHA256 69ed194838f3a71447bd6c47bcbd6fa4bc4cd784ca925d6badc5d8e71a768be8
MD5 a7f2716a835d977809117b8f5396b643
SHA1 db08bbcab9545e8a60769fef554f3e7a6ea610a2
SHA512 7ad7aded6ff1f183bfd48143f59e83f945abbbf478ec2181eaf0675f969ae4f5607e40b82b8a6806305aab8d4f86ee708b575f8810286be2230abae8fea2150c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEyo:A3k03kHRJw
TLSH
T1FF25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 df5f5c41eb03b14f1479ef5f110efd946482827167f8ecc0367f1d4efa424b54
MD5 2f8dc5e917a3bc1eb715803cae7f3bc8
SHA1 b5b98ebcd7e2f6dd528a33c530222db18c2413e9
SHA512 7da7101cf19a150d0492ec4f0b32778931c814b6012c8d7d143f206a1365dfe245d354a5116021b92ec860385191fdf6dff9cb50a0451e048f927f6d95057fe7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEmu:A3k03kHRJy
TLSH
T15C25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 e7f731fef2d991772f0a16b2e777eb5cc365d625029d3ff009632bf1bb8be7ea
MD5 2f8fa1ecf6f8d9edee75399708c6dd94
SHA1 189a8c5df4284f7d2de180af50924b6587c56390
SHA512 1634d28f612a4395750ac58957396abfb3e87fd53db2b9ad2b54ca7e28fbbd8d7007e3818e2d94a19d7ff7a5cd5addad2e21a54a4d26daf9b5d08966bfa727dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEa9:A3k03kHRJz
TLSH
T14125AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 1274dd4614808e51d7a95ae605466e87c462881f3fe172d8675f76904ea8efd5
MD5 a8598305e8f5e51a98a35f86b69e05a0
SHA1 9baca7b990e3912825db473f28e0fa7e3ddcbf0d
SHA512 d7140b5680ae179eb11d2651928c478ae82693178c1b22686eda4fde4f078c03fdb436174bb99966486b5bd5587f3ac17e668889fe460acd58024eda14316086
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEac:A3k03kHRJa
TLSH
T1CA25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 eb9be37061882442f8b85637044ee782844b116174cf210c3aa218e7994001cc
MD5 82ead9b88732848d449e8bf2dae9b35f
SHA1 5d68c8bb10baae6a3369e9098e8cdd02f898c0ca
SHA512 4768140496c315cc57fd7b145f2f92869e791306e42d9c68ed943d5921feb54fd40ac8396ca63eaa404af76a09bc4d71b59f09f1671c6299bad40e50d70fbd64
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aETp:A3k03kHRJA
TLSH
T11D25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 2b1dc6b619e080537fff960187ef1572e635fe0ff71302605270951d0afbe397
MD5 2cc1284a1de82a398038b8de34882c71
SHA1 085e8d0eda27e55d4591ea67f17206f1a2827838
SHA512 4f10086a3196644ac3e062359157fb3697b3a91d89da7bd54564353d2eb83e55993bf0014b7f06e21d1b9f9ef9a9cbccf3cf8622f4796854295b2aaee5dd2dea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aE0N:A3k03kHRJ/
TLSH
T19C25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 6dc85d79610d0913745b7d81648bcf21dbbe8ba85efa411896f927b32848a709
MD5 dccc699fafeedda7a81b0188cef68489
SHA1 34a1bad4e980d06e44a9fe59d058953d5f8476ac
SHA512 ee4f40a76e7d77656970ffe0b82b13a8baa8afc36e99859508b65ca249d26d1a2aaaca1d52b0d0d3e9ec0cc2219dd5279529ce96f63327b58e7679abd68409e1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEcF:A3k03kHRJZ
TLSH
T11725AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 d85a76e7f09121445a490fde8d4965ce745fbee6d47e35bdb53337c441f8fbe6
MD5 aa888d124dde49bc1844498c34fd1813
SHA1 1639921b33a1a65616f8eb15187960b291dfb88e
SHA512 6f998e3da0f71245d022d90583509bf196de2ea8926bdaffd23a89464ee7778637e47409bc16d0ab635a89d09c208063797e65db2ea84ebccefb345cc2686360
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEJC:A3k03kHRJl
TLSH
T15B25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 19de0e364c577761bc084826ddebbf5dec80dc0d6db0b27cdc57479c43c85ed7
MD5 921cd392f592c5ef2b42f33bc0124162
SHA1 9fc057c3c1ab31f7033479527c800f3c21363887
SHA512 0f55008a9435c904a26c975e3ad72be3951a4a77206c8b0db56fbda50bc5e3f1845cbfb60c5547902865d7bd6b677ba2656034f204ed49745ccd90c438efa3f9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEqw:A3k03kHRJI
TLSH
T18A25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 3d25bf6e9352001f4840b1b15cd9927793ecd53bb4128af70a8c1d52afc92b9c
MD5 b043729afc7e1eb425a3da041ba56222
SHA1 ec23e2bdffc9df7c945f8d720c29af0376c20b23
SHA512 58e06c0c73318aec5f13c6a16cc897658fcd2288d46ed746aa0aa79b7656e6320258ff13e20dfaac786fb99abd149fb6ab9e5821288b2eb3d7b859039dee6ff3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aExT:A3k03kHRJA
TLSH
T1B925AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 3de090b5fb96f17858a9380cec4021fea1dcc5736139d7f26a1115eb72116a1e
MD5 7994ef874c3eda4d7c803abf3ef472f6
SHA1 e087cf9b0dfa0f3dad8a59b719d0f806a9a4478b
SHA512 85e715083b9f497dce3b4f9b07b879910276ed45969411548e7101b86f028101a1055a892da5ef1a6fe387c1f7905d696a5242f2ab0c12586449255ce7a55c8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEfu:A3k03kHRJ/
TLSH
T1BD25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 69d95c0d55a802c3ee30d6b622b0b43c4ad393326a960402e9be8dc9f1b12cf6
MD5 00db639dc89b5d0fbb18ad8025821ade
SHA1 fabe5c2298267db7e0df9afded5eb8256d99f736
SHA512 4cf17967113009a7ff06de8f34418ba64fef187d2e9d2523f44e97703d402faa8ace3106b177879e391296db76c1f576d4f28701359713b6a3d651f52bb86e74
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEDb:A3k03kHRJm
TLSH
T11625AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 fe979a6b795ba24e20bc04e263bc6ace85bee40f3381a2ceca65884707f43d61
MD5 c4931c991a6fa4a639fff3ef7aeedec5
SHA1 def950ee80c41ad191442b3e9765671a5f70473b
SHA512 ba6e5003e8696ae871d95ec31e9326e73cece952d62bff19912582d22b7145e9c509e495918f21b013a2f799e9c709a87e27297bc16b1bc59162104c9dc08d8c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEXf:A3k03kHRJ2
TLSH
T17125AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 3ef9ff5c57310ca372258adb53363241cc9bbe473ec198b2cc3e84d199dc2b42
MD5 f39bdc337779e351785da2b28348067a
SHA1 3bb4abbbb97d6352ef1a1585a350ac087f2204ac
SHA512 2975ff0c1f8708fedc361bc42890265cb68407722832dee8789b4d4e17166b84eab244dfb85a29ebacb2884e3d9f273b342a844fcd2c56f9f4e5253d03b2d10d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEgK:A3k03kHRJW
TLSH
T12425AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 0aa88cf3e61c0b3e82d086d6c60f4e2a52166d0a58e1a7c66eb1ae5e2fac2a6f
MD5 42e90c15d27e2b8880dcc6d28b6c7c9b
SHA1 7ae0208889adea0942d12e570c8c28590395d71f
SHA512 ed3777a7f489926ec96ae6aec1e4ff1ddc1cbe52d7793e42ae0a9ee59d7969d9468bc729882db9fb18e2b364438d6e8060461d7b0c8718874ca7eabf9dd950bf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEdk:A3k03kHRJL
TLSH
T18625AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 7e68e83d58fbb4a0154368b3fb492ce3dd101ffadf10f77ea76418b36e3ff6fb
MD5 9cb4a303b7cb9ccd5603e7ab999c94ee
SHA1 dcd1375328685c9505fe6aad2396c2fe725e2db5
SHA512 29f83d570b763ae6500fd6b35b9e7d51ff377f881d1487f970967763f61c354a79eb95fb4cafbfdb253c924651f0afca0104507ba59a340fc29e54ff92a98da9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEC0:A3k03kHRJa
TLSH
T1E325AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 c1747280074a579e274648d6eeac63201b165cbf61f6da494e23585866961728
MD5 60a80a126c274888a69d500ed2abe074
SHA1 9d257e8cfd2e33d844e6fcbf44387a837436c5b4
SHA512 c0525be6b9bda17b20f2f2287d7bb7ebea9eb5077c08992bfbdd8f3bf22e91fec7ee81d0215c84a9fb0473798a287aa47b87db50f1bafbf686dfa8f39be3684a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aERg:A3k03kHRJj
TLSH
T15B25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 97644f814f5269f12a87df77ab781c875edbf4bc0984bd7bde60c62c1f65ddf9
MD5 f6458340c4cf19d11b7fa71a9e74573a
SHA1 a6617620a7d0acc5fc300b2324a9c409d1246742
SHA512 98d77c5aeebfb27fd6d6c0897b50cc98c9721e1b0525f9939aea60963c29911db0bf4d11c4393fec5184b826940f38d5f147dd65fefa626be2fe2b72afac5d87
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aE4r:A3k03kHRJ1
TLSH
T19725AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 379d5ad38da52fdc7523ddbadb59d24f28ad8b3a5dca54b53e17e39827f07be2
MD5 76fc8fb9b91ed4e2d2eb3e3b0c63a555
SHA1 476d8b959c0bcbadaed116668003952689df18c0
SHA512 142b4c61ba3a4417d1d707da6690a01ee7afef3924460563a10ad76a7058ef1553d98a90b7ee4e3194c04fe7683d71f7688488351996d5eddbadadd4a565292d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEWn:A3k03kHRJn
TLSH
T12E25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 a84369abbc9a9d8dcb55b7458589a441beebb6b087c9ea431ed2139fe489a1df
MD5 b8463696a9519e40c1c0b8dd421993c4
SHA1 e6a84bea1223934becf1311bcc3669469dce8760
SHA512 6c11c78cd090d231a030066822bd02c59fd88dc5c36934dbec197ae6e3deb58c8ad1f9c3571c18a5cf377974eb47e907f82993f0c7e55a45e7bd6203c2a6cd33
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aE8x:A3k03kHRJ9
TLSH
T1A025AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 1da7eefc8b35754df94140754009f3fb18d94543710dfc5d86f52d640bcd8e58
MD5 e63c92d8d8f5199ce6bb2a3fbbe853fd
SHA1 11df7d14fefedc757f4f68753a26fffeb10faa46
SHA512 c1f0d1598b3e663a5f45e00ba101708b2d05f844f0f5de686aaea2f884eaf9ebb65668b2ceac4ad81d28aaf7d63e149ea280e9e98bb935d5ae3d803b6e6ac6c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aE2A:A3k03kHRJi
TLSH
T13F25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 5493d32ec5716ef0c7f1018bbb962d5f18755a0a21805974563e939551b3417d
MD5 2d1b7b3929cb1fa5666cc48c7978e431
SHA1 ba0f6b751bea0b48974b3ad72571b739929a5894
SHA512 c1306c1bcd5945e87cee6f987d2f84e49e85c508f3deee6135454cca6d6636e8503593d8f0e9f4659829c05b0deea8722490dfefa60d6c8a02be9fd05cd687f0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEv9Q:A3k03kHRJ/
TLSH
T1B325AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 027318e5b0c67b72203523582a89634734aad2feda91febd8cd8186dbb56a3f1
MD5 e69ec44bc3509fcd1a43fee8f8e7c7f3
SHA1 7e39f62298768b9b7e8dd7251e0d2df3358b1d39
SHA512 a11d309e22c3df72e0fa33ff7f52a483b084a2b43582a6c564c5fb1f45ee06be512c7c5a039b4909758a7db8c70748b7631c38be6b88efd43eb32b9a646444db
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEG4:A3k03kHRJA
TLSH
T1EA25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 fe00dfd6014711aa68af7999449d3a2ca63233414b97b98c5ed941eed18a66af
MD5 9230ad3800dca344de749d6009862d7c
SHA1 11e6a57297a945c2174d3ea5b9df7f5611fd22ee
SHA512 125eb35fed1d0b82a61534dda6c8907b1e53be8d282f2b221b3d6e33d294985a208eb6a36f16fb43bb97529669191eb9fe7594f5c63a39779d0a385504746523
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEVu:A3k03kHRJh
TLSH
T17D25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 a7cb61e9714bd99813c1b100b94c741093bb152cc070a7f6cb9a38ddc61ef8b4
MD5 ea5a7ece35ac93f4d5f841820085c797
SHA1 f4b3b0c74779abcf2d801aa169c8dac1f5a3b4c8
SHA512 fd2afaecce29efd4237ae7d6e47f73af1c2945a4080da46973d22bf6807e1d5ec8c6254b29aa042188c9e70913726d8ed7e4b1580be6db78ea15550058170c4c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEIj:A3k03kHRJL
TLSH
T1EF25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 ad520b6c93849db14f3d089b5ccad73f2558eda9b22dadbc6fac00989abf6c4a
MD5 e0830bca8aba1f2bebb66c5ebbde997c
SHA1 30abed52e40bf0eb142a4fed68df4994fe2f064b
SHA512 3900c522bba2fc39db91cb008a20447051fe0aad4ecfe014b6096c5379305870e5a2391c780a7ae59601138bb148d8d9b5748fc57ed8eb9b8c61ea1bc732ca52
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aE5g:A3k03kHRJD
TLSH
T13125AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 bda20bb15ee6e883529e87ab02e16cf95b81997dabac96857c80bd6d5a20c041
MD5 9ebc20addb0257192dc23531a28ebf92
SHA1 faeb350f481fcfbfe3ab9f2b7e7a453722c24cd1
SHA512 feac6b69a93def8955e36b84b38d4d61ea888aa7f9861d1016f33239f93f8516dabd736a92e9ec013e6d9dcfb2bee5e54b7e010995f6d8d3abe18d8f54a75f61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEgI:A3k03kHRJK
TLSH
T16925AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 71f37c99bf0067cb27eda7a842efa3f227153ecd70b42e363ca5353c4146b621
MD5 1962d3434cdc120b812cdbaa7cf74de2
SHA1 31a875e6704c47be8b971935542326db2e7278ef
SHA512 5aae91e6eb8fd5a32b48672e1ceeeb7df0049b875aa002b2d6f0ecd99cfee9d23649fbf5c31123a17e4d9fbec02b49e8c240ccfaa5816a01ec4d9389056478e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEio:A3k03kHRJY
TLSH
T11525AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 c77be7d36c618af5616c429d7f4fafb0244690a34b4c84656d7543208325a483
MD5 c853357e2423406284b44c978678bee9
SHA1 d6ca9fcb4ef99e9754d6dd17a0a2139bc5a26144
SHA512 17e3c378a631020fa39e140076a0dfe63d27710a300bd086fc91279c37714b54e343d9337779c5f3c6657a52a3477422c443e0ab74a21c8f89b7f6234b01e45d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEZ+:A3k03kHRJl
TLSH
T18525AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 f0d200edc115d5e22cf15b9b193f26357140a128307f918419ce2b3f9ca4db23
MD5 b72f4e29dda979657d7c342a22a1012c
SHA1 ca75ee57e71d5666d7a115db7883c2a9b87bc226
SHA512 046a709a211eb7499e182a69989766f08c24e40b8dfbeb41e9e5bb2b7a6cf922220aec281d365235eab3b3e3def502171d61cbb7b35b980b59df763239d8d2f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEHQ:A3k03kHRJt
TLSH
T1C025AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 374d546d3d12e0093e97029b05ab6d7a1f54756d7d9e2099184c2adcd2e01b4a
MD5 4e458ab04708b2858690ead436c405c9
SHA1 b543589e61c83ecf602238e50f335ff043f58c3e
SHA512 68583a6034c66fbbaf947d5d39c7cb32900ab658777a5a907be9799d4fde742f214cbee5695d5a566da130dd22b8b9d74d5fb45699cc40ba303693fbc38dddf3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEcX:A3k03kHRJZ
TLSH
T16925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 cca154d432825c9831abd4d7d5b61d3b34c79ad18476e0fdcbfba03fcb0d299c
MD5 1ba8ff1afe0dcf56619c0d71bf894cb6
SHA1 13de2ed6e31b6da6b5372d405e131fbb9800a122
SHA512 53984eafdf9146ccb805c7bc888e5b8d39501b935ad6c7537b5959d9586e24740e68352a3851b20c749a70bf0e95e6d9876f9ab9a2f93c305e3374d0cfd836e2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEaL:A3k03kHRJT
TLSH
T1A425AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 d30fec76df2a8f9f9ca64f0217cce549ba9c82825dd5894dd1c5f39cf2ddc0f7
MD5 a0b0907a9ad530427e21b9b37b5ca708
SHA1 3386d814623750a6f800666fe8cb3d73c4b720e2
SHA512 4a66451bb3d627a98bfae7e2eb83e8f96957cae1ffa7933faddd65839865b308d5f6f7bbc37bb0bea461b966b860f368ee3c2cb7f21ad17ca4c246333df2bf0a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aE+M:A3k03kHRJe
TLSH
T17B25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 ce21e3bfc5acc39f3fdbf658a0ae1885083df0f2eeceebfe866bf81715cd0c8a
MD5 1bc326941019b630b54c34dce9686a11
SHA1 01328fcfcf8ab57639f6e79ee03d8072e6223d4c
SHA512 ce8b439a8a62973b0e974b1347ae4cfac58823c8ee78765e6feba3a5c1481a5c8bb6282da12c25ac20cdd1eab710b4189a0631df739853f72935558b865125d3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCBm0aEnh:A3k03kHRJw
TLSH
T11625AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3372-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3384-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3384-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads