457879c315ff7dd6c40525dfc5ecf92e394a8256e3c4809e718f4b75316fc417

Analysis

max time kernel
104s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Size 948KB
Sample260808-rx5hdasxdy
SHA256 457879c315ff7dd6c40525dfc5ecf92e394a8256e3c4809e718f4b75316fc417
MD5 5568036d141fbb91e66ec4cf686880cd
SHA1 c27b0c5488cf477b788a35d79b37f34676fa42b7
SHA512 c25a00bcdbbfcaa62f369f5766b3fd56fe2f6d604b86705ef9b4456161ee1fb6e4f17980caa1bba4f2ea59f8fd114a6884fe4337ddcbffd2ca39f232fe36a97f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3z:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CD
TLSH
T16F255916E29004E4D46E8135CB954A12F7737C2607E086DF13E4E63E2F736906EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4828-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000f00000001c485-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4828-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4256-71-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-228.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb47-452.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000198da-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-587.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-704.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-784.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-924.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-980.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1041.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1060.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1127.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1326.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000f00000001c485-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-39.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-228.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb47-452.dat	aspack_v212_v242
behavioral2/files/0x00040000000198da-495.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-587.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-704.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-784.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-924.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-980.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1041.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1060.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1127.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1146.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1217.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1326.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1370.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1395.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1396.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1397.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4256	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	patcher.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{19C38D80-0C26-4176-9E53-8ABFFD293E4D}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4828	2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
4256	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_5568036d141fbb91e66ec4cf686880cd_amadey_cobalt-strike_conti_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4828

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 457879c315ff7dd6c40525dfc5ecf92e394a8256e3c4809e718f4b75316fc417
MD5 5568036d141fbb91e66ec4cf686880cd
SHA1 c27b0c5488cf477b788a35d79b37f34676fa42b7
SHA512 c25a00bcdbbfcaa62f369f5766b3fd56fe2f6d604b86705ef9b4456161ee1fb6e4f17980caa1bba4f2ea59f8fd114a6884fe4337ddcbffd2ca39f232fe36a97f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3z:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CD
TLSH
T16F255916E29004E4D46E8135CB954A12F7737C2607E086DF13E4E63E2F736906EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 8b881299337f9c9d8aa787ce2f7b7629d541b0e474470ecb572ee7f9955a6edc
MD5 92a8f818a4df03c82da33e2e0758b280
SHA1 1ea52335e3d36f1df929481dc720f2bdf55d0dd4
SHA512 0e62a6ff64660de4f287d022aeadb65f0f05a3ccda43ec1ee8fc0aa025080f0af40bbb340b8800d88a784ee654ebb117f64745e207409cc5ca45c1e2392d2212
SSDEEP 24576:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7C/0Le5ji0hmxNrM:A3kM43NCLTYPji0Aj
TLSH
T1AB654916F6A402A5D06EC079C792965AFA73384207F086CB13D4D63D2F337D19ABA763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 1b8f59b2238899ce165ecf0db54151fc2df9b8d73f6a0bbb3faa16dc56ea1f5a
MD5 2aa65154bcd6da122801287c168fc6b1
SHA1 112f5ffbd82bba54375cdd8a6b16c90fb0d010e8
SHA512 0cf5e97e2725df37f193db2b2a6b70bcf566610c17f3b14481c31f790b2e8822c8bf3c06bb3ad9f230f80069096e7fed564b8015fe74beccaba523e034f0b6be
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3xa:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7Cha
TLSH
T16C255916E29004E4D56E8135CB954A12F7737C2607E086DF13E4E63E2F336906EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 c3754846638e00c038b0f302426a5d1b82ce671ab4b781b1206265b691be84c7
MD5 c78e9e96317ff3691f1bce38e8cca64c
SHA1 339abe7291c93cde9fc20c98c42e476f90c612dc
SHA512 7c6b7d142b6555b2a8c0e01097ad2bb6ac456bbbe5813c49ba3ff7c486579a9bba0c276326cb47987b5a5364316c43c3453032e8968b2867de0725333c0c15de
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3I6:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CY6
TLSH
T155255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 971KB
SHA256 0da9d7631466d8881c83c48989fdcb91849d9b577a889efb87609c4687aa9bc6
MD5 8cba00a75aa3cec505e9a5b879766953
SHA1 5600d4e2d0ffbfbcf236965e371ddf2f19ea3075
SHA512 ccbdf1c78c2c9598d169d0579c3575c2a64b1d29d6b13957acf9a91440c7933ae672d0c60c019280cb72b6bba2c83a2eb0b415b5d9e065f02c1fb306db03bd00
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3MN:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7C8N
TLSH
T14F255916E29004E4D42E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 971KB
SHA256 cdb5cbc39c7f3598dacd053b54d30e3d6d9c92755fcd30fbb3f8b8af0f8ace4f
MD5 64644ef2a95c9fd559f27621e1d5ed3a
SHA1 abae7e01962494a1de24165646830994847b1ce8
SHA512 08bd88712a6cd82ed6d29c62c3f1998dd609c2e5a319d090ce72b1f2f7321d234295044c4ec914b524bf1e7327a81b26f3d732b942e14329135363367ec3425c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3Cf:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7Cyf
TLSH
T155254916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 971KB
SHA256 cdd7f71f1b23cbe01fde625c09c3b1e05bd69ef4b7e94371ab83bdd36381e422
MD5 c5c8ece6e8c01d6dad773ba4a13b0d6a
SHA1 ea70d84e428ff204cb17d361f5631af3a0b5004f
SHA512 09969ac6d501fcd922355a9d83e9add7766a2d96563f149fb8d8a297dd4d7f239847d029d8e06c37dae5b106dd2cb059102b4c74a057b0dd9614092b4f278090
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3co:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CMo
TLSH
T1AE255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 d046dae1e19c8d8d56b361614eb95b458bc02569530ff1f40e83c4a51f272d64
MD5 8dd6b688bda3b41aa6586286d89f551c
SHA1 c177b46a7a410d99804984eb0c2a11703b187d53
SHA512 1b6a206cce746cbcaaf4b4c7384e9cdf0b3593521699eaba52590674d78585e8ab2cdb9345cb67ccb78d8d9b2e3d451ecbf52b9e66621eb45446dfa1c342168b
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf38u:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7Csu
TLSH
T123255916E29004E4D42E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 015cec1ce2eab634a4b662a60cb73263d0a7bbe0c9f31f9444b431d222002f7b
MD5 9850cc1dc802cf2d28c061fa4d34cb2a
SHA1 cd59f199863b54d5683268fe2530eba59d46d9b7
SHA512 8058d047650d5ffe39b273d34af7c5f91d0de969e422bcdfccc5aefebe7998c18487d163cb3feb6fe80a19a14030705b2aba6fd2bb54151747b311c76f6bb11a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3A9:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7Cw9
TLSH
T1A4255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 ceb5703dec1b52d99dce55d36e3a21da19a11a689a39c3add96ad689e38fb607
MD5 b271f3008cec49ef3ac4c66f025f3286
SHA1 ffd72bea4efadc9d71ba717346e0be28e9a9525c
SHA512 d5f5f6b9fde2ce304fa3743af6292ea83d56fc70cf3d42eb8cb14e518f625ebe0a675f9b5b8731ae933a24523382666f50d696c68d3d734d32a1284e97cb5907
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3Ic:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7C4c
TLSH
T1FF255916E29004E4D46E8135CB954A12F7737C2607E086DF13E4E63E2F736906EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 55caa9bdc55c789259e23a9ce4cf876b21cbad25454cc1e39eaf2ba36102016e
MD5 7713a3490210ed74beb86748229b2885
SHA1 284eeae00266c593b0ca3de795bcbe9ddec98f00
SHA512 fe15dd150ba2078dd159528ae0abea5121a9294f283471d6e429c2e1af43fa027f94a2962a3f9b30404d0956207653eefdf6cb072208869cdf43b01ee956b22f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3hp:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CRp
TLSH
T103255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 57df1f061e013e33c73c9d1d0b0b4291c1f511509a195ba5620118a7b7f11103
MD5 0655e10011c412c692ea3c9610af5231
SHA1 aa9a0a368534d65291b5afac69901fb9198c643c
SHA512 19b668af3118dc97813698e21c5ab528484b13daabb33c9a10b78f3351821b2126264c2ada2805c1fdab4732ec1db2f66311ad3bd3a47937983a757f764f02c9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf320a:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CmN
TLSH
T127255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 af0a683ed0b3751fee774a475065cee835cde3bfd7c938d27f02c62561004ca4
MD5 7851ebbf1d0ebb51d44ba13f8c2b2986
SHA1 8244526d71cc75b118c93268ac458f9b74957743
SHA512 6f06ef1a4813646a60ab287240df0a55e34f7ad3dc2db03533b6a31f380891a7e6dea27e4c36d26ed611f694f3e88c71bf2e3aa8ae4645ff80d271276a16233d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf36F:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CqF
TLSH
T11E255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 55437465d7b5354d52eee8a7a14a1223cdc06e674664f050ee03f191357bc285
MD5 b6a695453e99c6f977ed3eb561133c9c
SHA1 268be0b1a3829f4416fffb87d183dd3d2d9218d1
SHA512 6454f0280b8850a1c8a82cea2336cd941c4a8fea396086fcb7afa773d8528c831cc3dd6763115462d727cfd9006626b51af4153785a8588f3bc38dd6cfc7649e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3PC:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7C/C
TLSH
T1B9255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 c6ecf28d2ccce73b1bc901b81074ee46f05c618c42e204f839dc6220f1a1cfec
MD5 6bb14adff452c18b63afdeb82dc8654f
SHA1 394b41792af10bc78c425160f8d8f09849a1b484
SHA512 af6750fc8bcb27a528048d29c34b4283215413f2282e0eada0dd978685707106e16ac0cbd4443d21a993822ae140ba45d25108ea12db9c4c3b93d1461ced6226
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3ww:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CAw
TLSH
T188255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 3c7dd084da155c202d42eaf0360d435dfb92b872e781e3030df5357acd66701d
MD5 b6ccce32111c3c992dc2f50598d34662
SHA1 b859421a118209cc0a90b199194f91753500c42c
SHA512 211cd0809c4ffba8257350486684f0bad793de04d855778e15a354ef8e58053e6135c990baf9cdbaf98a1ab4911e26867c265a752a07c622cab59d4a953c78b6
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3PT:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CfT
TLSH
T1DB255916E29004E4D42E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 394699ebd432217a754ed8d5a0dbe2835a5f872b59b6a6b75096dbc8320923f4
MD5 246461385d6dc191eafd4b2318735854
SHA1 eff0e26cd6b6dee87d5d08ec4f4773f3ecc6fb51
SHA512 885b046b5df60b56a90aa821dd259b1c26b12177b413fcefb145697f6b18e6de6f81a195ae89e08a3595a5ebad7b8d22809ad8ad710e0bd452f58603de94f377
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3Ju:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CZu
TLSH
T126255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 77c498fdeffdb1d03bd1e7454bd1b1a5cc4320a79341d8183eb27be59a20b3f0
MD5 daec1a71682b0cb0b3e73d65146bca38
SHA1 ea0114382c7b9c8613017d4e12bef6e5cf60a31a
SHA512 62919eed1373eaa4105f46eda9f33741fa7f941a47af65933aadbb0531a139cdde754e45c59672ae1efdb957e329960363c5ac6ca26c2e17988d8673905af855
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3Bb:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CRb
TLSH
T196255916E29004E4D45E8135CB954A12F7737C2607E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 0d880a3340beb501c41bb105f14e813865cd686176d4bef252839f726a1d8841
MD5 d39a110c745c021a37d70391b417ce8f
SHA1 ed6b9bfd1fe60f1488329ce135e55bdb7af3acf6
SHA512 a3ecdea4aff666ceaf6c76fd1226fa748f553a425c9001bb3aada3c7453cfddf1c0a7b755eb88b7e106dec90df1e12099308594c499431e21c93cdc1521c155f
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3Jf:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CZf
TLSH
T13C255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 85ea94f36ae0de67bc50ca5b4df8a37409c6cfd833da6ba7716c7a5015788918
MD5 ad166786804fd55dccf8099664a98499
SHA1 3c81fb2bd3ce05b5dc9cbeca39d363a9eca493ff
SHA512 f2faab855b17eec2c48e79917cdf631c5b6efc573d4c67deea3eef3701b18fcb64e0024d410b05e04fadd384394bfe8f36a8513795cd50af0818ce32b25ac30a
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3yK:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CiK
TLSH
T144255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 d1cefe722287d606399bde2517ace19a2a889e22f693f503725e6a5487703484
MD5 acb6aa6c231f24315c4316009f49f522
SHA1 9ce40db211764356a16337cf7c98c613ec2cec8b
SHA512 f067780b4c050aa0e5106658c6191c7ad6ebcf9b6c170762d5eb88cda8a72297c0e4f22e4a9c307e5a2aa36666ec0b8e684191738c4697435561dfef0cf31675
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3Xk:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CHk
TLSH
T169255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 16b31430847e72123af9f09e9c51125c97478e035d47f652c4a654dd7fd2b7be
MD5 63bad84c43d2be472750ed170fc7f4be
SHA1 574f804c8d58f079cfef7f3b4d5625f70c8efb61
SHA512 e6a2b6a40e1f217efad9e7847f35828d3c36ff7f8b20809f1c4c4bc289afb8bfc58c08b0a1a45ac0dfac1192b4e57e569754945974fb7d0ded27f0c5acfcaf16
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3g0:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7Cw0
TLSH
T129255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 45c85e0db094652ef0987f288e9c944359c5caaaff4cf37422214fa7d5485a23
MD5 51b817fbb438d9be984fb92931636c71
SHA1 2cafd2093f04e65cb3511aced19b80c308a82a5f
SHA512 ca7aae64323256e0dec003d65197fca9d39301c8663576e30747f9e3dbb531737ebb574b30ec17409f6d187ecb08d0cff0517e688d8e07c22fd85aa81b08e0f3
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3770:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CLg
TLSH
T1C1255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 f4049cf966b4ffad791d87a715f34cb802c8a7ad0321fb169517471735db3f49
MD5 1954a51fc33e3e4f6470d0d76df211cd
SHA1 9696977b8a09fe00ca7cf77c9eb3b3fa17eb829c
SHA512 bc24e07290150c74baa027c3b946e7a549dd20510a4f165ea4f2561966ba6fcb4983cc1abb8136d988673149090e9714969aa85a06f7dabe4f7b7fed7f793a4d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf32r:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CGr
TLSH
T1C5255916E29004E4D45E8135CB954A12F7737C2607E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 c12b349a76eeb27a97bd3a5d92c783bde39733a3187f612ab9be653b8aee722c
MD5 9205faf58d6976923caf347f3d3dde83
SHA1 153bd7cbd69f142411400acabe3b9e1286f8642a
SHA512 de905f0174f9195f30edc43f105263a888988752c5f0a737942edfdfee0681a06f8992e93e38549e675350e87c2f6c36ece50c7c24bf4a62d3ce7b1446eb2a32
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3cn:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7Csn
TLSH
T111255916E29004E4D45E8135CB954A12F7737C2607E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 a4a5f5d947269561bb5232f15e8577a3dac9b07f3dbc74bfb69968d1e5eed362
MD5 376f2ca88d68e2e24e08f5f8b7eb85b0
SHA1 18aff3cdb6a346e0fcb46d47e8c7ca0053cd58f9
SHA512 2e5869d656fcf32dca1073bb25a402041420b38f166f81d59ad6c602126d03e7ef616d1c81947307af9fde53433f318b5c75702ce1993af9874d8cc20c4c0540
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3ax:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CKx
TLSH
T159255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 5c75d5a76cb7c9e7be90c3f4e41c0e5e3ba9b5c0689f419001d358e5797de5e8
MD5 272402f857ee49cf9bf01da1c645928c
SHA1 496e225518cabc9425a5818208f7ed431c8925d7
SHA512 4931c2d2bd0309f30b3b21cd8b5f1938b74cab650703bfb9a63b25d34f6832d218199f6260d7aaa0331c961ba2bae4ea8adc96e5c05bd879efc90800ac8a51de
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3cA:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CMA
TLSH
T19E255916E29004E4D45E8135CB954A12F7737C2607E086DF13E4E63E2F736906EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 d6b3587d6384de87672ba197113ea75203cc987415f38a72fd1dc2b51e1f5bfa
MD5 820bc02bdb0d85384e6f127a2e30a6aa
SHA1 42dd8642d8bfef6e5c8668063984991ea2c6bea5
SHA512 d0c0ec8115bea4c63f18a93bba3265e79ef16a60968b5641c6089756e9e328323b2867d8f29a9d8e631072c8b08601406d70bc1ce0eddc504a35cc0f8b2f2fff
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3F9Q:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CV9Q
TLSH
T150254916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 80b9df97b4085adb8b95cd50bbf52133bfc653ef0d9815dec19eda32bdce9a77
MD5 3d36dab59bc197a75ce21e3d03256f4d
SHA1 766e850d71b285422172b3363b9c6a5c2ee6ada9
SHA512 f23180b602a89fee5deb472d8680abc5a43e58367f0f57cf0ada70721235c05a0bc2d427495feaa45dee9f546173a433003c0d4cad597223b1ad1d5b399a829d
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3w4:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7Cg4
TLSH
T182255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 0529466d7bb61615f4cd964c66f188f35630707a62e060d1c17aa5beba19257d
MD5 832a5717015cd4d71926f875c069b85e
SHA1 f7836cb97a04d4899d7ed0f42378440a499eb752
SHA512 522528c6d2728bac56b662bc537e4803c8aa3ea83f76f2e98bdf8e713b763fe6cb0151d4ef7934648cc29d433eeda6f1e162862ec777d3afdbeee237de1e51da
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3zu:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CDu
TLSH
T11A255916E29004E4D45E8135CB954A12F7737C2607E086DF13E4E63E2F736906EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 5e42522550d9377783daf7d6e5b29da7f502c3fbec285dee968cb96db0b0ca40
MD5 926934c4b860be2ae4499d744af5c2ed
SHA1 5b28b6b32894d5115f99b8e8f5cf207de1df6175
SHA512 d3b8edf8c7bcedfa5f92c6bab13e0327a2513f9e6b5d5b67745a0d881d621638b6daf187054786382a2f735b57fe544c0a1c627ce5e5fff8dbdc7a1c07fb2bac
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3uj:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7Cej
TLSH
T1B5255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 88e64ed1460e9e4e6ff6443df953a6bb46879cb99a8edab498ebcc66c795aac3
MD5 5b878017382605f5ff3c9da467ab606f
SHA1 149c8f52563887a6afc7851c9bd6db945e958eed
SHA512 7a32c57d28c635bc7076219a052aff37cea6ae2e6c265336f065f83f083aa948252338d0bc0e164d85daabedb56f444bdd3ac4c00fd165d456b22a0a487977fb
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3bg:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7Crg
TLSH
T1D1255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 a3e1973ea7658c17c14c34e5d3ef895027de75587c16649ebb7c32dc8cc2987f
MD5 3660a43062ab956d5e3ea9e440147ad7
SHA1 76d51eda8286573fd017f9b404ffc2eb23288058
SHA512 bfbaa289dfe7d2136b7bf685b3274fc573a670b10e46f32ed6fcd05559592c1750e0aecfc0b9eee8b637c95d180faec9d1142be8ed3c9c8508fa4b922e734139
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3GI:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7C2I
TLSH
T1FD255916E29004E4D45E8135CB954A12F7737C2607E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 3982722d03f46134d2b3c1df70facd2cff36226d297f4287f0c61d0869e2610b
MD5 921e37cd41802f809d8a2879a5e0f03e
SHA1 682fc07d52ebb8fc95cc2a2ff9bf5e245204fff2
SHA512 31cbe679bb984422b0e15e3f35f164dfdec6ee26022370ecdbbe441fa2ef257d6b85e50f5d9dcb0333406b8c9e1abe4b0d76551df76f568c2feb7904a05e6861
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf30o:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7Cko
TLSH
T127255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 9b484cb244ce45a56843a57d2497d6b1d1f8e43e09bef800dd2fda8760c48955
MD5 aa6811cc7a542e4657928abfa1d6a0ae
SHA1 01e968f7dc13b2ac5fed1ae032148aa9cb57d225
SHA512 8ad413fc9a7c73cb1f151ee5312fe88cc2bfda4fdd98a944136bd0ff923766213615480c7087c543756de00a0d996f2301e82c6b4e25ce848307f9f902595bc9
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3X+:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CH+
TLSH
T113255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 3efdc127f95a01558e464b7f47165cdd59b98d614df2b30fa01cfc66e1c30b3d
MD5 ebfcb2c0bf8804f191436fe358839927
SHA1 70077be2c9eb4d2229e88dc8bf0227a40a26094b
SHA512 1e234a097476198cd89ff2092aaa6292600c25d7c11ac74d14046f547f44f6b345ccdf45ea7af29fd9a7821a72e00c853cd6cb20b02867219ee3b0e0cb486ecf
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3tQ:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CdQ
TLSH
T134255916E29404E4D41E8135CB954A12F7737C2607E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 c082513f9710a4322c4fe9a120b8b5ee7b828a2c2ef6024d4a16eee4e590ab98
MD5 04b218e22b2bf9f012505cdbfcf4bd34
SHA1 9e1dca25fcdbf84ef99c715bbc5b47674184f879
SHA512 ee9d0b594dd1778a01010a886e49e3b2c8a23b3d2aeb6cf438c00171bef6181713006a8692b6be83789a34adfb1d9d6b7dd2c2565ab4b1413ba7d36edf36e3ee
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3iX:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CSX
TLSH
T1EC255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEA7A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 6a2160d3ecd9eb3f63fc1d8da5752cf9631e4a2962c684fcc4e6e4ba961b6857
MD5 75755e60c569d173b75e3c5840193b2f
SHA1 f3ee5708d4f5ca7ff1e68b33faa167b940947d70
SHA512 70a0821067eccaa00e178e47e3d0a45cda796919390ef7567eac6bab53552e4269ec1d1c5ca822829758bab65599035f2b5b8961dda5af41d878bcea178eaa3c
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3EL:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CUL
TLSH
T1EE255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 2415487e613dddb09dba92bb11841bec8e0354557935a4ccbc2797789a0ed359
MD5 4d7e5eb26420d155e2cb3b048b50a021
SHA1 2d8719ccc6c0491530c3040a0cd04e3e331b7166
SHA512 6036da98f6eeca08a00fd89b90dee8a77b8d67d45ac62d19852d6f0ebf8c84154008fbc59541ab3b0cd3bfab2edf330663debf115e1a2778ff8d88c186df7e83
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3gFC:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7CwM
TLSH
T177255916E29004E4D41E8135CB954A12F7737C2617E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 9d3c72f395a88822d8529375c5b379ce6006b5ab622229c39a2e46d1f330368a
MD5 1600a15917f7fdbff944294ad82d3b6e
SHA1 758c10f30e0afc21b8431ab88288eb455cc1e5d0
SHA512 e1c9fb18c05a676fbaa701eed67e88cd9a447f9d525810cab2ddf3347ce91cce72ddca36341141999ab28486576112004b282b096699d0cc3eab9a5d524a317e
SSDEEP 12288:A3ZUnXoZ+yPz5L8aEFoeG2XAm3ggRUeMz9TNXvkQ0mTXsf3Bh:A3mnXoZjzyaEFoeGDm3NCdBTNsQ7Cxh
TLSH
T1D0255916E29404E4D41E8135CB954A12F7737C2607E086DF13E4E63E2F736906EEABA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4256-71-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4828-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4828-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads