26f017080fffe984fdd4f66d41b7f1c238de30729d2a33f7935de57d6c59e31f

Analysis

max time kernel
106s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260810-xmxyfawbme
SHA256 26f017080fffe984fdd4f66d41b7f1c238de30729d2a33f7935de57d6c59e31f
MD5 1925dfb56e3d474193bc66efdb1a21f3
SHA1 f9b14f83205baa1fc628bc9ac6c8a28a8ffeb70d
SHA512 1fa7841ef129652559984c96a74f873096e202bd2c98cf1c4eec5c63a22c245f1ac9bffa38b12192bcde25a179bbf1ba40d005e82a9dcd06275c3c879d268580
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiu:A3k03kHRJn
TLSH
T13025AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1136-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b815-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1136-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3208-22-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-41.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-224.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001bb29-261.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-442.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-589.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-627.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-718.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-743.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-792.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-841.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-854.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-893.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-907.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-932.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-951.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1006.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1049.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1080.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1174.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1182.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1321.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1340.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1365.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1372.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1400.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1401.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1402.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b815-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-41.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-224.dat	aspack_v212_v242
behavioral2/files/0x000400000001bb29-261.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-442.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-589.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-627.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-718.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-743.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-792.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-841.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-854.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-893.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-907.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-932.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-951.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1006.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1049.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1080.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1135.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1166.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1174.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1182.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1321.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1340.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1365.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1372.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1391.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1397.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1398.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1400.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1401.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1402.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3208	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe$	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe	patcher.exe
File created	C:\Program Files\Mozilla Firefox\private_browsing.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmlaunch.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	patcher.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1136	2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
3208	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1925dfb56e3d474193bc66efdb1a21f3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1136

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 26f017080fffe984fdd4f66d41b7f1c238de30729d2a33f7935de57d6c59e31f
MD5 1925dfb56e3d474193bc66efdb1a21f3
SHA1 f9b14f83205baa1fc628bc9ac6c8a28a8ffeb70d
SHA512 1fa7841ef129652559984c96a74f873096e202bd2c98cf1c4eec5c63a22c245f1ac9bffa38b12192bcde25a179bbf1ba40d005e82a9dcd06275c3c879d268580
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiu:A3k03kHRJn
TLSH
T13025AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 735df6bd886ebaf3c7ce1c3c7a5a59ab3ba38e594c2f431d0ae8803dbacf6801
MD5 4276ace65433e8fa51e017a9dd5915d1
SHA1 960455b3401cf17aed19c0ca7315260751166250
SHA512 e4ca6c44cda5e50c00cf0179a8604585066fd301c0e85bfa8187ca41405a9f27189b8aec0dafcf5cc5d2cf934d07682252302441486dfc278847eb75b53eaf0d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjie0Le5ji0hmxNrM:A3k03kHRJjPji0Aj
TLSH
T1B9658C17F6A402B5D027C1B9C9D6966AFA7138821B3086CF1359C7283F67BD19B3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 962KB
SHA256 520a74f7f5eafdc37ac5885cb29ee6e294ffc9c042efa6cba11569f3ec47b218
MD5 6f9b35f4f2eb4174a8c4d116f55c57e1
SHA1 eb39a5e10e65fe9fe96f13d6a8c3c4812d4160d7
SHA512 01e8c918a34c14c9a71063bb48bd9adc03631feaeb28de2e77ad5837bad7f3e2f6d926ce663927d1a07851e201162ddaf8619ba97b677cc53657db749f3bcaf4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiYa:A3k03kHRJ
TLSH
T18325AF13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 971KB
SHA256 2e929cb6a0eaac784bf331c5194089c2b7ab76cf0f76362901fa3f5188603951
MD5 27a0773c08289f86433be0c1c5a1db0f
SHA1 b931cc16b30b411cfd1a3fd19f6833cd9bcf2e17
SHA512 ce62ed04d0aafa0d9bec8b7f46b6b432f398c014ad50fb932c03b508e2887acc9606934452f862682bd8a7ff93d88647324508209a269536d746deff1bb4f057
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjix6:A3k03kHRJL
TLSH
T14A25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 971KB
SHA256 dd1279424d067215278f7904d1df3d5aa3e963d5cf191608f96d336df16f1fc5
MD5 beac13b65619162519429d2165a728d1
SHA1 f31c3a59f6274cda409f083c2ab1efe389cd9d23
SHA512 769678fef17733574c0161ada7e7a91c3c3ee54f70d5e84748745ee1c46ab22dc01e2176b038d55c4ac805bd3af5285a15d8ad1bcbca2d877a7845c1b8d5e9a6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjivN:A3k03kHRJ2
TLSH
T15D25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 971KB
SHA256 d6b21b395b61b70eb0f32d8eea42509c250d4926f52ed1e55d4db104323f4e11
MD5 80ea0daa81f2d263037428059283ea22
SHA1 d11141247605188cb551ebeee95bdfd84debd903
SHA512 d08b37e6123f3e510def3380bf5696f923a73b7ff46ea55fa9ffea8015f989990299a749935487981fe68cdf3967820f67a623f24592cd3d72fd822710208445
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiVf:A3k03kHRJK
TLSH
T12C25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 971KB
SHA256 48abc9512f7bd40c13f4f6d588282ae6ba4a9ba2cad07c36521bd454f801ef5d
MD5 666e49b40c38c5056eaa67c562812742
SHA1 332a575ba376e288bd01e8995a785db474dbd4f5
SHA512 2c2e24e01829495e573c0fe3499e8033937897539815f6e6d84364d87e02d012e1a2acdb2ec4335e3172e57abd7a3fe838c4d081d2075f27bc3cd694156b4e43
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiXo:A3k03kHRJT
TLSH
T17825AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 971KB
SHA256 30d7d92ef354d0d26388deb157a90779e97b094b986253e1f98d1c724f0682f7
MD5 f2abbc6b709e4707d6872afbf12a64fa
SHA1 d19f16c9b63f00413a1a7d787ab23b72aa337bb2
SHA512 c7faf592af0c4a835525d809ca79e33ca392dc5146914b27dcc86d210ff6d3ee65a4d5d0215ad0abbd988d5ec412af7d13a7d9c4a3cc24df0612a570e21064dc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjibu:A3k03kHRJF
TLSH
T1D425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 971KB
SHA256 93dab8c8bc11a61217585c62f3354f25ce2efbb8de6af556e3064883bc408e04
MD5 8e183a2c4ed63a4b8289ea51eb19eab4
SHA1 523d7680c9bb9fdb22cafc6568e4cfe8f44e503e
SHA512 dfa9c833156f279ac62aa096b3e8b31f0d1f1dde69cacd1a5c7d08a5f9569161a09da11aa27e838b523308d44680389934872e1efd8c3b18163d26e110b42486
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiJ9:A3k03kHRJw
TLSH
T19925AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 971KB
SHA256 48d06e608517d0922030bb8e6f60717e0ecf63c6fe10a99ab8b5b71f8daba218
MD5 cc591d0facb83c276188d02e311311f4
SHA1 0a27a830b4dcbe83e26efa480dfac4befbd6fd9a
SHA512 892a4940e9828667b368ea8e60943c5a2b49b3445583b37d80535ac962b8e13d67d35844ccfc869b4402819c3596092f28711b3e9d0502a6cf1de5c9a4d2f7aa
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjilc:A3k03kHRJh
TLSH
T13325AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 971KB
SHA256 b03f6c029e321dff8409ecf28d6094313e668056e80c830c5782ca0a3b563c73
MD5 99ae525340f1594d71ca59198bd60606
SHA1 1e16caa1990e1e4038ca091165bddddd3b5217a0
SHA512 5c40a2a397c05e3839aa11478a9047537c97763209adfe999b0dec09acb4e055134faab5d1247c54d4aa59d51de9fcef5ca611925a009b6d82d928a2fa0ff0a7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiep:A3k03kHRJf
TLSH
T1EF25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 971KB
SHA256 8ad05dde856e08bc981a90aad8ed68fd9ba71c0d4bba0b9b27bd8b4fe583ab96
MD5 b003d51f7307d17c5ca84e90712357b4
SHA1 ecf1748d7c47940dd511758302e80cec6d16b44a
SHA512 eac357f500817f300d70636aa087caa3e85e6884dc5b686b72d4ca1e52eb2bf7c606edbf1404ed1d051c9f3633aaf45eb47671ab7a3dbe8ec09bf1f2e029f5f5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiRN:A3k03kHRJ0
TLSH
T11F25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 971KB
SHA256 a3025b6265834d5b970f69ce024cc2694efbd5fa08e0e5d22d124de6ea0b1331
MD5 66d9ccc7ef17c27a247d923198f48dec
SHA1 3aea777323f6ece36b66c2f3e74de46f09ee7871
SHA512 188bc253a62d346b70e48a09ba21d7734794955e6a6c2b39bfba5badfa4fa57c4ae8eb1d74e131c56e1f0c05317c4e8902bd1488befd6c3d57e9993b2ac4caaf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjizF:A3k03kHRJi
TLSH
T10225AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 971KB
SHA256 269abd02fb4d303015179c03b01923ffa83f998e1a84c7f67228c530dd2ddd74
MD5 e3f7d3350bd90bdf12508085c6e03f17
SHA1 30a9419efc46442a19b23ff53860b4d8c4e2ce7b
SHA512 f7ef9b3e04e4f63b55f109cf1f661cfda2786522e38a36849861e1480d19782e3f9dd686d3e4ca7216586e7b4b1b313702fc7391b10114858987708e75a4e9b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjicC:A3k03kHRJ2
TLSH
T1A625AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 971KB
SHA256 9843fc1b245d143f9cfe5408caee313d8dbbed42255a4c5a5df4b0bf74e5fa50
MD5 41acc29ee869948d871dfdeee8d260a1
SHA1 caba668091c3a53b6bfa0b1f9b5c17ac7c3d78f4
SHA512 38647fe614ccb7fb865f4ae97869d160031aea53df7405ef125437be1a10b5761f11a880b2c03316b05ca70346b26a034f870244f8ded9c1c552ca72a450af5d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqji3w:A3k03kHRJj
TLSH
T19925AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 971KB
SHA256 46fa23668cef190c351007e67bf9d29082f6d6e9742cb3c34fb4b4d71f3d2876
MD5 6956f4ad1cd2869c47d9c78e6b489ba0
SHA1 68532b647f51f433396f1a020d235eb7bd95530b
SHA512 058a280b5f4f783a44f519f559ca16b98bb3c4e7facb40994d44746ec768bca08deb127494ee20c32ef64dd4d799a8a2bb6a89873a4e055e91c7ca099e120492
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjimT:A3k03kHRJv
TLSH
T1D925AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 971KB
SHA256 bcc89044127676d4215684ec218b253d32211beb138e32724cb72702f3b59dab
MD5 106cd0c69d2052e5633235ad33bf298f
SHA1 d17a55c0d47478b1405af418b5d6410457d6bef9
SHA512 b0ae8bf62bf97f1aadec3fefe52482a4913f3e733512347ae63af1bc3f4665604b7740755bdaa2788502009303619c543b0225922c66ea11bd077f2a03d2604a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjieu:A3k03kHRJA
TLSH
T10F25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 971KB
SHA256 e52eccf6d11edfc11fc23883873989cb771826996f7474b4e189ec983029d9db
MD5 ad6ba3024036dbc53c51b3f9d68047ba
SHA1 5bf59a3f9f46851e7291f43d2e48613a619bd4d8
SHA512 35d92f437269d4d761e7522803cc3924b54290d3b0561a890655ec3a3947b5d7df2303afe502eca95349478f0fdd3e5143ccaf0dac5f30aa714bc4e23189baa1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiYb:A3k03kHRJ5
TLSH
T17E25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 971KB
SHA256 6d2d67f2bb77bf6df7ad24fa45da5d32f8c4a9b1ec6300cab91028c881b38873
MD5 e5f57934b7eb0b20f0d7d8ff7f55b360
SHA1 0b40d53aca7fc26342c9b5b5a771a6a7152bed58
SHA512 776dfbba892c48a918525fe68a7e2831d66e4e1fc5e103460d8eb5b3564d5a370b641da96f0e87a9d81d471f6f5de556b441d98837e11b0abc7b66f66f429697
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiGf:A3k03kHRJJ
TLSH
T1BC25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 971KB
SHA256 6d127ef704dfc06cd40d7e8dca471f41e040769b1579d49c8bd6169a6fde9298
MD5 7b454d1efa2d65bbe95e8af146d3c67d
SHA1 7eee2a9b82960b4b2490f4aedd3c4a64708e54ec
SHA512 d062f32be5519052b80a60eece9d1e626882f7ad0c4fc903612384f1a33d5bee10bb1a9ab990bc872b79ff69357e578b75c5e7c38122aa63ba863874a5b6d44f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiDK:A3k03kHRJh
TLSH
T1D825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 971KB
SHA256 76128897d51346a6e6238387e82f78fecc8ac093ffb6855b6495e22530d1d292
MD5 1cc7f42cda79d56da27f591e319d5501
SHA1 2233e3c2e5fc47754ef185bdecce6b2396a99743
SHA512 bfd715f19fd826e10af4d9122a2f2b1e0354ea50999ddda513a0e67b38845000468bda55e9a4334a385371c86f54d225ea7a89bc28575265b58ca247f47af70c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjikk:A3k03kHRJI
TLSH
T18525AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 971KB
SHA256 25ad39b727f5543cd78ff5b94498c7fe34c46c5e148618f55274164cb6f5efad
MD5 e390e1ad1b63ba9f14a3cca6834942db
SHA1 5c44e184f14ad479eed9ec642b56c9109b486fcf
SHA512 099005376fa965767f2717ef7c16d272355877ead911c0961d0f0943715136b5782582fec6c13dae278542a7456ac095e73deb4f9eb4b4a12d2050db591123a3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjit0:A3k03kHRJh
TLSH
T1A525AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 971KB
SHA256 8fc37799dfac314d9f7a2a0c76fd724e9f43291508d00089583ba24296a18139
MD5 6f41ac3765b29bb154afc82ac77b6ff9
SHA1 5cbf7a3496dbc1ce2175681ec9d790ae7337742b
SHA512 d2c7d30466e4115bf6154447a080e05b5cc30997bb1c4568c09ddb5d1c574d41c4c0da3c3cbc5d1ff2d1becaac024585eac06ca8a4dbde957814e3dab1263eca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiwg:A3k03kHRJg
TLSH
T1AB25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 971KB
SHA256 3c465c68fce1c8a1a2f4e363a882667eeabdf70991f19789d00d75cbe643089e
MD5 542ab35a72e326f2ee9a866ba3346a94
SHA1 b887b268435a58b790838887189c5a230268804b
SHA512 f0496c57eab4f036fb013d421b7751c3dd92802eae54b1dfdd7da0fbf1a16a2709dc83ce00bbc8f16d5fae4b2720f343547a1a07656ebea4f95c58661ed637d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiFr:A3k03kHRJq
TLSH
T10525AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 971KB
SHA256 18a71381127534623a03011e3aa91b5b0a187a2ff00fda9386d7fe3e4d80ad70
MD5 89faf1c9f502c4b3896f48a822c55736
SHA1 789ee10d8945d11d9f2bc3cfd7e30b4ca22e3986
SHA512 307e121c5df1ca87a5e45e68f802c0ff1a90e74a225d5604077f1ff589c1dec2a03a924202517648b9a6ff2bbd5573dad01f0e8437c7da5b48fa089a47f2951d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiPn:A3k03kHRJs
TLSH
T12825AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 971KB
SHA256 3340164a173b3bbc99e7c9f6f588e41094fc2865e917ae585cbbec31ac4a0c05
MD5 aaf72983ba1c8d4e063cf6e4062dd725
SHA1 5d21484e194ef79005a33c355a9516a8a6841f7b
SHA512 3a9499fa105314fcbc6c60085471e3fc2e39e9025d13ab8815c5bbfd80a0e36239dc9a316773cd2707caed94757a21f25f8a69f58b8ba40d492f26c615256a98
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqji7x:A3k03kHRJ6
TLSH
T1F525AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 971KB
SHA256 267efc905d67a21b1eb3142550e4f4cbfb4440330c656844bcf5ed92101c3254
MD5 e8e2a04a1b6fedc370d3b0a0ebe7308d
SHA1 fe866378b8d32bff9793aa01e84a3bd74216befa
SHA512 61bc63d3804a95ac4313db83133bb3d342cc49274e58169178896eb90f291b9bf9cd483ddf61865d2629788f32cc67b49d2fa22f3053c0a43f7667cfc821aee1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjipA:A3k03kHRJ5
TLSH
T18925AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 971KB
SHA256 7ed6fe7c22b323a71548467c6cff7e6ace9a5871507253d3c1a128f31795ee84
MD5 260d05e657e37d1ae4b0381caaad1685
SHA1 982d40d293de802fef31d6da3d8e95c35b0499ac
SHA512 9d2a87114160d820afab3928764bc2875c7ae8541179b8275c2b71be7a331b052125a0147caa7cb0c6107238377c9f32caf91c0c5e21294a1bfd2901db6e8980
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjii9Q:A3k03kHRJg
TLSH
T13625AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 971KB
SHA256 259d4b1d8c25ad7136ae996d9eebe154b0ecaef97189431dd66847edb7731fdf
MD5 a89c52de8009533d966ec2ef21755a5f
SHA1 8bf7815f815cff03e8c1a2fd64761913c4d47236
SHA512 2aa9689d023599ff742430da574206c95e3b535ba785f65a8d575f54307c63a0722fb45185a286724951a1240a72a164d8322c4727e775c99351826b8fb9a046
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiH4:A3k03kHRJ7
TLSH
T15425AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 971KB
SHA256 a747c9ef6ef8b4cec19994cf9b6ccc1753717200d14b25a6866f83fcdc9e1957
MD5 cc90650ce8c3a742686e8e9d7986c7ed
SHA1 eace2b23fc3bf37981eb9b33e9c963535eb44e3e
SHA512 ddd51861a136c1bdbc708b8fb812e87b6c5314f885e8b2346cd015ed60f55800fcca44b28027fcf8c3a20d92daf674ed75ff22d05d6b5e55d7eee8f0912e9578
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjimu:A3k03kHRJu
TLSH
T16B25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 971KB
SHA256 8f3d954e3731008c004650e681fcdf2252fe60a526e5e5ea3ab0b898e6633fe5
MD5 4753a73693348b1fb04b72fa8750d9ee
SHA1 849869f8b5a196cbd7558197ba770008e4cdebbd
SHA512 398da757b0fa36a15081b22641dd75c876aa390b948ea40a3fe1dcb76deee736bacd8742758adc7ee5074dbc7a43a11a25ed189c5d3f7251b15a072b92eff5dd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiXj:A3k03kHRJA
TLSH
T1EC25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 971KB
SHA256 85166738ded180694bfd157e2c6a759a8f95539d9cb4763c7c5ad9e9ba0c2577
MD5 837eff9d65b6b62480d65230be571499
SHA1 1034fcfc91a3b8d68b3fe1d1790b8d8f78401248
SHA512 d10459bf9a3eaa90576b0aa5ce0a8ea7fe7b06af21ad8a130ac9c1abe2321190ff74692cc9f51d6e0864411c4beb05b6858bf83bbef45850676fd3105e08298c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiCg:A3k03kHRJY
TLSH
T13A25AE13EB9504E9E10AC174AADA4A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 971KB
SHA256 6d052eb7710eb092b7542319287a74fd13a3d86f610cd29b5482bdaaccbc80fe
MD5 f1049baef202a0abf4c986436d0bedb2
SHA1 4426010d14398f5dc7cf58c131d300b6a868756d
SHA512 9b301c735faada0503bd0c8b2a2436d5464280b29f44de23a7aee2acd2df229a661ef45c1c839e0a2f35330a2984abe6a9eb3b0ff5bc8ec8d41ccd70d892afbf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqji9I:A3k03kHRJp
TLSH
T16525AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 971KB
SHA256 517223bdf968b5d5da49fc509b018b5992f34f09addcad09925ee7031b140d74
MD5 097f8ff0a51a52c3749f7e1be1d5b34b
SHA1 6c4f95ba6b476619443912910059f998a34bc93f
SHA512 e6aecbc585c6d0a7af458d6a9b4fa14d1a089accddbacce6a2e9fc34ff86d63897935b704391dfc01e8f341b520371fd5ebd3fcff0681229cc047118ca0885de
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjivo:A3k03kHRJX
TLSH
T1BD25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 971KB
SHA256 e6608d921768cd682e7fb6cce53af5f1f98f6e3bf83def7e7f6db2b172d35b7c
MD5 f245cd2a9ab1b76b102fdee648d42493
SHA1 e8151be79fe91a9745f37004943f1155debc34a7
SHA512 e6ee6c8845b28fecdcc5e8f2ea64a621d74f975709d58b3a7cb6401703c5dcb4c148314bb7e8a3351c5a66307317bbed34263aea56d2e038a998b3256a209c80
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqji0+:A3k03kHRJi
TLSH
T1ED25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 971KB
SHA256 43276b09bfa5bb49ba85eb3e535033a97830c97cdbec726ccf8593328a2781f0
MD5 a69b87b2b160420ed04a7aa8d102788d
SHA1 1823ce54bab81788ebf2cc1d5a2ca3cb6309e163
SHA512 b0ef2c879b07584bffc3ff38354fadb3f1bfc580f20984db8f3dc7ecdde629d1b137e80cf33283feac571ca1122f9ae53df47d0733167cf7c55fac2a2cd56a9b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqji8Q:A3k03kHRJW
TLSH
T14B25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 971KB
SHA256 5111c57ead0bd3f0dcfd0af0c1c9e3abde82d586f1e87bb3b8469f1f957d8b4b
MD5 b2139be088af20122900cd930e0ca9bc
SHA1 90c2ae59d3a891444471c199eb91b7b063119092
SHA512 1fec7f583dd1c03a10a448b2bfb6c83e3573597b52f31bada1b5b75781d6384e23a0af636c491b318cbbe959c86a0334503f6ea3dd79ae2a37f0fc1914906d03
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjilX:A3k03kHRJW
TLSH
T1B125AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 971KB
SHA256 7ffbb2b00ffc4112f70744913dbc89f9769695cb1e1f65cf1a761f6883299474
MD5 05bee8d16e26832a348e4b9117c99246
SHA1 67da37f8cf49a76e513c5290ccc8fa9a0f3f3249
SHA512 637d2d4463bf14e0a6d5f51d67508d9fb8c6a46bd3f848dfb21c2617ffd17a73a4cfcbec9b6043b0471f321332aaa93f94a8fe18e33eba054c2dde89371a49f3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiHL:A3k03kHRJY
TLSH
T18925AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 971KB
SHA256 2c768666f90aebf2c7dee588bc6bd5ab2745ba2efa701a64091e23578a0682d4
MD5 2b0bef830498ded3be79a182ecbe2e4f
SHA1 fda67d9c93743ca85fb3e7fd7f56248f1b40f40b
SHA512 92f647ade7e36ab08752ac94806ec44505af99811783880254ae4d0f7b8b32952c206716f60b80f9c3ee605902275ecf488980fd95623d30832135ed913b6445
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqji9M:A3k03kHRJ5
TLSH
T13D25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 971KB
SHA256 5716aae9de898b87bbdf8a4c5450b7bb2a40c842a4225ebb8541c0d793a7118b
MD5 07f679d1df9956465280dd29b83b26e1
SHA1 c5820d2d6f7a76166e8c44cc7120743bbb06f091
SHA512 56784221361b674c6b89fa19b74f51612924e5adfcf55b14aa1ec2e31edfd1dfee409bfa2092a321209874af2222528802242bb69b5f3348dfd71390f996dcbe
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJqjiuh:A3k03kHRJr
TLSH
T1F225AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1136-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3208-22-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads