b66d1e53102cb12be56a4f2b765d3a034d5ee545e006915f8bc5e4226f5b22f8

Analysis

max time kernel
128s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 844KB
Sample260809-vd4zaasbph
SHA256 b66d1e53102cb12be56a4f2b765d3a034d5ee545e006915f8bc5e4226f5b22f8
MD5 4ac8b2459f921637a34671b70aedb3e3
SHA1 525b5e090f2d52e88908f297b4f3a1a94d472118
SHA512 5b39f01f27731deff9ae4a3cc230dff5803688e70aac3925de647fb76ca034515564b21dca2634d16f2d0386172a448d38936393174dbdc4f8b44b734b2401ff
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYf:A3k03kB56rC
TLSH
T169056A13E6840FA4D10FC1749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 47 IoCs

resource	yara_rule
behavioral2/memory/1856-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c405-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b32b-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1856-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2580-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b330-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019cb6-60.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00040000000189a9-203.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000018a83-210.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019871-229.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-242.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-249.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019905-262.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a85-264.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-296.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-477.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-508.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-599.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-630.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-655.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-742.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019911-755.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-810.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019913-859.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019914-878.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-918.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019918-938.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019919-963.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991a-994.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991b-1031.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991d-1062.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991e-1111.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001991f-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019920-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019921-1188.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019922-1195.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019923-1304.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019924-1341.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019925-1354.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019926-1385.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019927-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992c-1405.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992d-1407.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001992e-1409.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000006545-1996.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 44 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c405-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b32b-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b330-41.dat	aspack_v212_v242
behavioral2/files/0x0003000000019cb6-60.dat	aspack_v212_v242
behavioral2/files/0x00040000000189a9-203.dat	aspack_v212_v242
behavioral2/files/0x0004000000018a83-210.dat	aspack_v212_v242
behavioral2/files/0x0004000000019871-229.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-242.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-249.dat	aspack_v212_v242
behavioral2/files/0x0003000000019905-262.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a85-264.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-296.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-477.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-508.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-599.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-630.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-655.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-742.dat	aspack_v212_v242
behavioral2/files/0x0003000000019911-755.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-810.dat	aspack_v212_v242
behavioral2/files/0x0003000000019913-859.dat	aspack_v212_v242
behavioral2/files/0x0003000000019914-878.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-897.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-904.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-918.dat	aspack_v212_v242
behavioral2/files/0x0003000000019918-938.dat	aspack_v212_v242
behavioral2/files/0x0003000000019919-963.dat	aspack_v212_v242
behavioral2/files/0x000300000001991a-994.dat	aspack_v212_v242
behavioral2/files/0x000300000001991b-1031.dat	aspack_v212_v242
behavioral2/files/0x000300000001991d-1062.dat	aspack_v212_v242
behavioral2/files/0x000300000001991e-1111.dat	aspack_v212_v242
behavioral2/files/0x000300000001991f-1148.dat	aspack_v212_v242
behavioral2/files/0x0003000000019920-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019921-1188.dat	aspack_v212_v242
behavioral2/files/0x0003000000019922-1195.dat	aspack_v212_v242
behavioral2/files/0x0003000000019923-1304.dat	aspack_v212_v242
behavioral2/files/0x0003000000019924-1341.dat	aspack_v212_v242
behavioral2/files/0x0003000000019925-1354.dat	aspack_v212_v242
behavioral2/files/0x0003000000019926-1385.dat	aspack_v212_v242
behavioral2/files/0x0003000000019927-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001992c-1405.dat	aspack_v212_v242
behavioral2/files/0x000300000001992d-1407.dat	aspack_v212_v242
behavioral2/files/0x000300000001992e-1409.dat	aspack_v212_v242
behavioral2/files/0x0004000000006545-1996.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
2580	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpshare.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1856	2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
2580	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_4ac8b2459f921637a34671b70aedb3e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1856

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 844KB
SHA256 b66d1e53102cb12be56a4f2b765d3a034d5ee545e006915f8bc5e4226f5b22f8
MD5 4ac8b2459f921637a34671b70aedb3e3
SHA1 525b5e090f2d52e88908f297b4f3a1a94d472118
SHA512 5b39f01f27731deff9ae4a3cc230dff5803688e70aac3925de647fb76ca034515564b21dca2634d16f2d0386172a448d38936393174dbdc4f8b44b734b2401ff
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYf:A3k03kB56rC
TLSH
T169056A13E6840FA4D10FC1749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe
Size 961KB
SHA256 9e3be4b6d63c1150db8ebd80ea8969d8c39e8884a3d15fa82e62e9a4e966f6fc
MD5 ba1710fdd087b7bd8954b543f32db9eb
SHA1 239a5f69183b69a2562d612f95c177e5414cb146
SHA512 1f26231b588b468bf788b1c0bf47d601b1f48b9f026ab17b6cf976258415619ed30aae2041c2da7cbbbfb162bf9ae03a7a7bbe77b94f64df8f543b1c06a0ea0f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcY5v7MFi:A3k03kB56rq7gi
TLSH
T161256A13A6840FE8D11F81749A958A22EB73BC121F2097DF1354AE153F32BD0AE3A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 5d86c6b96d4dbcfb2616aeb789e64e441ffa596ae8bbced808b8779dc1c9c6f9
MD5 985e3af0bf818bc12c192e5e5b5dc445
SHA1 74b8d70171948ddb9ab731c5455ee15294d05b67
SHA512 40e2f7ebb1f24a922270d554e59c8bc22ed3d0fe28b5d3d1cfd39d421b9bd6ed96a7a1f186729112ec1b394e0d9e9df4de7b108402cc00e9449018cdc19c2bb3
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYL0Le5ji0hmxNrM:A3k03kB56rCPji0Aj
TLSH
T17E654A16F6A44B65D02BC078C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 859KB
SHA256 a479d47f6455d0582e8a36cba8b55b9a6e52f576d322a2f6537ad11363039073
MD5 f5b6c919c73dcfd086e61c22ffa85ad2
SHA1 f6bfd9fb02f8c8cf52b6062b9a50434ad8f88c57
SHA512 a9b29b26aec3a57d79c357151c10a2de5e8b4c35d33b559aee9a00b3490b8611c45e43d13c93bc9e6236aee07408cee3b611b55ff96de55f7a63ef019d46d758
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYNa:A3k03kB56r
TLSH
T105156A13E6840FA4D10FC1749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 892KB
SHA256 b253729806dfaa2397f24d500f7e20487f06f90f8386d8f6e4d9b36c126fabe0
MD5 76d48315580a53afe473279738e08080
SHA1 b216604bc1e2c1e98e64665a2eb4c3063c9984b5
SHA512 76d90de46d23d634a43d0b04f6278b0533b74d80bb46c73aadd4b1a7603f36c79eb19a78afd28c79dc28474de976f8fc616ae1fce4c6d9e1c1b836007a9d977c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYub:A3k03kB56rnb
TLSH
T156157B03E6840FA4D11F81749AA68672EA777C421F2097DF1354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 868KB
SHA256 835e65dbf36788ef7b4bc7a271f833ef0450fe2c03333bf4c6a5b3da009e4f81
MD5 9393847f68d31fe4027c78267e1d372b
SHA1 943441b6bdf03c90b531dde4a2744651000f74e8
SHA512 3dda90eda939888008929ed1287325a6700f41b6410a7c09b4796ed545709fe965bce853e3d492e6534597897ad344d9dd08d4d6da87f3e7a4a732ed22eef99a
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYtZ:A3k03kB56rw
TLSH
T12E156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 868KB
SHA256 99f0ba3dece7cb375a6a27daf2af9b4abe5aa50de45993633518f7567da234fe
MD5 2debd5eca2ca60c1e32bbc21d9d43bbd
SHA1 ac9b5b0822f5a6f9a254230e6ac0a65d337f9fa4
SHA512 1c222fbea69d4843b697178254f064c4495c61b229408d0fe5ebe64be34202859f5f79c8e5939a913b7f33f9af0ad6886282b42d6e02e0505a6a9539a42a79ba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYW1:A3k03kB56rH
TLSH
T104156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 868KB
SHA256 f0cc056234b03fbf77868f0e2255bdce41d66b09dd7baa39237832ed9684fc36
MD5 c3237329a51f8c4aaf7a34e9c577a93a
SHA1 701901a25e045ea1a0c0c81d8c1432fae5cb1ad4
SHA512 ee438085f255d9adf52c15d2ce093294dc9c164bd2f70bbf9e9c2823687e4de53c719bd84802e23d49f1706b18296a7965f420ba2f296119a0371cf3ce755730
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYE6:A3k03kB56rs
TLSH
T134156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 868KB
SHA256 c7748210a05f7de62dee16c346dab1fc2699ce982a15f21d0fd861af9a9b3fc9
MD5 59f7c955f3f23cbbc3c9d7badb652cc0
SHA1 27d2816f5bb575085f2c31d81c6095a33fd51541
SHA512 7bea9b6387c915349676f9e8ffc22b25aeacf7067eaf400f93f29a5257eb3518dd9df98e42b9d8a47da706f48aa6edca34a959fd828cb3164ed68fb37a0f26e4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYgN:A3k03kB56rR
TLSH
T116156B17E6840FA4D10FC1749A968662EA737C025F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 868KB
SHA256 cae18f1e576dfb8bbc11296e9f0532576417215fdc4e0321e5a608ba4724563c
MD5 121360f65414d878674d63f7d1362efd
SHA1 ab5c090eb72179cdb88811f13244d81a67582987
SHA512 c8a73338c122f4472a0bd4b2923baaaacc82013ca42751144db36a0bfa460141b7a137cd658aa681fe01883c8c5b732e5911a5fdc03519c40b6c0c002bc69d63
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYOf:A3k03kB56rR
TLSH
T18B156B17E6840FA4D10FC1749A968662EA737C025F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 868KB
SHA256 f6c3e80113b1bbe54d8935d32b7e887471311db0bd945db698edb8d400c1310b
MD5 f7e7cf5f28bfc0b53d020f1fec6f6a50
SHA1 8afc7ba8f59ade11b6d7c51a7315324283426455
SHA512 72a365e38422dda0f8211cf12ba98696f86a57c1cdbce892db620b3e55ff30ffc15aa7e689f1add9510706b96e84067220b652ddadc83b082ea7d122c09a1e60
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcY4o:A3k03kB56rk
TLSH
T1E7156B17E6840FA4D10FC1749A968662EA737C025F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 868KB
SHA256 1ed643e922e86b8b4cfd83d0c3fa7a01cec18894c8fc2e4d43cd5cda490fa0ca
MD5 eaa9239e0e68d450e518139bc1e3d009
SHA1 f0b88e7843368175f16c54b8d1f20c56637cf746
SHA512 423fcd819d27ebe62911ea8acbc5469ae45822c620ed57ccc7c5b21c0e20893fb92063ab06471e336c500198026d93b999c1ad7eebe0a78399da19aa27c353e6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYIu:A3k03kB56rW
TLSH
T105156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 868KB
SHA256 7cb22feea5f316088a834e1bec457bbbe088ab4353dd1fe179a708d65cd05e4d
MD5 9344100594edc9f48f5b35631227cd7e
SHA1 2f420c0e3c2e797dfbc7123312797bc2e74a4927
SHA512 592743a7ac8247004ccb7b3198bed0f1e3f0b9f2e1e955774e2c6f3bbdb5a933c6d85def4c26770e8d1b199ccb1a4168086a42f602614d036d5c30eb56776b72
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYc9:A3k03kB56r3
TLSH
T1C4156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 868KB
SHA256 a7b8ae04ba84f67c6555d3862993c61cb68fb991df4f6ec2d20db431e8d73780
MD5 275a322ecede56f759014cbb1838e096
SHA1 65af8027bd92011b174467fae2caa37f7cea3dc6
SHA512 8fa009e4adfae6f75a340f11d353b108f02c08a00d4a8b3800c17a0d9d109595434571a5580fe32745237de9fbd2c079e500e20505cb20a787b41ffd14be95d1
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYEc:A3k03kB56rG
TLSH
T12D156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 868KB
SHA256 f03cef255fa1af1eb9c54f0f1e34a3f464fd8320d38d48af93982c42a3121a64
MD5 d0cb4d9d9cd099065d7a418e43d3757f
SHA1 51a92da5b6d0d735939a90aa2445235b87e21e93
SHA512 bedc9600e4287798eeaf0a048b04922f1ccb88185671ed8dce02b0db30338a11565bbcef00851ed718bf220dced8b8de4cb990ae95e58af44f43988fdc51ace0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYdp:A3k03kB56rU
TLSH
T171156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 868KB
SHA256 45bbf6fe0f5c157704047598c2fe86ff3185a0c0dbaa5e334d070d18177d6f79
MD5 a02d675261b7ba424079d974f061f0d9
SHA1 d0052eaf34b5a4401e7cd14d00795474b670e277
SHA512 825f598132f3dc04eb06b2ac8acbc82cc09fc1018092b9f95834f78a7fb1915861971c50f49d70f2f61214e3e6e2be29f9d32c6d57e4678a7e8f998a3aae69d2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYiN:A3k03kB56rj
TLSH
T188156A17E6840FA4D10FC1749A968662EA737C025F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 868KB
SHA256 67868aa6f7d6a58c5dd1796938c2e2f8b50dbaccbca99aa5f39c95df55c1207d
MD5 9b770371b2af452c55915b20489b5ae9
SHA1 d995d214ca5a96f19fd753a80d8921f05bc9bb5c
SHA512 a8c1f0a49e4aed74f32b05588cb273e985d4c89ef9483fc4c0c4043f70eb4489bf3dccdbad8b332f23db0eb140219f6736bee0adb48ca09326fb0749438aa7e6
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYGF:A3k03kB56r1
TLSH
T17F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 868KB
SHA256 28f7766319b448908745904aafb3c27bbf59b46d3d04c315b4e7ffdcba4a3aa0
MD5 ae6d628401a4f54c590f7a176c8cfe3a
SHA1 eabdc4adf7a7206540c6a8ee547e53927132c041
SHA512 b1279c89b654e82161b71166a1d40e5a9a29fc765e85544be452e4b4fe0d519c901ddafa5d9d7eaa60065f0def0e07ba25b8c664321243b0acacab23b2200c78
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYTC:A3k03kB56rZ
TLSH
T140156A17E6840FA4D10FC1749A968662EA737C025F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 868KB
SHA256 7f4e154f29feff7460ba9dbe3a24db8e1c9eebced2894ffd2ffd42e4d3a95bed
MD5 77d14271b9a85ad478c90e8de7777f9d
SHA1 cbf04bdb0a21536dee60511b0015fc5ba013d507
SHA512 24b49d300d98d7a0a1d2cf7b6be3b4b40302f37a9c22e16552be6d81bafcbd85d28046d0c0572e5ee98ac2d9d2cced4e93b6fed99a9d12c22c160e1ff877f9c7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYcw:A3k03kB56rE
TLSH
T1FA156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 868KB
SHA256 aaf66bc3b944e3612de38a84b77b904ac37a6eb83d40281312e31ea24898f987
MD5 313637d66d61ba912c8056a66df8d7ff
SHA1 91c23060c03f5cbceacf93ff37903d62e41d64c9
SHA512 433d3ca0322a9161eda1997f1b7c214e1f5d2ff1327b3aa79b25fe5993a850f3ef405dd2ac0170b26a0431e0f059e625cfe810f9179a0f2cee6f44c0829d6ac0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYTT:A3k03kB56rs
TLSH
T17E156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 868KB
SHA256 2ecd3fd2861f9c41437c47d05488cfaca1b38a8b56ea7d62dc3416ee8a565f58
MD5 4b9b301f7c5456d1ed438bb2597e7087
SHA1 f7987521beae09ef88c04ca03875a603c1b95a60
SHA512 6f3e3b50b93d58ef322cd312d23c5aab6cdcd381773a63b11d91f580fda48b7e509590335fe625470c359b52e9602367cd73e60026fb83d0b2ed77c6a2fd7a57
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYlu:A3k03kB56rL
TLSH
T19B156B13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 868KB
SHA256 b6bcad096fc7601f140ebd582a9b942342189589e03f85fec4f062477835f04d
MD5 5440019c49afbd9240e817092a55e54e
SHA1 59c6b8e77ba0ee1760ddc73f42cfd0ad2b760a38
SHA512 1a3dcc75a3567ab91def331bbc9664345bda6a54d46f1cb5e938d9286586fd776aa6d069d5412ce551e57f5d984c5e16074d64c1f3ed1bcac5df20ec11f35f07
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYtb:A3k03kB56ri
TLSH
T1AE156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 868KB
SHA256 8841edfe842f263187d8b63d68dd364c73242596feaae37b24b9fd137780900a
MD5 22476bf5ac696a0367d3e91648e12dda
SHA1 eafdbeed072c75bced660925692ec483d66ed952
SHA512 b082cded3314404a4f32244f2492c8cb60af08242ba2ea45342d5f11d658a69a0082afee7405a518b581f13c056305d5cb8ee3879d06f41725c785c17530cae0
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYdf:A3k03kB56rC
TLSH
T10A156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 868KB
SHA256 11e633cae9116f5e077329db85a097a4c069765a69fc5f25d89e323746ae7f1e
MD5 ebd3af6ce18b3e67d2efa4c685d4998d
SHA1 e13a64e1c64fb224cfb70ff1754a40c02bf2da4c
SHA512 adead04f9bb944bb2d5ca527445f9d6ef7fb016dbf8944bdecab2c3971746c671bcc9e2952344a83e6b1be6470e0226dc4cca59087825573506ad8234ebb946d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYGK:A3k03kB56ri
TLSH
T1C1156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 868KB
SHA256 2626fad7d29a006512245fe8ba6d1051f364436560f9e6d75c4f7e68f1b3b7cc
MD5 fa95b8cf11846f61efe7d1d256077f2e
SHA1 58f747d1778fd8ddf144d6623e9e149b27302f10
SHA512 9cf3ab927428ed23dfd7ad021fc9ae799fba2458f23cba9a1c8fbe51f4c77dbb67dba3614fd0c3ce2f9e509be6a2084ec03f54496d23dfe25f9d1d38760d0ec4
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYzk:A3k03kB56r3
TLSH
T152156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 868KB
SHA256 1e9d149a0123b110a0f4ea3db1a86961a96de4dfb8ac0a93279e17f090a13ad5
MD5 fdfe4e54e1671fc39c9ae265443f4071
SHA1 57a69a2b9ee0cbd876a9fb1c81e623346070e93d
SHA512 9fe76af5f666c993d4c83b4acbeaf7ebcd8345f1209c77f82fadd9586c59d981dccba8259508e15dfaab3a321bf0f73dd9b578ce53be39e40890631ccaeb2d7e
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYE0:A3k03kB56rW
TLSH
T132156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 868KB
SHA256 b2f67420a384b23ce6fc26f1086edc1d8997face5d501fd65e7b606bcb395f25
MD5 f47a38ae5763035135380b4d340f4dc8
SHA1 133ff94a5f5194c1892e23af1df464e24b1362e2
SHA512 6c6df92c10ec3d4b749d3653ad0fc18ead231896388d97d4d9b2ee5e51dd2d530a05566afa1ca8d32396e3f1109b0c5ed2e02b20c756ce32299ebb96241d7e12
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcY/g:A3k03kB56rv
TLSH
T13A156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 868KB
SHA256 c90c543f17ffc710a90767deae15c51a4abc60d38ad5f26bdb7d669b0657faf5
MD5 450a6e17258ba99be4a24f6c6bc45580
SHA1 971466071c9636eef6e7cd96147338fac0d74886
SHA512 c20d77ace8d881994b13221bc799928af57ae92886771df3c97018becb8b323d8cbd7175c0a9f1ca47c011ae1af271ecadc225e5161bde0641b39495df0964f2
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYSr:A3k03kB56rJ
TLSH
T1E3156B17E6840FA4D10FC1749A968662EA737C025F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 868KB
SHA256 8d402840aaad7f626cb3683f24a789d1ce4929051e4491410a7345344f1e00d8
MD5 5bf06d7788b5949e821beadb51d23fe7
SHA1 6c859fb18f66ce2a427b6441388af4d8035197fb
SHA512 e85248d1d14a6ce5590884bfbc354aaab96d988b9a9ba257d04a066c18f0d252dcd25328b513900352e811dd7c146bccdce24a036037636882f2c2f7647e74ba
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYwn:A3k03kB56rj
TLSH
T1FA156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 868KB
SHA256 940d8284dc7cde9138b6d53be5571d0065424b394b68ec894b93403f54e4abc6
MD5 781b114551c04e95a7db34cd545d65b3
SHA1 e5d671f3b95c6f38eadfed9c045ccbd5f13474ed
SHA512 11e71386cc4f36a6a1299b63cd890563969dcf3950bb0bc20c2d3c0a6c502d295e0676f9fa9f8df22289de5f6114831a3b5a7abef7422e8df06f7248e35b21f7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYOx:A3k03kB56rB
TLSH
T10D156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 868KB
SHA256 ab5d6e55b9e684a9510c3b7fb35d4b529b785ee84c8717a46134b1b861dbad84
MD5 e86f94272d2cfc333da4583bfe45889f
SHA1 8af8c78e05bc9e240e93f7ab2bb53241f787122a
SHA512 ef4a4127cd259877299321abac6f1e2b265e5b93f19e3ff885f803abbe7e10aa907cddaa1faa92b380198aeb23f0c623035f5831e9056e2b40b1bb7fc28b3d44
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYoA:A3k03kB56ru
TLSH
T196156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 868KB
SHA256 3aab7acbda0fb94ce768ce44db3fe710353b1c6acb43ce1d657e364c22a6a10e
MD5 0e5ea008d5dd18f94e1f25e3041b4e47
SHA1 e436c8809dcdcbedc676ac8019ab8e4b399049d7
SHA512 45eee3d23c674d78d2eec8a6c5b4e6e3eb2e14e56a0f45601873e6cb5015d646060e4ea6aaa008009dc6c12f360b62660aa6f7d1d55a8b34d9f7cb82ce25f48d
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYB9Q:A3k03kB56rz
TLSH
T188156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 868KB
SHA256 b9f49d152dda57a0f590edf443702425589341e070a058006ae36c0814c1a4ca
MD5 83cdc8d772e9769cf194da151f9281ad
SHA1 d5b7628e323ed0dcbcd138aa0ffdaa24addb2ca8
SHA512 d203cc55bc71e75b432a2a90a1273e0476c199a83e41a4c9943205ff0fe5c939da8e6596e1da1acfe29c0935b776f5ea98a04d982bf0ff106f25ceaf18b7622c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcY04:A3k03kB56r0
TLSH
T19B156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 868KB
SHA256 cd1a5ecf1d3b9e4d4ba8072d4885deeea293e05405084077132ac17ba072748a
MD5 2e1d36b50f6cb35acd8c8d7331bbe511
SHA1 d843049a8105aff80d34f57aec3c9580ecfd5330
SHA512 9ed0919513ed39ddf9fab1f25deb85464d49f958430a2818f0ff88b2cef66ec227fe79647512bfaf9446a876debb9d61e7a8e906c2ffbfb146753643c1b39135
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYfu:A3k03kB56rl
TLSH
T1F5156B17E6840FA4D10FC1749A968662EA737C025F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 868KB
SHA256 5afe6a5b403e13c0f742983e9b9c5219109c4ce11259e2d6ea279d1d6561f933
MD5 5d9bc50a7e99ce022929686d55234ef7
SHA1 3647c325fdad09762cdfd2de565c8f30f62ccf2c
SHA512 fd6f11db2898190fa99b716134a83f25b06087bb5b4e7a8c5c5a601750e8b7c769d3853c41d95fe619e03730b7aed40872e315c0fa876802fb775198a7d57700
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcY6j:A3k03kB56rn
TLSH
T154156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 868KB
SHA256 4c70c68f30b5c8b8a9f94a81b59da8005ad7825c66834f157e003bcddec0ff73
MD5 3c2117f05a935c51340ab4867b6281a7
SHA1 cfc263628d6503327e0f35486ceb7c674478391f
SHA512 505b11d888913feb136a241e9af0c35f27ef56ca0c4ec88a9f24e381255a5ac8f29ef54225e3da3d82bc0bb79719931529224a3cb4c4b1f5b5085a3d47c841ae
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYng:A3k03kB56rP
TLSH
T1F1156B13E6840FA4D10FC1749A968662EA737C025F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 868KB
SHA256 d9b21f2dbb125a201e850e8ab543cad73c489a0179f7e150e700b02698e80e3e
MD5 737be01aef898b7f6818af8b1a402658
SHA1 8e71db7e69fe732464b2d13962a0e50cf0419ada
SHA512 3eeb4db20fda2c66603cc7b132d23033db0b2aecbfe054e815249836108bad31549bd87a9826f9f9b383bee6d82c7b2be1e1082c3fe5a23d757aa648339447b5
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcY6I:A3k03kB56re
TLSH
T130156B13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 868KB
SHA256 9357e6b000c35d147baff3f0ea25a67aa8a32ea5df2d56f3a8b8c6e76ac3ebcc
MD5 9331b5fd921c48c7139032b649c9b2a4
SHA1 d9a261f40b328929918315565e88656c0a649bc6
SHA512 761a8546ea55e9089186c3c7d13a6d66055e25f6023973a2db4a389de6f511791a7122641a4badb755dc798174aa175b6f8b2aa1a447dc6d937674d7df8571f7
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcY4o:A3k03kB56rc
TLSH
T1A8156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 868KB
SHA256 c024f81076b93ec9926b06e7e48368b729b043a22846d1f58e48b1817db7d8fa
MD5 0dbfc62fea715f180e1b6d71c1923071
SHA1 fe8bb6a487d92cbbed5780b23381b6a094a9a137
SHA512 81b960a86dcfae63b109478fa7cc98e3b6fc2b187b15fb580671a0ec60757cdf1915ea2836ba4d54881f55da802bb05bdc981eeecb30472fd298d64d38d0a22f
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYL+:A3k03kB56rR
TLSH
T161156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 868KB
SHA256 4d5b34d002c93a756613f764bdbbd81473ea253736761abc9100bcb3b8944fdd
MD5 e1f7bb0a2bc0480870f6e12cbcd9be5c
SHA1 06672d93d71d0ffc1ff86f6c6c19203126930550
SHA512 7f3d9085105fe69421866334cccadd17163c96103bc0f0d89e265d2a8565b854d48b0e61dbdad91a905d5f12c8c62017483c934017da7efd764f14e20ef90052
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYBQ:A3k03kB56rR
TLSH
T100156A17E6840FA4D10FC1749A968662EA737C025F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 868KB
SHA256 4fac0b57c2661b892625a2d07ad036400c6345995d758c7693f76c5032efec6d
MD5 ac3433236edf1811a7d6b7dcacb407b1
SHA1 227fca6dab393d45708ba22e83d6e39bd3b51147
SHA512 8ec29dd20c6fecb90de9d1cf01bbad7abbe031c078a72b18adb2803678ffbaa0e9adce2dd288cf356177e6137bee0b97bd234ccaa57ee708b6be59e026bb5253
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYGX:A3k03kB56rd
TLSH
T170156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 868KB
SHA256 a48dac22e74634b05c93e7e0c45e2741136cfe8358592f5aaac6f54830848935
MD5 ac2d15b7add9ca6c01fcb46cf42f16d7
SHA1 bf83481d2955221cf900950909dc36c331af0d28
SHA512 ec3337ac86ecb589b65922f040a4b4a5128adc3fe3f382f167ffcc81b16a4cd304f75ee6bcfdc6eddca08fff7b5decfabb765e3590202adf5c7fe5ab6de8c368
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYAL:A3k03kB56rf
TLSH
T123156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 868KB
SHA256 99188ce9a27d33658562f6e5e5496599b4a7faa1a0f476a888f4e63888a4df82
MD5 36aad7d99d93259f8bcc5b936237c4bc
SHA1 480046c1b6666ff133283f7d3d8b03a6562e8227
SHA512 4a9d4d27a19f8ebcae6aad8519a247ac154c909be463c15c8d5f16aa8871421e0caf6a00cc5ed8707426e66707fb5964d12f2da81822d33e0a389e17ba4eba64
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcYsM:A3k03kB56rq
TLSH
T1EB156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 868KB
SHA256 6eae99ea8837c3009dc52a4b5ce11179bfe9670f90a0dfcacd682206edbef7fb
MD5 266d77b515defa2e02f6b8ca6329ab31
SHA1 e4a139d0e740e9c8f81a6cdcf3bba24a2947eeec
SHA512 0a493f98fee4662ec5004e68bc05d5f675c9a4cd5ad878a7af614901b0e7100f9174390ebbe3b17108b9ed478b4717e1b90e9e18a064a72dc01d15b5ce754f2c
SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYcY1h:A3k03kB56rk
TLSH
T12F156B13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1856-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1856-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2580-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads