71b784736228549f1e39249edf33ae8fc6fd0679cbaa2e88eab3e40bcc22b15d

Analysis

max time kernel
106s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260807-aaevrswycs
SHA256 71b784736228549f1e39249edf33ae8fc6fd0679cbaa2e88eab3e40bcc22b15d
MD5 fe7e62384d38feab9d726407fe696940
SHA1 a6e3eba9b20012692e10b4979888988a81aadd33
SHA512 282fcf9e46956dde7634ed946e4a3a26d668496378f61f3a950513930c7acb157ec6f52a2e8cf0adbcbf625400d9410e32afb5c81a77249dbf3454a72b4ae864
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGC:A3k03kHRJq
TLSH
T17825AE13EB9504E9D10AC174AADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 41 IoCs

resource	yara_rule
behavioral2/memory/1556-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c506-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e1-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1556-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/528-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b2e6-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bb-242.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198bc-321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a3b-472.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c0-509.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c1-606.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c2-655.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c3-735.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c4-791.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c5-840.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c6-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c8-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198c9-903.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ca-922.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cb-947.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cc-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cd-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ce-1090.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198cf-1133.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d0-1170.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d1-1177.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-1263.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d4-1330.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d5-1362.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-1388.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-1389.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dd-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-1436.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 38 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c506-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e1-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b2e6-41.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bb-242.dat	aspack_v212_v242
behavioral2/files/0x00030000000198bc-321.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a3b-472.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c0-509.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c1-606.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c2-655.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c3-735.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c4-791.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c5-840.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c6-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c8-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198c9-903.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ca-922.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cb-947.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cc-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cd-1047.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ce-1090.dat	aspack_v212_v242
behavioral2/files/0x00030000000198cf-1133.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d0-1170.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d1-1177.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-1263.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d4-1330.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d5-1362.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-1388.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-1389.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-1390.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dd-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-1398.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-1399.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-1436.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
528	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\mpextms.exe	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Mail\wabmig.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MsMpEng.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoia.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpService.exe	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe

Drops file in Windows directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1556	2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
528	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_fe7e62384d38feab9d726407fe696940_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1556

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 71b784736228549f1e39249edf33ae8fc6fd0679cbaa2e88eab3e40bcc22b15d
MD5 fe7e62384d38feab9d726407fe696940
SHA1 a6e3eba9b20012692e10b4979888988a81aadd33
SHA512 282fcf9e46956dde7634ed946e4a3a26d668496378f61f3a950513930c7acb157ec6f52a2e8cf0adbcbf625400d9410e32afb5c81a77249dbf3454a72b4ae864
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGC:A3k03kHRJq
TLSH
T17825AE13EB9504E9D10AC174AADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 b6f49e06b71afbe8855331feb1608c9afaac504d348055a62d8ec5841713d14c
MD5 691b1b21bfd6a90823af788a2528930c
SHA1 7a22b3daf3142caa276dc7d2a2d56cc3bbfe03b4
SHA512 2b220790814c0fdf60e70f61608e7283409e080637c829e9908d781bcfa0972a8a609671352e8c45d62f9c148bfdbf5d3ebcd2cccac80a1c311383ca27dfe7b9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGC0Le5ji0hmxNrM:A3k03kHRJ6Pji0Aj
TLSH
T14F658C17F6A402B5D027C1B9C5D6966AEE7138821B3086CF1359C7283F63BE19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 4650f80b1df6293acadc7e11f3cc9c0af050d111921f47bde41fc5847d6ad000
MD5 8bc9857497913bc9a17f72e3848695cd
SHA1 f807fffd183b39508689a133ce6d94928745d699
SHA512 0a6a66ed79636c695633a7192cdd6c18d2c3c9d05f1a06bdde5abdafc2a9b61b3550965acd8028d676107fba9604be106ba63cdb9a1b9f81cb18230ee6109a36
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGMa:A3k03kHRJ
TLSH
T11B25AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 8cb914077e62bc82fbcb80e841599e4449d5b6bcfae7b6ea5b64c0e2ffc2bd47
MD5 4936e1d05637bd905af3ff014abd384d
SHA1 9df4e1963090f0a95e4bab2fe4e607ce1cb1ff96
SHA512 7ff167649a83b407765bbd7a207342fe9a82a4823c4c0951b00e3d116c74fd764054bd94180b94dc4623ca2ff77639a89ad7211d85474c0ff135f204f107c1ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGl6:A3k03kHRJE
TLSH
T19425AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 971KB
SHA256 9589606e97e7a896d1ddb5a7448c74364aaf98b1cfea42d8c3a222ba5a34d6fd
MD5 e094379c2827e7ec67cb3e454dabd0af
SHA1 22b6ff78014be1df17c2267704811c69a9da5d6f
SHA512 9b4e808cbe4943e195b7eec74681126adb7dc99bda4e803a78266fa4779144003a970a417eb8fca81aca08320db090a37c32a49fcf5c074a66998a2fc380d4fe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGbo:A3k03kHRJs
TLSH
T11725AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 af018798a2e1b72ac6afc8400b80173d596f75b703d5a4f9ef3b20fcc799b434
MD5 42e745e7fc238ccca6a7116c8238edf9
SHA1 67a9f410c58a8341d1c1a0af35231afc52985716
SHA512 9151f55a1b869b2909c2eb02e3143cac173420038cd1c5d54b59d343062e57bb61ac610e394bf3ba01a061056c98309912ebd4f150bfd3937a79a68b5cfa2692
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGPu:A3k03kHRJO
TLSH
T15B25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 ac42929c06809b76423a701c0d167f573b76397e5b3f3dcefe6d2d3a611f29a5
MD5 ab72415c9f0e463d66ca1e0815e7df86
SHA1 e17810bb3a98a3b0c88ca8271d416de416ae66af
SHA512 f1109c999f864f56cb3e178077795ded86c965d93220abe8b02ab1fcc23977cc17a46ba822f255f34412cefcc0c5412b8f956435ba36133b13dec9d9aece3e25
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGd9:A3k03kHRJv
TLSH
T16C25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 c87b4f53608302644b274b752c1333ff90247927ca2696ece320ec09e5c2cffd
MD5 ea4390143b9c48ae8999828dd5f1cb79
SHA1 925a132803db0a44eb4d4af1b711141143f459df
SHA512 7678eff14da1d19795b092a54cada9fee97500450070f133db29e3dcaaef392503c3c8bdb8fdb7e70874bbb4e60a8998c5ed6b2fd895f8e92e07f9f6d1e89dea
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DG5c:A3k03kHRJu
TLSH
T19425AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 0cf04beecfe18431e93e5a38d0d208f519ebf97fc2269d367da409098e79284f
MD5 a238717a692ff5b41ca7f65f5b2fbef7
SHA1 14444ec39dc0926109bef68953203b44a01e0df2
SHA512 7ca8d70f608c13f5157a3912e8b3695e1782e3464233196835882fc09bfc44f9683e15990ce6ca3cdfebc830eeb99e480b84f3e176dc98432fe2fd174cedb6de
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGyp:A3k03kHRJc
TLSH
T11225AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 3c14b1092d2571a83e949b15540832d4c0a4eefc68ffefc9e7e934d19514d645
MD5 803e0d4c21b566562876ca2958545f10
SHA1 f3b41d71b3cdddf8eaeb344d9f56a2644d15d063
SHA512 c5dcdc424b58bccef4f45578017926ab606844e2000a35df49ce5439489e0b0fba14a2f045aa10bf9a7c40e6b37371536b631102f7e2bd7c1a2a246926fb9627
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGFN:A3k03kHRJ7
TLSH
T19825AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 fd75a1768a769f6a47732f6a2645f99c2edb7f2f616ad2fb577db005b813e3e8
MD5 7761a83dd8718abc6f8cbec4c85c9993
SHA1 39427bb5605956119d921b6e797aa82f837be653
SHA512 e0ec8c927fc84778f6f535be84f177158908347f628579889def054c1407f92f6c1c6372cfbb3b110669498d4805c9d9b2ca13aea8e397553976122dff2b5f90
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGXF:A3k03kHRJt
TLSH
T1F525AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 87573b07c0861eb073b0e229f1c247fa6733aa01f9a07d77965305a437a64d6a
MD5 f4e7be0906791247bd83755d0dcabf54
SHA1 7a17fed8fc19b744be247f63d27b3943d8636c54
SHA512 1e70a1447d131a89421b4fdbbce34167b6a85fe29bf3ac980109d7fe0c69200fa09ad173a8886c00407a030343328c5712c46ef6109deb9c7e64439e23a4162b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGoC:A3k03kHRJR
TLSH
T15125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 001e139055958b99d33f9a2006653d638dd4ee36c99e11fbee757938f33e56b7
MD5 6e36faeadab74bab88f516d162a26982
SHA1 716b175e038d8427b521f60230d7c4b53cf20b02
SHA512 fadff9fcc44c06a9be428b4f7b9a26aafef2261c986c96f2d4cece42ada70a8bec82d91d195a996db30faaf4e8b25f782ed7e3a0b1e07644e5fb1fb1ac4a2cf8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DG7w:A3k03kHRJc
TLSH
T10E25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 e3efc6ed2d5bd88f23e82dee5f57e6ed74e12d86e3c2c0cb6b84f8ce4c2d8f7b
MD5 5cc15fd7e048c93625fbccbc4f210c24
SHA1 8dd426af82d1bbc117194b2d09adadc1c88e17d7
SHA512 06b75dabc7528f950338a86288e99c7b0c59f55dc54d30712b0af1c63c11045b866bd2b34e9e811215a8c942fd2a7a06e9017df59da6fd25ecd860992572ec75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGCT:A3k03kHRJE
TLSH
T15C25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 a8d2258d1f2c277c015c641fe1c2e3f7a290b0730b051b1240a921c38b2d18f1
MD5 ab70af4b261a32c5222548716f664ce2
SHA1 58005da1d69c3f04b66af8791f668924f35044bd
SHA512 ecc096733a95f3647022e22b3e054457ead3a0539c25e3eb61687cb54bef1458a67567a45a8a51304427a5a903d5389c17abf49566c98ef9fe2cee8851a67a5f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGSu:A3k03kHRJz
TLSH
T1E925AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 4c221af8377385952f2c3044f774d7cf46543f025a1f1b3bbf98d0f4ec1ec951
MD5 5aecefed4556181c3ce23f0ef0e51502
SHA1 83725ae663c310a9a819f4cfc2c5a5d642110567
SHA512 20e710bf0bb936958b0adb2ee55be634c3e5477fc69250ad56186fffe5a276665086880104354ca2761dddc60c11ff2c61bb0e235071d47c6b61ae2ebb34102a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGMb:A3k03kHRJ6
TLSH
T1D325AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 c0215ecc67008b8efed945271ee3ba8ae82e5d076e19c74a6df2ebd25953210e
MD5 f537cb35b0aaffcc4801671b310c958a
SHA1 b0f0aaae01a8952bd81cc3ca86f2fe9a9ef7fdc8
SHA512 e1f13f9064d8b2a29d2c2dbdd4e2e6f537634247914622eb33c2c6d1cfd344546df5bc767103d3affa654a52148abacea3bb0fbb10594dab2c4afcd9815faa0b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGyf:A3k03kHRJK
TLSH
T13125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 97905b0556f3cb232f35d79b35d07a0e51bfac9d6b4022f6b8406ff2e000aebe
MD5 c5b3d93afeab6a10450bf4138e26e11c
SHA1 1678cc4f1959fcc92ee30fc58a25d62e585ed505
SHA512 707740afb9ff9ac9aab0b65044f69da7b44bec480e6c9d797481dea8fac1853be19f9f2be9cae90092208f662061689468d70dc174a1f3d95cc05baf526c89fa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGfK:A3k03kHRJK
TLSH
T1B425AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 f8e101faf2fa7964c593845273c23920a4b32dda5942b689b8becd6e49c028ac
MD5 e8520e3f6b6df40615b224b6c6c025b9
SHA1 5f55836fc32bee0bd34a7ae8c520776552277e88
SHA512 a6e502f509811c13c908d7f81d75733367063b38fefb29b004e5cd6f5357b586d6e869039fd0a0587de8a1cb3e6fb3a5206db80d5291bf65775f34037f8d512f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DG4k:A3k03kHRJv
TLSH
T19F25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 04e04ac4e5627876080b66cba837f81aff1c17875f7682f923db736fddf686b3
MD5 849115eb5e63df00282827cca7889118
SHA1 d101539e729a8698fabcae66a72702ba1c539653
SHA512 a5ee0749ff56ac74049bc004b8cb450712ac2b679eaa1f7492224ed0476bf44b5746bfe0f0bc1097ac95c3a6eb0103454dea10a0f3b21dee0231d05015698613
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DG50:A3k03kHRJe
TLSH
T19025AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 1f336c25f7e400d3674e516e29229abfd8ffa51fdd6bb467e3c2fc6cde48fccd
MD5 919b61a893d02bd41bafa9b5881c224e
SHA1 77e380249cb57c329ba2976899aec86dae0e100e
SHA512 15be8d7c035fb4b7132508a0bafeb742bbecda16b0f7ade4a440589f85e76f6db68e5135a371e5c24ab485a6933611e7f13af18597d56fc00080289e535a33c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGsg:A3k03kHRJH
TLSH
T17925AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 414f25737a22bd7bd1697484d1b5faffc006858996888757f13a30edee38432d
MD5 dcc7f6f7c3d16b40ee3b523b3de16c2e
SHA1 0174d256b9a83875017d61eca142ca6ab9c46a59
SHA512 d84421e2b87648f9e6fbe1eb9bc360a61d75c37b61c9d653db9a9fa609d58eb2ef9e11307e615e7a6c2d29b112a8b0322ae2ad7816f67fdba200120ed2927cf5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGJr:A3k03kHRJh
TLSH
T12C25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 706ce38d48257a6d57003f5c3e49f6423da368398258a4db77e4a70b2888c795
MD5 0b8a4ab49283a2a5ae3e54e97e1624bf
SHA1 35a105ad869ab68f420cdfca47794ad4f3701f0a
SHA512 1e8794893527ba66bdfc05b4c9e9785c79cf4e6a970eed7e7292c5d6f6aad372d98814505279763fda3af91c5d9a81ba2dd09877b0aca115b13bf4fbe970bbc6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGrn:A3k03kHRJL
TLSH
T1E825AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 a1258e081d067d1a95c8a13a48b2f59d237f9ebdfa30d0fba4228ccb31a6523e
MD5 845b75778bffea859f3292ec543a73fe
SHA1 67af9864bb3c8490b51bc7b5ae8963fb0c349853
SHA512 5a0d65038faff4da6e0758b26c89a11d6d5c986d8873d378ae62ead16254ed9336a6dc098684006b5635df146a947409407e7c859ac26d8d683dcd716928a897
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DG3x:A3k03kHRJZ
TLSH
T15525AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 e3829782a13c7415fbe583145e850e29fede12691b4b663e17dcf34de30adfd2
MD5 df97be3c9cde76b0808a174cd7b27d5f
SHA1 25b21bf5218fb92b95d866bd06a27706a1f33e9d
SHA512 0bef0afd430fba87b955e2d27d6f21b0ea567a40071ec9b21fb0e91c2b37e5fa436eecf542ea963ef37f7b0baaa8e78b3ce4e588580fe9ef7f874484540f12b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGtA:A3k03kHRJm
TLSH
T13025AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 1a99d1bd9cf9bb41be15124f09b32088a062ac2348b64cdf4a4f7a23fd349cb1
MD5 6f1bb1402669666510debd57e741738f
SHA1 7f98459ee4cccbebf6dca4f52d40e7e1c4d5983b
SHA512 8cabad681105c51b38b7530e6961e75ff1f900b8404a99251a0ea6063399b6c39afad7fa6c24f25e2299b3a9b0ace01d6244f90284f4fd9d54199b5fc238cd2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGm9Q:A3k03kHRJ7
TLSH
T11125AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 9937770801de62e3a69c6b8ef4a45d64eac9904e9c0b5f7693b623e50efa6dc6
MD5 33f0c6da1f58c997fe9aab0a92aae10f
SHA1 9cd9fc94d282a8a58cacb675eb6726b41263ab29
SHA512 890b743b49a65ad11f3f3d2de7b95a1676a08274ec42a6f32b660432fe89db5820ef5d15cdfc76a6f6dde708741e1dd4f708031eac1d7b95f0d33272395639de
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGD4:A3k03kHRJs
TLSH
T16825AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 b21ab69cf2323f22e3502d563ade4923cd1ef21a930a06e3ba8a22aeed2f68f0
MD5 9c97968e7aa83d1e3560b24c0223eea2
SHA1 d423698ab07b14d2573c8ab79eef5a9521830222
SHA512 ea65020fa46dd73243aab830fe0e53701640e2daa512db9e9e7c2e15b70c4e3152d975fa85da531d28709b78a9ceb46fa844f12e51fac69b613f1a0224f6c4c4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGqu:A3k03kHRJt
TLSH
T11925AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 3409d2594011e88d4a6ae26e7cb1dbdd8db69df5317c46722e145d6a4aee5daf
MD5 0b943e724e0b10a10c44e512655acff1
SHA1 5981096eb50f82eaca4f1a9aa0780efa7a9c9975
SHA512 1b560ce1473323e449259f1916898b0173fdba120dd75e83a3dc6e5287da058f340bdf2e890b6af681bc8d50df41b18b076cbf30d685eff76121bbebd05fd1ca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DG7j:A3k03kHRJP
TLSH
T19425AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 86f995d6ad1aed7549651946e81329a5a935eac1af8828dfcf0d5f0ab7891931
MD5 766ad3a077596cea4f107082f7497b83
SHA1 a81ac4de46010c99760cdff1af9972584d27dfa8
SHA512 5271c8bdce9567aab69972bae5837222556b7f20a864b87497cc028aa4ca68de0aabb784441dfbd0e9d49188e45bfddac3fd85f3c9c1445c348ad3f9bf1b4f6c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGGg:A3k03kHRJH
TLSH
T18D25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 4bce362c19aafb46e99410b5307fbbafd530bfba0ffadd3f2da4763e3a85bab7
MD5 a4065e8562267eb682ba5644e56c7f1d
SHA1 54cdb93a7bb0fb250b1ee458da1e5d4b48766827
SHA512 35d8683cc0ef1fbaa5b3fc4d413cfe5d7501bb1412373f4562b795bac2478e919adbe61acea7ea70a723215384f6f4c012fa59b776bdc338c27b66b961e9784c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGpI:A3k03kHRJm
TLSH
T15225AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 3d3108bdae08ed4550f3670bddc72e206668f8060cc2d791f3b03b1f0aae9617
MD5 d8ca7647b96b807938cb2e5031410e37
SHA1 c9d29d3b3fe89e9415c1bfbbde69af986d696a5e
SHA512 77410f34ffb569a6319dcab70f72f418795e5d7d104338cbdbbcaab3bbe2457fa327aaebecf47712847ade8846a8ecce4d49d3f9aac77b6b8994bd66f9003644
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGLo:A3k03kHRJ0
TLSH
T1DD25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 f05b0b73f67b3a78ab53397f80934639dcc8942dca4810af7a5e3e71211e5881
MD5 e2e8be3d7b29ee7ede9e0731cb756373
SHA1 00bc240cbd23e2ad67f5f03975ae846f088cccaa
SHA512 2f6ee05f3509a83dde4342dcfba51b296b3eab0fda765f725f47c4fbebbe460b20b2551d8265a6f0edccd2261c4133e1fe9cd0d0ac4944bdcb4ef1ac2c3d6649
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGw+:A3k03kHRJp
TLSH
T11F25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 fb9fc40e3308c2c2bf7ba479b5eed8e872a6e0d2d411fa3d53460dcb7578bcce
MD5 cd128957874a4e67adc78e49c728a040
SHA1 b24a14dca710ea602365cb7fd6611e2505ed601f
SHA512 66acf104c3d791094139f12dfcc6f00e25dd77bfd6315f3d01e5514443307bf96456a3c62d99631ba0f4a65c9e68e845bc5dd8434e88a854c23cff41cbf1f2e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGIQ:A3k03kHRJ5
TLSH
T1BF25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 13092b53d7f9384d7b1496cf6371ae040bf56b24e8f093911f94a6913091e7f8
MD5 0c62218a38326a7f29cdf303ca0fe97d
SHA1 76b1d6d70b25fb5532b8dd082a9ee119f1a4ed4b
SHA512 94a4a63b2b7c80555431fb53e5a265eddfa03cc5ad009ff500ff89c872c770c57230c812e826bd5e6b0779ecae796cb41f03070ef7793008aeb3c2697923fd97
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGBX:A3k03kHRJl
TLSH
T1B625AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 c05a6372f4547937d3222eec19c66724933d4d1214e7ea60111c45a73276515f
MD5 151ffbb94da5e5aefdeda4d62ff45c76
SHA1 3b1bb5c525a5a1edc97bb88f97f6fcd29a1aacd8
SHA512 eb38a6086d2924378b95df4b4caefc29ff6378990b4b41852652df264e3d80268da2e99f41797d173b96378feaf7aefe92449df9c8509baab9895b2766109011
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DG7L:A3k03kHRJX
TLSH
T1FF25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 61e353a6449d00423cfbfa23dd949f41bb000d3bae74a80dfcab4f1b04b43f69
MD5 dae5462eec3b83a14a9bd1e00fa07e42
SHA1 5f660a66594a1e95d125c4a8e332c2b289876fec
SHA512 9b08c4dee13eb011b32ed3a23d55b53564e505a7559ca0108c1c013910f1dbd20fb1670c048daac24cd8df13bfa3b9792d5857fd8dc78e2641f4f9686ddaba61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGBM:A3k03kHRJy
TLSH
T1D925AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 cd43db72dec209da49a53d0adc28306fdc4a2f8e76d42f1a047f832028d10406
MD5 a5fea8693cdf94baf42fe354f3806868
SHA1 70b41671ebbddcf0c02e181eef6e57e02e0970d7
SHA512 83496cf44e03e08ebbb83347f78458f0cdc2afb4149fb97540204f7382c6d53e4ddf93bee26ebc820ef5cfe43a7ce5bc26b57a93839bd44b35a164fc24ea1abe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpx9DGqh:A3k03kHRJs
TLSH
T19425AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/528-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1556-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1556-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads