8be531d7dbec2c4628566bc3f547f9d6a0d5851cbc86b94ec31bdb8159378bc3

Analysis

max time kernel
95s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 939KB
Sample260812-lvhypstfnd
SHA256 8be531d7dbec2c4628566bc3f547f9d6a0d5851cbc86b94ec31bdb8159378bc3
MD5 973f53f1933c3f236fa530df6d6f03b3
SHA1 4ede96740c3bc9fe5cb58153f633674b57715901
SHA512 d564f792510cf969f0ecf186f4338d14fc29347d31f2e48f668241c177065bba9e0368e317d1d967e88984a198d96f338ed15e917131a5cbe51bf5a649be003b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvN:A3k03kHRJN
TLSH
T12325AE13EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/4680-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c536-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b30a-57.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4680-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4448-167-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019849-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0015000000018a5b-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-684.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e9-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1003.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1085.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1134.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1159.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1172.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1318.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-1331.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-1356.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-1369.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1391.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1398.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c536-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b30a-57.dat	aspack_v212_v242
behavioral2/files/0x0004000000019849-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-440.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-495.dat	aspack_v212_v242
behavioral2/files/0x0015000000018a5b-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-684.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-783.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e9-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1003.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1047.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1085.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1134.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1159.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1172.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1318.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-1331.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-1356.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-1369.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1391.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1393.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-1395.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1398.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4448	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\klist.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	patcher.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$	patcher.exe
File created	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe

Drops file in Windows directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4680	2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
4448	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_973f53f1933c3f236fa530df6d6f03b3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4680

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 939KB
SHA256 8be531d7dbec2c4628566bc3f547f9d6a0d5851cbc86b94ec31bdb8159378bc3
MD5 973f53f1933c3f236fa530df6d6f03b3
SHA1 4ede96740c3bc9fe5cb58153f633674b57715901
SHA512 d564f792510cf969f0ecf186f4338d14fc29347d31f2e48f668241c177065bba9e0368e317d1d967e88984a198d96f338ed15e917131a5cbe51bf5a649be003b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvN:A3k03kHRJN
TLSH
T12325AE13EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 8bd9172d2ba1734e2e1860d3c82498636cfe30459e066d1fe69365399dc04910
MD5 1b73b36855e32b55d366f77767eb02dc
SHA1 b879d23c501c9c6db111d7cb0756ff63d8c21629
SHA512 1309e2a83d65b8a76c9017d52fc0a0d8f2ca22cd5e9372db8bc93f4618051b0c9974de6920a785bc9c53554e8c6ca2c5dff63bd782d3c5e93cc64ba132a4231e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvZ0Le5ji0hmxNrM:A3k03kHRJZPji0Aj
TLSH
T11D658C17F6A402B5D027C1B8C6D6966AFA7138821B3086CF1359C7283F67BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 954KB
SHA256 1555384172aed3b39fb2473c8ecb3952c9a26a42ff52a20cd0e2e5a52a873f83
MD5 c158fb7db7d5d4e5d678be4e8c557494
SHA1 4c6401dde24063d127f673b318943f388750cea0
SHA512 641d663299b30e8ff6f69dd719de2d11894b76f45626b6c64bdbafb97e94fdbb7e881d904c2c8db37fc8951f44bb5841f221e0240a6742890326af069cd1efca
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvLa:A3k03kHRJ
TLSH
T1A425AE13EB9400E5E10AC1749AE65A23EB757C56176093DF2368C6152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 963KB
SHA256 5171c7d0e406e3cb784cc409e82f4505eb68542eeb73d81f504934c26535e97d
MD5 43673b2a57f50d2c2a359d9738aba498
SHA1 4cf688e99fa109cc07c1fbf7fc8a1e76ce5f0ad8
SHA512 9c03a79ee8d00d554fd683cb2e57d5de966595c85b6488f819cfbb25e64ab24e5c882d48452dec572650ce4d3675702e6e528091b73858743092ddd8dad9e94d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvK6:A3k03kHRJl
TLSH
T18E25AE13EB9404E9E10AC1749AD65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 963KB
SHA256 292c1fb4274b4e9adddccff80719e45348d89494ce16f7f542edc9529c4fd882
MD5 3ee698b67e9294d00e259b97b3a225f2
SHA1 1c25ce27e8ac3294eed304790b4545087377d907
SHA512 69c096769caf7ae28b81708b610dc09a7c7a11f4b5966fb87dd6ff80ca8288b1d923a51c5d386aa45ea38b52e3a7c448d6979a91b88702b2357c45e23e837748
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIviN:A3k03kHRJ0
TLSH
T11025AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 963KB
SHA256 c835e7a6c7b53dd7221a459040c911db8be872dde79c50122519cdaac62a1408
MD5 d7251684ecd37117b5e38931b420de67
SHA1 d4b6017e189f357eec4d1b32cd0cee2709dd0411
SHA512 5b3026a29514fe63e2fdff9b7b47a9891695ee00f2c4dba9ff078fa04274406c6b24101d6643e57e05337bbdc9fccee4c0c1aa33d84c874b3c4c6b9284ed7c8e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvYf:A3k03kHRJU
TLSH
T10925AE13EB9404E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 963KB
SHA256 7f2c6a119680015ae3ae02c0313308add450c9df4e75a425d1aabcb2451c56cc
MD5 a92953925fe86a8299933c41fd7ac862
SHA1 6a80d2e425f0db519339418005a969b67f56daa6
SHA512 4146eb05c9324bfdf244881c357e7acd8f34b7fdaff4af9f01930b3217cbb3be4f4516aed000efd41ba3c109b105d96f9334b768572502df24359d0e7e1a09e0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvyo:A3k03kHRJp
TLSH
T14625AE13EB9504E9E10AC1749AD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 963KB
SHA256 49ed6f50fe45d2a1d9d569d397f9c9e480ecd3886d5f0da66228847e090924be
MD5 2963fd9546469f7f59bafec013203548
SHA1 af8cade3fc00f36f3bf59a5a6a911c2a4e6d6a50
SHA512 f7416c950d5149d753a0e62b85a4b2f4d29dbd87b74bfa3b6a0f610ecefe692923e3936ad6d93ecf344e1d74d24727b211038920e19b830cc73d80495d5df008
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvmu:A3k03kHRJL
TLSH
T14225AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 963KB
SHA256 93d2195692cf3d34fccca0305eae83dff674b897ec441c96a9c0b6412d0ae9d6
MD5 4bfb4aa01f0b6e94298c2838f47b579b
SHA1 d87095da949ab130bc80a1e3d3b1ca19b7825cf5
SHA512 b404e21e65fe9bfd39aca321a4f87a33f892403c776d928577b5bbd104d127f076617574cbaae0ba994097242b3d047ca7aecf3b2b082f0f97fedfdfe5a87566
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIva9:A3k03kHRJq
TLSH
T18525AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 963KB
SHA256 19dd8e43481e2af37b2f68e02d837c7cea54dd9a8c59e2d5d4a9f7e2a3553f8f
MD5 f0f24b3ccfba6ca1e7de08ac3362050d
SHA1 b3f7b378ad292ca2cdd9b79f2ad2051e7d572661
SHA512 66151988d16185d1fc9f3ecd69e31a46dd6a63d64931c0ee2b99e5af669c932969b46cd67dd0faf7e57e3af7e7eca4fd21406a281cf38876cb2616a88c9d4ee3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvac:A3k03kHRJH
TLSH
T1DC25AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 963KB
SHA256 81ab6f97737028140ece5a1de170740a280ba90e476fb024ab5d005d322839b9
MD5 3fc99aa42ddd8f4f267b4df9d47c1980
SHA1 02265bb2d5876b2a6d3c52a41d7050ff42a0e531
SHA512 3619a3703905bc63afd39e61deefcc357d18e8a491aacc9500654f380557bd6929e31fe1e5982cc76df0eac6454b895779725cde82a678631a68d3c932711e60
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvTp:A3k03kHRJd
TLSH
T1FE25AE13EB9404E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 963KB
SHA256 03db12a3a3dce91ee8a3324dc4a38bcc3597b9a181b2560cc89d0e910c7ae709
MD5 2fc92bc1cd84537a1aefac9d013a0acd
SHA1 b068c18241044ba38ea1a0f7a9bbdb9e119180d8
SHA512 e0f2535345aa066d15e53b5f8ea53f14eaae31d37550d8cb786ba49d919a190c5eb018eeebc9e5aeb96cdb9e6901377876bbc65915786cfcf031d3f7883aa092
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIv0N:A3k03kHRJm
TLSH
T11225AE13EB9404E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 963KB
SHA256 f27180076f34e5cff6713a3a116c7117e7bc76e9190215e5dc53cda1e4beba27
MD5 6281161dbaa2e3a5886a0224c92f3188
SHA1 d5de137550c2c9cb7cfdde57b45befad1d5d64b8
SHA512 e668c685daa0e07594e719f6e12645dfcf6d9868cb2ced9af218ce25d57f401e0b56018f9299290dc8a3f112676421e0c75af0dc72e378bf4f0d1c676d81c0db
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvcF:A3k03kHRJE
TLSH
T1BB25AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 963KB
SHA256 ff4128727af0b1934bf69306e9fc8df0f18d1969466a24edbd6063eb1b7ebb1c
MD5 dbc5670b67de30e4471c3b91dafd5d6e
SHA1 61b30468e377d0cdbeaf9dd60f3cb434d9ef3cde
SHA512 688729b36f6b4237e80b4c56a165fe6dea8c24ae149bceafb414af70e8cb106f579b1fa804d25515e8af272c28754cfdb2d8e610184c8e1bf99e79d21e6fc1f6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvJC:A3k03kHRJw
TLSH
T11525AE13EB9504E9E10AC1749AD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 963KB
SHA256 f7402f90ffa1e05f491a757a89ae767b1ca32793d09ec6c1119dee9d80315c8e
MD5 2fe083d081db2cadc787f8b8cbd1b7c5
SHA1 501f1d3f9fc2263fc1e058c6054491ec3fef8819
SHA512 fa161afad6f88576eefd31532f579af21d844a46af2e11ab1fb9f958390af947880cc81d672f767928df3ad2b91a73026d834f3d58276230aa48c8c8c5646e75
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvqw:A3k03kHRJN
TLSH
T15725AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 963KB
SHA256 e47b55be656be041fa9d05122bc8ffe8942703a16e567c563f9fed3ba26c54d8
MD5 7f1bc0f909f5ab6f247b81c70066e9f9
SHA1 64e34867b589909e35f45d689be3f154c8019126
SHA512 b9812b2fa11769806f980e94269ddcdff95bad38dbfa3cfd36b1d2b7282f0b488f8c1ae252db14f78c735f69bc014c2bb09d505be3e35b170fe5fee2a5bbfae3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvxT:A3k03kHRJB
TLSH
T10025AE13EB9504E9E10AC1749AD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 963KB
SHA256 090883768142140393a6bf2aa71395af0a5afcfede7efa1f3ec2692d56e725a9
MD5 fd109b3b32f296dca8823a3506de57a6
SHA1 f951277859898a2f6a7fdabc74dd42e4333acb12
SHA512 53906221e0806793b599b0c51899db6f9b2a47619860a48963bc338c3d23c3dd68db3520b935b324c0ea8aa78fe574c6e0cdafb268a9b57c165558f8209f9df3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvfu:A3k03kHRJ2
TLSH
T11025AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 963KB
SHA256 b710a2e61bfd4237d2f4fdcca73637e87534990b4eb6a8ac5608915b81f238a5
MD5 4c9430d40b2c7e4822b32e0f981c8057
SHA1 d727b0d896585a131751f67e08c781e0af244ce1
SHA512 dc16e0043a211d24a807ed1cbe4eb5220db0c6694c7e99cdfb118270eb24d971c42a0ba91c9dec4ac9e008d2c66051f695e5efdd2acae99ab35e5ca75c34d9cf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvDb:A3k03kHRJH
TLSH
T10725AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 963KB
SHA256 c6e1c29a629df3087522de3de44296028ab3643f2ef0d60b8bad3eab62029d5f
MD5 b75b59a1a859e0d2cc11b3c67af05f58
SHA1 98db26ab332b0cb7940b4ada86544325c362a1aa
SHA512 fc09b7761fd52cbb3eb1a99cff5af8385a14f89edd635e64a692553e3b17fdca8c2c5e6a74803e56184efb7dd4dbf52a8210d39cc6695897448fa42ac66f733b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvXf:A3k03kHRJv
TLSH
T16625AE13EB9404E9E10AC1749AD55A23EB75BC56176093DF2368C2152F72BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 963KB
SHA256 064a22c25175241f7c598dd6304b0c8273b1ca03efda0ef7e71f716c94cdf663
MD5 54e552669df7a0bc4db85abe601b81e6
SHA1 911997e5bcf16ad4d06bdc28b5a11fc02d4cf948
SHA512 706eaf411d417ee42ccbdb31dcee9abfedc6df387f886e62b517f57b6f843ad7bd19b6f474e0247040fd116e3e0a93d7897892c55bbeb388ef0a5c3a936cbeeb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvgK:A3k03kHRJP
TLSH
T10F25AE13EB9504E9E10AC1749AD55A23EB75BC56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 963KB
SHA256 15baaefbd9572b49cc44ef674b8e447c891213b375de34cfac6e51852e5424fe
MD5 2611635c7fd737c5f3329585db1eab84
SHA1 535d4f3902a82319cef05f3cb52633c620ef3956
SHA512 3f93bd3def0f78e13e666feb68f46ff48baeb8a11f0d4581d92ac769bb1db05199e2a60d28827a856c9008cfed0039a2e3915faad675a4b16e7bbff838fc4a93
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvdk:A3k03kHRJa
TLSH
T1CC25AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 963KB
SHA256 cc6fe8a2a67996119e5c08e9aedd095518b772b8ee51452f631b677e90db6be8
MD5 b6dee26dd34ce695ba81ede68313774e
SHA1 1e8cd1fde2ef8c29892700eeb62c9e8c3f0cc5ea
SHA512 1da03967ac1d1ce37fa661f118607d9f24eecdd2b17c3aadabc745640c3744d34234fee2a736de8fe7e126df6249aa95449e5fcf8f599da8e9497360845e9b9b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvC0:A3k03kHRJv
TLSH
T19125AE13EB9404E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 963KB
SHA256 44b0d4544455fd9ebb4af92cf41c5766d9faed2ff10e851772484dea880d8f5b
MD5 b44dcfc5a24e93b23316ad96fcef0ed0
SHA1 4304db918e4a22d37ece9fb6e317474ca128d985
SHA512 904017ecb587ab3a44366ac1f65700e02bc8a8f4dd2ccf7b25a9522a8d72c62aad34c94d727ba197cb54fdf3dc26a1b0aa50841956b84b3dff81620f5abe54bd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvRg:A3k03kHRJy
TLSH
T18A25AE13EB9500E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 963KB
SHA256 69e29739efddcda64b03d37de40dc70d2d1408c0994a8bb3c464e6d7aa8234d8
MD5 136d91d58c4f2fdef1974773e14e0dae
SHA1 c2566837aa0d36f82426592c2ef82f2e3541d99d
SHA512 2d513592ceb17a9b8b6502360ed8fc90840af70bd23300ae60cf36b4647fefda00f67c40f042e2f3b609eac97850da528963daa2d0d06633fb8e03af11979939
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIv4r:A3k03kHRJ8
TLSH
T1E125AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 963KB
SHA256 c0fa1f011b1366b871f24a2c6619e66a0e95f973f2b42f076b1432476182b0e4
MD5 77cb3f9d88708186fd9e0c76dfa1bd96
SHA1 64c920f9957301a7b4c5535795fb046a38a25509
SHA512 3f06f2b20cd736a3d82949455e5acbbc50d9b777d6020796e9a21a9ae11df07cb6dc81dbcad145cde2760fa5f124819b9e89700b9fe0b6b846b82229990035df
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvWn:A3k03kHRJG
TLSH
T1FF25AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 963KB
SHA256 39b306e79fa4daeb47b5c7ca89902d21935f5a822515a0cd0ef3a8f7b9ab322e
MD5 a8342c4bb5c3caefa48dab7178bf7ce1
SHA1 4ebcc42d8f4790f474fe0204d24ad447c10c7d21
SHA512 fea07e2a82f0df827b23e8163a0500ba73d4c23408fd4680afca55cdd9e97abf68f393d9343760480f02dfbc1b0270965fb70b7a7461f8a0a3f7c0fd26ec8753
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIv8x:A3k03kHRJc
TLSH
T1BF25AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 963KB
SHA256 63cd1f043b19752fe5f4490ca566b121877c7e42ebe74f70bc8343a7f82c7f2d
MD5 358a43d26d8c4ce3fbb1576921aa0f92
SHA1 28f96d03f1197a5f332eb6db55fdbbd8761509fa
SHA512 981c79c34abc24b748ccb31d04bda422afb1d5e2b61069f8c7dbe6a15ad71f21d00108ac956bb4a6438a2f4db55179d8ea1c25f4ffc01aebf6a96c0ce7542137
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIv2A:A3k03kHRJn
TLSH
T16A25AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 963KB
SHA256 e04814ec945703a24a8a4ca4d95396be9c3084c18b706c4f699cd059a2ea0f79
MD5 c585a690537f60b6fca133052fd9ba5c
SHA1 648fb8044b1e67f65407e4d065ffb42b38fd6cec
SHA512 672654515da5641d556df029f943f805ea87c58c4d60e1e267eb059736ac4563e4554c009f470f6e038d2d69e809801f48dfe85e57eb9dc11da3bc0402a587e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvv9Q:A3k03kHRJK
TLSH
T11425AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 963KB
SHA256 ef8efacbed1310ca24143b1be27dce399e75d80420ed0a6331ef6905320d32a9
MD5 ad7cbfa2c6732afd264b4b4c1e581007
SHA1 a1fc7012fd571286ba853139f93cd22d792fd139
SHA512 06e0a4cc52cbaa7c2830d78568b869e6c56fd03a17d47ce0a3f6684f867e12cf2eddd9594878a8163355080959ea408be53d621d8ff84b9edf770e1ac7c3e226
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvG4:A3k03kHRJJ
TLSH
T1A225AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 963KB
SHA256 38a103233d4ec2415b60e4f0715c55376490e4256b316b223a4687284993d4fb
MD5 6874f9caf56608512e245619b45047b4
SHA1 46cc4e5b5b0855874a602d889041f43d9f0b0120
SHA512 287a9ae96ff4ec291ecdc4de504f038e4ed89212be3ed9f8943f7a9c8881566a0676bee2171d9b5aa12243bbdd4c512ec955b858cc848a59fed1d546ff2050bb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvVu:A3k03kHRJU
TLSH
T14A25AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 963KB
SHA256 ac7bf9ce1ff93b476163a71909df451d6d1004079c97efad27a915575638ef9e
MD5 8afd44be36c29871e8bb9ca94a79549a
SHA1 d6e22bb0198e4c1a96a242928d5255f0df777834
SHA512 f2cd5ebec4f365faee48a6c36dc413a2b74dcee0181362f4651248ffa6db3c972e0c06801f9886e8b8cdd9fc6800894375268d50949dccc7bf53d8160af3bc15
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvIj:A3k03kHRJ2
TLSH
T17D25AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 963KB
SHA256 d5144b5619e9d44f2c5c4c7bfe5a104302a7b3579a143cffc3ffbd4535a89167
MD5 0f9531407f3ec6c1c10db1671f55b988
SHA1 0d4cd10f3e437d7d579bacf22bd9ef01ace74a39
SHA512 487b277803e9fbfaea7a2d2391eb2929ac97f845ebe96f974112b271a3df0763813c5b62c90e0b264ad815d58c67f0c9e37b9a04b87a861303694c285e0688d6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIv5g:A3k03kHRJa
TLSH
T19625AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 963KB
SHA256 e203dc8c7ce6e3a155640c5daefbfceda0617ad670de0c5fb2a222c5cc525140
MD5 00f87db8b43f595ec6ef91c2eec8cd91
SHA1 8d512922ab22db2be87d38b441e5cd108ad74a2d
SHA512 d57e3ac513e3c497e8b6ad888504833dee6114e116faddf58e9d6d9764e8cf4e09626a40f03a2ce13687e2b7a796cd0b3204fff522e925cc6c459c79b58caefc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvgI:A3k03kHRJb
TLSH
T15C25AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 963KB
SHA256 dccef97fce0d3e6cce1aa156421da16e1c18bb537aca3d0b7f624a442b39630b
MD5 e6d24c8dc2fc366ddefeb8a52ff197d1
SHA1 76636e8b4bfc61acff78c887f39537afc6a67f57
SHA512 be1ab417e80a55af3db6c9d9196cab3c911702a43ff710cff565d57fbb03c96f5f08b77fab2a050316c1aa30caa2fde7eba125e3227c1ae15003825d307b85e6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvio:A3k03kHRJl
TLSH
T1C925AE13EB9504E9E10AC1749AD55A23FB75BC56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 963KB
SHA256 6bbd7f482d3208901bbdd8cf0146912c642c8cb69d53ca6fff92dd322927542d
MD5 98cdd24f20999f47ca4b5646d15fc9ae
SHA1 3e9d35a03a8934e428184e1f6b3cbd42790a6f05
SHA512 1173ab42b4f01babddbbfb572ad0546a3c0cd9bb21f5318220fc2d5f935a56060c43f1fa28b473ce55f43c54d8c0f7b942826d96bc1ce3c361ca45c63073a5cb
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvZ+:A3k03kHRJg
TLSH
T19025AE13EB9404E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 963KB
SHA256 ae4069046290869e1cccb97f00d54c992d852c8d89682853ebabce2859b667a8
MD5 9805a11f0dd6b1112befa3c8f732ef0f
SHA1 f803e9db48aa844ab694cce2bbcaa0b9cf13813a
SHA512 fe4260e908eb779d0f878e7c283600362dbac183c90906bb59c0c63d2295f704435795cae5bccfd00c6e929e587a5b6e30213ea7c2ba078ac63e492ab831e16d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvHQ:A3k03kHRJw
TLSH
T1E825AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 963KB
SHA256 13054a675712d987f3e23dda4e4711efa012f725afe7cbd5a3f4e5fdb75a137b
MD5 1c78d2495fe74331785d2844552dc4f0
SHA1 4f5e8f43ee29ea75222b433ce4b33f2d0e08f87f
SHA512 b49c2a54886b001f8897b83623255f9123c87492ea8b65b065b22c17b931cd7ed8a73766b36a49660efa29deaf0c575b879c59b4a1b5accd7a6fe6d052534615
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvcX:A3k03kHRJA
TLSH
T14925AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 963KB
SHA256 af2911fa7494fb5b20a2b7e00424e4117598fa1d9ea243ccfe3bc406eda2d350
MD5 bccc1f3f8538ec7ef17f60b0e4fe3fd8
SHA1 4b7709f1837fd94250893c45b63bed956181bd05
SHA512 83009c0348da36e936f43ed1d5bb665b087ea406ff3004fc5fbb1aa966e00ceefd5742b85ab117784d969342384772ba961152d783bcb127d0d4a0f31ee718d1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvaL:A3k03kHRJi
TLSH
T13125AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 963KB
SHA256 59052d7880fed44aa21f567ceac611e32f5b1e283bc410632cb45cff7350f2ff
MD5 9e585b45b451705266c6f83d8a858cfb
SHA1 d9cfd74a9dbfcf13fe64fd51e70f4400c8bac25a
SHA512 eaa6e07f19791087a9eea77789246b5506796b6758332b89e63e142577b6d97566005d4c3d4abe4467541f2a3254633f13949c97f0163c74bec0553a88d00e94
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIv+M:A3k03kHRJv
TLSH
T13725AE13EB9404E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BD0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 963KB
SHA256 2b528bc2e8bdfbeeefde65d99311df03a44bc7065dfa629c22b2cf19150ef11e
MD5 1271645c0a55f2284731fee772c74ac9
SHA1 14c879e193dfe8013d4c08ea9c19ead632ee123b
SHA512 69b166bdc4be9411061a6e10421b2d6bbe8e8e15d72316b49d6c2ff34a777c6f143b4ebf5e0c57134c3c8acca12b63d6c06e1f64e0b7b220e0f4be58f6aaebf4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkIvnh:A3k03kHRJh
TLSH
T15925AE13EB9504E9E10AC1749AD65A23FB757C56176093DF2368C2152F62BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4448-167-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4680-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4680-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads