cd53a16d22711e88f53277ff57446d081f613bffb2293a94b3aee4f91612ccfb

Analysis

max time kernel
104s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 930KB
Sample260806-te6c3ayzev
SHA256 cd53a16d22711e88f53277ff57446d081f613bffb2293a94b3aee4f91612ccfb
MD5 0317bb8286c84728509dbbbb79b1260c
SHA1 cd4bdd5fddfc8eebc69fdf43a372f2469b586087
SHA512 0bada4d9e3a4a688c6734496757be18365ed40f1b46916cacf46703a454cb0f2a7bb24eb9da7f802ffce102a746a851e1e0eaf999acfa24b1617cc0d364d9e13
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYa:A3k03kB56r
TLSH
T14B157B13E6840FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/2948-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4da-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2948-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3184-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a59-230.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-460.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-626.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-706.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-737.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-786.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-823.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-873.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-919.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-982.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1043.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1123.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1218.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1328.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1379.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c4da-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-41.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a59-230.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-460.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-497.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-588.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-626.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-706.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-737.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-786.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-823.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-873.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-919.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-982.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1043.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1062.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1123.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1148.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1173.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1218.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1328.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1341.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1372.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1379.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3184	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2948	2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3184	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_0317bb8286c84728509dbbbb79b1260c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2948

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 930KB
SHA256 cd53a16d22711e88f53277ff57446d081f613bffb2293a94b3aee4f91612ccfb
MD5 0317bb8286c84728509dbbbb79b1260c
SHA1 cd4bdd5fddfc8eebc69fdf43a372f2469b586087
SHA512 0bada4d9e3a4a688c6734496757be18365ed40f1b46916cacf46703a454cb0f2a7bb24eb9da7f802ffce102a746a851e1e0eaf999acfa24b1617cc0d364d9e13
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYa:A3k03kB56r
TLSH
T14B157B13E6840FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 1c77c9ed45eb67b9ce352ff663411240b79461654d424bfd5325dd1802106cc5
MD5 40012a4214f119359c9daf4d64016dc3
SHA1 02fa3b63326165906669d816ba8f779854724dd8
SHA512 cfe7c312ab507d01c1b1676f8edda8170071f97754be49812cdb3ad85bfda7b138e495af5c8206b5df0ead2261c39b6f10d1aa9b10fc429bc2c31975a615a030
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaP0Le5ji0hmxNrM:A3k03kB56rFPji0Aj
TLSH
T1C3654A16F6A44BA5D02BC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 944KB
SHA256 32c4eecf4ea4f1d48b6b47b7a460f3258d4b0761b6049ca5ab2460c27d9ba097
MD5 66c2e91d1a6769ae456bd7d021512eea
SHA1 899503f05fdd645464b289dd03a04e45615cb0a0
SHA512 1778468868fd1ceb9588010deaa598731e295121739fc28012df503411a8dd67a35f12bfc52f78277e6b1dfb7a0995f0359397a0b4d9ddb2a4edc898768a3389
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaRa:A3k03kB56r
TLSH
T18E257C03E6940FA4D10F81749AA64662EA737C025F6097DF1358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 953KB
SHA256 d7a48b5dafe650f7da7839b74356a4e0517fd47fe6b15ba9feda7c05f4234ae7
MD5 4abab214f273cabea071e4fd6634852d
SHA1 d5074e86b34f343fcab922bacc5740ed6b564076
SHA512 289cb07da70d34f2679e01efbb55b357aa231787f9b1093cb88a64834478f27802af885682bc440dc0af8e4cf3e5d67e4d813b33991e673aac277991daab2c65
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYao6:A3k03kB56rB
TLSH
T19B257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 953KB
SHA256 7aa9c53f83dd8b09e8045a6d68126acbc9937e856806d1d2256dde045532efdf
MD5 f3e6bb6528085124ae09078ebd02ea63
SHA1 ea7bedeafad9ecbf761a99d72a1a75a86bf7f9b7
SHA512 9f79923e7fa46b7a6ee390fbbc2ec5e528127c7e442f424dd35de81d70c67e165614cde120aa0c62e3eefe72ed4cdf0fee2bb5a299ed0a4a643f8442e2330a77
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYasN:A3k03kB56rY
TLSH
T179257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 953KB
SHA256 10dc3d1589e7cb15583882b2f6ac91a0abbce4e6fdb257b27e0dee69b579ce51
MD5 41dd127e6982606bd2642838dfe813e2
SHA1 53759a7d5ac7981aa8210d96453834844fef5586
SHA512 8cca0c165b6877324af816169d8ef9b3e11e7d348e2dae337c03ce4f0589f8e9b39a8f9cacac704cb0c7ddacc60925415c9d40070500e755d85b342905024003
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaif:A3k03kB56rQ
TLSH
T1A5257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 953KB
SHA256 794627110028602768111e7f947f9d7772e9424b8b41718f7fac08bdbba7bd2a
MD5 73c4de29198882476d0456436f986e32
SHA1 c86c3c31c1da7b33851ce289b61ec83cbae5e36e
SHA512 a0e54dc3620cbb8eab3e99eca97af7f73b7bcb5257443eaa17b12c2952f38a3499980c84f61ba7f5bbba9734cf516fb4d78dd14984ade693a63ed09264d5af6f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYa8o:A3k03kB56rd
TLSH
T1AA257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 953KB
SHA256 b3872aec751ed497d15cc9ee0769a9a2682310bd847dd4c7dc24c866f7a015cb
MD5 6b31308fbb5586a9ced8a753cfe08e50
SHA1 a5a1fb0a3100e61ab4122ad3250d2923c785ebe4
SHA512 5be95f846ef5c9eb10dec5d28cd429ddc3296ba0f8a899add8bdf64e17827751f1aeb265127ca6393f42ceaa95aa3f7f2a5cf75920fe4f7f46f48995b16eb260
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYacu:A3k03kB56rv
TLSH
T1BB257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 953KB
SHA256 57829d6dffaea1c4cac394c29be6a0d4c56a1eb4c70e528955afa070f91e18e9
MD5 54f33e41ce7242ac808a7315571d3382
SHA1 387a848fc38b2b7d70068a111a992ea339f2e19a
SHA512 b5e3a8f863e8fb1823f91d28bf70422704bd7aa533e07831cdb28089704d12fc0d03e89677e8073583e97d51e9ea68859fd26eb0f3cc75e8d1482654bc210fcb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYag9:A3k03kB56rO
TLSH
T17E257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 953KB
SHA256 bc6cda78f78b5b11db089d14c883ce3b051f1a371c38ddebccc4d4cf6eb85d63
MD5 f483d9d813e20d54aaf9cbfd69fd5c7e
SHA1 b6f3cba54a365959a42d8704a0213cad20183e32
SHA512 98bf70200f53626a7dd2800c797bd348395070ecdcb4161fac90f984ee98044d1fbeac9bd20b547732fea0958502b0c276e2c0c7bb4cb647ec06effc8c8c8886
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaoc:A3k03kB56rj
TLSH
T152257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 953KB
SHA256 4daa39598624597a76828fc0ef76d0c57bb9b1117473a4330bf078db0dd77cac
MD5 10f739aa6ae5bf0f7183aecc7a70073e
SHA1 3df0d07dce25882049776d60c25d22e92bd7d776
SHA512 f590ccce480b17827fbefe9f44917e43e63f220fd1a865db41ae201e4a8eb987e48d0151e1ffe48e2f3c0c056d7880bdd67e31351b7f45be56b367094831dd97
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaBp:A3k03kB56rh
TLSH
T116257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 953KB
SHA256 becf428bbd1b0da0e717ad90fb61c498ac18edcbc302d21ed4e04805d5452d16
MD5 bcd03ddc05f71a1e361ddd228d9f0c7e
SHA1 b3fd4b4e893fa132c78904d3b0d09c49beecadab
SHA512 9a1dc06c49fce42fe950e473c46cec95db1999daa8da263c66090b0ae6b4c6a8425f76a29bf6aab086cc0c6d5fd0c192fa41b963a710048e37bdafe1f915cddf
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaWN:A3k03kB56r6
TLSH
T152257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 953KB
SHA256 fab9ae2dbfcd2223d17b78aab44c595a186d74df1d3215f5b2e900da9bc65a89
MD5 a11bea7d78d1aed12a57ffacfed62a81
SHA1 1d557c7f9250af2b9d0a367cb2ce2b648b5192a5
SHA512 6bce30aaa7c0986cc7f09c3e7a1fc7221c86d1b01ffb661244a1f2f5e61fb12c486a1503ab24a1a00bcc019e8f01d0b20adad15e2d33e65692a41dc585893146
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaaF:A3k03kB56rA
TLSH
T1D5257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 953KB
SHA256 bfad4fb154b906519809e4c141c7a0db602ba589d413d6e680e9f9d00d6d34a8
MD5 5b86473d93cdb37fd5fce8b72be15e33
SHA1 1d9fa36a97cc7e82ecf09349bb03702c73117a86
SHA512 5bff9371dd5aaae9fd897d416f73f1c435e531dc1db282af80175f14ad3156142e0e0e870c32a447f8a52af61eba1b6b7d76fb495e2851fe2fecb7bb3e307307
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYavC:A3k03kB56rU
TLSH
T182257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 953KB
SHA256 a2bb5c7fde134169a9aca775b2ed9bbb3feaba25c205c5de6882740a323bedd8
MD5 cf248e6ffaa29c6d227a74eb6572ea79
SHA1 496d73539191c9c6b0b0b096cd441fb6b63f038e
SHA512 887632bf4ca2251ddf1cfe28cfe094f165d4cd66062b2414e360bf05a11d737d3513757a2d853885431952658aa8d77257c9b582daa7d0c469d316c393d1758e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaQw:A3k03kB56rp
TLSH
T1C2257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 953KB
SHA256 5b96c10904986cdb4b67b3cab597b692e5c5d27b47d4289acfd38722c5de8688
MD5 a3121c5a1a1c29bc969027d05c1b5f69
SHA1 f468a349e31d7fd893e0953af51920532e7e1b32
SHA512 fe644fbf7126d96427d499ec78a281146dca18c217aa12e08daa874f25053b8828e9b2ee20a79379825c7a4db6d07b9262136c62f7547c8e8ce326397fa1f53d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYavT:A3k03kB56rd
TLSH
T1AB257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 953KB
SHA256 d83323dcd8c5b1c18b5135da3f37a38e3b087a6d11cd9eaa46bbdf9a43a3516f
MD5 4931e41a6c0bf653c32f119f81df36e8
SHA1 d73bfc831a86827dd6f6ea3bf9521798323c27bf
SHA512 ba71d18b30f40f0a2838495642574ea8c3b5c6daab4c413bb83d2b63d0fa54801f55b7bb7564ef0309841097c1158c0ece6f623c63649615ea402cf3a83661d9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYapu:A3k03kB56ri
TLSH
T199257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 953KB
SHA256 3243d5217627261504589daf85dcf386b1928945200e11e9a7ae4a33c2b03f6b
MD5 b1c41ffe1e3ba2378eae72d7a0cc8e32
SHA1 b942bbc7bbcf8c042bccc89eef723619192107bf
SHA512 84f706c7d7c6fad4206e72d9f56828f8768d64ed7466e89cfde4d2428be0c41d8faf64935fe05283b76c263b9d10d6381f0e2c0215568054463e5cc61abb06b8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYahb:A3k03kB56rT
TLSH
T1F9257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 953KB
SHA256 f11fd66fff90317bcd4e55e4cff53920aecf9e97c824f8c25a3e0d4aa0e6b73b
MD5 c91880f997e8382b23f967943b4acbc1
SHA1 58bf0220e69a928cf745a83a1efe8f60722f964a
SHA512 e54f552d49e92a7e8c0f4b5a5b6f89236860bc0c87002720f579726ae17ac5a22fa51e6b797e8135c577067722452d66c9b338796dfe480ee627d1139d6d610f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYapf:A3k03kB56rL
TLSH
T106257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 953KB
SHA256 bd89cf36ff155a2259e18ed9141154a0058bcfb269c6148817a1927e258b9734
MD5 937450109e905a80c1d3e47ab21305a2
SHA1 31695e4527606bf742eabf9ba5bbfae79334fe41
SHA512 b91b0eb533f90a4bf67600234f014c4223d2a123a99b5126731e90133836b7e58692da305fb76bf0b58faf3053bac0956db958037e05f4eb9fe836cff44b71b1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaSK:A3k03kB56r7
TLSH
T1E1257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 953KB
SHA256 eba067ec8e9cbd9287280c6312bf92c06bd54e0a916e796b81f1db5f214ea1a2
MD5 0429792b67f474a9b3c56e8508827dbf
SHA1 47ff4d1f7c970b8dabcb8474b58327fa3e109bbb
SHA512 47c1f82d11ce09fa8bf2a1227230887f29ab4669a41965aa6a5f6182d994d609c00039d54f29fc29924a75e7a204b816b704e58e626751a813833f3cdd03e5dc
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYa3k:A3k03kB56r2
TLSH
T18F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 953KB
SHA256 ed7d04841e30c779f30241a96e1400d3f96dd4fa2a7bbe272bb87328bbae90b2
MD5 cf0e4b9ff41030ac12593a660af7381f
SHA1 0e74edc5bec02ece37770453733b88809b25c09b
SHA512 cfe54483d93b94faa2e23f59e4199850f803b15bf228287848d7d043d5b538543d8731e5cf772a006f46b91afe95f0ec39e7737941844a15c5164f8d12443317
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaA0:A3k03kB56rL
TLSH
T1A4257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 953KB
SHA256 423f34f3495e14977be4398bf0b1526fba124399deba7cce9e5cfed6c4fe7a8c
MD5 340f893b3f3656c7a4f6f1da10f3a8fb
SHA1 04ed7b2ec5b4faa6ba6c8539d388b49443aaab83
SHA512 5d65092876010532d32cb4341d13b13da630729953fb4b7b53c91ee53a4116764f4668187b2cab3f1189623192572807e390fb95ce9a4f22ba7b91bff3089162
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYabg:A3k03kB56r+
TLSH
T130257B03E6940FA4D10F81749A964662EA737C025F6093DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 953KB
SHA256 c07968c16736b0d8c761ab99829dd7ac39aa05c6e21abc8e7ad3a5ba70c51bcc
MD5 254efd25086b12b7073dcc89ca523231
SHA1 2ede6a7e55ea4d8244442c3e9ed7bdd1333bffcf
SHA512 13855462868a8d0dee6e0d83eeb1715c7f389d2aaa1f814456c3d2f3f0e4629f79ba00aa08ceb4ae43ca26f85f7ff12e9126da23509e92e803c42ad3d334f0f8
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaWr:A3k03kB56rA
TLSH
T114257B03E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BD0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 953KB
SHA256 33ace8ba6be1ca35fed0adca8c2194bf9ea6b6b7d231ef6567dd717474ada33f
MD5 b224f4da55f8f9d0f9d8d6d87ac29e7f
SHA1 6b7ddb1b8f3cbfac8b8c36b12c1df63d433299a5
SHA512 edf6778464098042fd7cf25591b3c6a5ea81dc0cf80b8604b3ac401d3d1c6c8b31c991ae4a65314b22b9bf14b803fc68914224085cdfdc5d61eb27e9eb356896
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYa8n:A3k03kB56rS
TLSH
T159257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 953KB
SHA256 380d7ccc90d5c61fe1887e8efcfab5bc991106162495172a0b81f48ef8a6c144
MD5 a1e9b8da162f8ccf9c7a48c5ef843bab
SHA1 b2c980f40f8d777c855d0c9542235b032f3bd999
SHA512 3b6e88395c1ab012041d6ed039ae54b113489a1a57d6b2735a362ba884619d167e268baf0f0ca031124ed73939dc2f4757d8220f4c61b3e9ee20affb3c3ede19
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYa6x:A3k03kB56rg
TLSH
T1D9257B03E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 953KB
SHA256 c590126ad1712b7b54c43e00e91d91efda343d3e3d79056f7c4e487d985e651a
MD5 9c0dd496975207120f61ddfa16e2263c
SHA1 5f30be2498746eb8a1d41d0506c500cdb4bb0857
SHA512 bc21fd575e90f6cb7f2a499ec816172cafecbc532cfbb4222a37d7df2e6f1c4676beb3701e2c7cb19c0413c2c731e8f45ad41d83c444068f294b274d5184c830
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYa8A:A3k03kB56rD
TLSH
T1BE257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 953KB
SHA256 4da5fbbb54007376bc58c929e61d45149fbb76f32fd8ae27dd2c4f18f892565c
MD5 e2660617e03be93efeb0356ae13cceb9
SHA1 20eed1cc9d75ad10947a3c4412fda4d035660744
SHA512 3636617c83364f9874af049eedd08024fc56f246a217e0d8b102c70f09b476e5e4fae81e2dc6ffc11d1354e0666538dc2193b6f20d4308e4ce9832e92a8f5ccb
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYal9Q:A3k03kB56rO
TLSH
T193257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 953KB
SHA256 837c24852a4bc18d615b2f344f66cb495447d61bc55482228e6237c54458f987
MD5 466a811208644f14451a7d8773420f37
SHA1 2713f2d4e27a36a5a657ef835a0bfe939d487394
SHA512 fad76acfb8c51eb0147f90405759919f2a3ec612e415743681468bbab865dcba317fb9041edb230198b9e1a841a6c3b7e7f01724115492f077d7dd912b17ad0e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaQ4:A3k03kB56rt
TLSH
T15C257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 953KB
SHA256 4b4b0524c373157bb01acb9325a013f8399076018a7f1f4197209192148c78e8
MD5 bc643d8e7b99e70677c0d181f1030670
SHA1 f7e9d60b652a2df1ab742241365cf86a8655afd4
SHA512 1e8b3123ec7acc5b65b6cf521e4c7a9e11780498465265724f544831ccda4a124d61d9ce3c3b04a6bdefd377f30c8242ccf5893b818befb7f6f9d8bdf5354015
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaTu:A3k03kB56rI
TLSH
T164257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 953KB
SHA256 e00aaea4495bc0b9db312a1f52df6636ef59a81f9ece92c20acd6613bb5242e2
MD5 94d1709f1042c9702f0855c4ea0f535d
SHA1 28a9531aab7c6efe182d155ece5260976b9ef8a7
SHA512 572e1bc1b910d353f8aaa4054586b07176faf3a536a9c3c900b24a10c30ad7ce872be0b4367365c5f546d51675274dc15aac61d3e2228accd578264189954f1f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaOj:A3k03kB56rC
TLSH
T16D257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 953KB
SHA256 0e47a73bbffbebd939ed4bcdfc1a39fe95e9228fbfb345d69a66afde46e7bad4
MD5 ed8ed970980754ccef661bbc33f3bdfc
SHA1 46a8d3e28477a0c9423957fced5b9a0c4b8195b2
SHA512 f6c7b460400df75b4da60a92c74e9230e6f1f69cda525dab42a00aea5b36bd80085a3de38ca3b6726f31390787c4b87637e81b28e330e46c5cb495bc18741d02
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYa7g:A3k03kB56rG
TLSH
T14E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 953KB
SHA256 76830f78450ff44982f98b3b3e294e41c3ebd1da017e84a264e7dcb82da9580f
MD5 3dbcdca828018027b73026fac63f99c6
SHA1 377dd79a5d0e0ea0db2f7c2c6f68060afc440b3e
SHA512 f3180ebc6dc66ab814c67e00326c90b041cbd833bd204a61f1f435edfa3da9ab639cda0871c840286860a6b83da8f287a82f00254c78b11469b31e32f24d3ca9
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYamI:A3k03kB56rP
TLSH
T12A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 953KB
SHA256 fa960e01bf92bfe6da47a9b13a35802d40b4679de9d387b0a94576fbac60429c
MD5 b4668f4b21cd1c3482c10a48198f2a41
SHA1 aaf47adefe1a75335d983b96e1707df93167b915
SHA512 2839d7a50ce4a973ea086819994d1b7270d1a34bf8b601aa238bcaadf0e30ea110ee805217f1071cf47fbcf44bad642e30607b1e6024bbd9f0fe0744ab473e51
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaUo:A3k03kB56r5
TLSH
T159257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 953KB
SHA256 0965ebcdb65894770b530518f80469fa60fe6a0a3941d811f28f05f54e9b4028
MD5 7c8ccdab00685d533955746623406f9c
SHA1 c1bf476ce58fe933aff8ea2e0b1f5ac9350d282e
SHA512 3fe4d7d5e942ec124d4bb5e7f160d66c4a56e1655bf2087853f37c993b8e0c1da20e423e3f9fc6150908af18e3367c660fbfac399f50de0d12c36ce890b110f6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYa3+:A3k03kB56r8
TLSH
T1B7257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 953KB
SHA256 ebd6a61b1d6d1c89c537455e3d78f3fd02fca346242de16cae5728856b0809a5
MD5 7bf928f9849c9fe02bca790b366c05d4
SHA1 14ec3edc274df19dd09c87b2995fb10a538f3e5d
SHA512 edccd95ceb4c891267dffdd32903ef948d60543196ce178d5d6bbac2e8d23ed9ba4b78419f406afc6b98942aec886acb95dc0ab7a097adb0667dc76d9974243f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaNQ:A3k03kB56rU
TLSH
T186257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 953KB
SHA256 3169782a31694f4f0db83da3688ca37803fbb84cace19c4675b75495e4db4363
MD5 488f5da859764bea11dbaa6c7caae4e8
SHA1 bcbb445a54f335c46c2ee48138d1261bffefde3a
SHA512 672068d03aaa6a8cf5f90668c156c5a0fc72cb85931e222089de842642d5155117fd836ba732e060350058e679f77ebbfbbd9ab6b4d7ceefb58fa33f82f20bb1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaCX:A3k03kB56rU
TLSH
T1C2257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 953KB
SHA256 17ad05d017e7c32679698ef0b3042da601cdb50bc3562a98ddc70f849a3e522d
MD5 5f7ac37400b01f619f240d261b7c9f97
SHA1 4c590575b130574f20c2172b4f9b2ee8c4c33956
SHA512 ab0b4e8150b0886eb836439db18c5073c871e9f278d371c75eb7b9bec1fd056f02c9c6221a8f66ead9212141f20db9a9695b8461d4982514da1c5dc3678a8187
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYakL:A3k03kB56ru
TLSH
T1EF257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 953KB
SHA256 d2ca51824771d54d8b72a75d47cc9808de204b79412c370892c098a0a1427db3
MD5 33d0cd2907b6547a122839ec7b95222e
SHA1 667af1eadf063e573f3d18ede752fa30abe5ced5
SHA512 3070c51705e351b9187d53697a4b0aa526c498ba57f1f17ecc033056cec45a321ffaecd824b8cdcabdbe9dee7d3979b790caaa37021c9acde241142a062df119
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYaAM:A3k03kB56rb
TLSH
T15F257B03E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 953KB
SHA256 7facd016759066b37d52cfad23cc0e0af94f3b3fb9fcd09d05cb3ecd3072c6a4
MD5 b48be58342e4543eec408182cfd3f90a
SHA1 c1256d771eb4eb0fd29ae22f25c07cbd7bf5fe3b
SHA512 a6d7f3e19644e6b15a571f68f71bf78d747a6ec59e25c551638004c3ac8be525c512b51e250e369c503b19411eeead9f7d80b5d64a514850f58fddb72e07a206
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQmYahh:A3k03kB56rV
TLSH
T17C257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2948-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2948-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3184-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads