e1279716ff08372ca71d44ecb319c0f9ac02e8dec1a12826bcbbe9a760662bdd

Analysis

max time kernel
96s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 933KB
Sample260814-stwlqsdq21
SHA256 e1279716ff08372ca71d44ecb319c0f9ac02e8dec1a12826bcbbe9a760662bdd
MD5 e6c5432025a656d990329a602c79c25d
SHA1 2b9e3f0e81328bfb1880e90effd5e3a6f547bd12
SHA512 9f8875ae2727b8c9139fec98d48ad715333a6441b5d44880037816f0db404bbe66896a0c8c442ead776ec9f3d21fd812c033667d4eb25ee3a4e66d3a7ed95830
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcK6:A3k03kHRJd
TLSH
T1EB15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/3912-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c566-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-39.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3912-166-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1356-179-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-440.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001bb29-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-574.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-690.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-733.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-783.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-852.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-890.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-897.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-916.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1005.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1048.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1109.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1146.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1171.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1217.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1377.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1390.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019912-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c566-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-39.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-440.dat	aspack_v212_v242
behavioral2/files/0x000300000001bb29-495.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-574.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-690.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-733.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-783.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-852.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-890.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-897.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-916.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1005.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1048.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1109.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1146.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1171.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1179.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1217.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1320.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1339.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1364.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1377.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1390.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1396.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019912-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1356	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotd.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	patcher.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmplayer.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\crashreporter.exe	patcher.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3912	2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
1356	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e6c5432025a656d990329a602c79c25d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3912

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 933KB
SHA256 e1279716ff08372ca71d44ecb319c0f9ac02e8dec1a12826bcbbe9a760662bdd
MD5 e6c5432025a656d990329a602c79c25d
SHA1 2b9e3f0e81328bfb1880e90effd5e3a6f547bd12
SHA512 9f8875ae2727b8c9139fec98d48ad715333a6441b5d44880037816f0db404bbe66896a0c8c442ead776ec9f3d21fd812c033667d4eb25ee3a4e66d3a7ed95830
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcK6:A3k03kHRJd
TLSH
T1EB15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 8b076935746a2a699616d64f21f5ffe3adfd8b9aad9e19178d9c8d836c129220
MD5 c1955597a12c7ba7f9241f82644e3801
SHA1 8966fc4a8ac599cece5063e20ab0c4cf1a55e0f2
SHA512 da84de4b15d03786e1c4491a81b701f7f0d05e73dde6523fd8dcb07ad2f96355387bf95d24f3ee0761379a1042231c54823b931610278f95fc3449f8dd6d589d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKK0Le5ji0hmxNrM:A3k03kHRJpPji0Aj
TLSH
T10F658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 948KB
SHA256 d5d9f3f5c138dd3591e7bf2dcd19256fec7f4ad7cbebc75d58a83fd6fc286d99
MD5 7df6d6bf31c298c201ab449d8386f163
SHA1 ed8754243d5ccdb2d7bdcd506f3d7c89835ffbc4
SHA512 87830fc7dda684f57310289522f352535155a7f57bd19bd6cdbe6d4cbdca356f251f104b4f0e817653b79c8db0c821073010f27b35457d5cba18dfda2f0a4e78
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKEa:A3k03kHRJ
TLSH
T10625AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 957KB
SHA256 f6b1133fe447004a9c458008d12156bf646b32aaaf2de4771b806c15d3080139
MD5 e4ed252ebacb8cb6eae116a26c610beb
SHA1 60fb509d8baa0263503380ab980cf36071d44e89
SHA512 48304ae0ff2226d9addf769dc8648b422517a15917d17932818f2c5b6e8c7536b36485bf59d6cd6b77af9e2f817bf1c098336d06ef435f19ae8db96ae3ed9416
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcK96:A3k03kHRJ1
TLSH
T10425AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 957KB
SHA256 39ec40e562979af646be697dbe43ac168443a62a6531d3c5641031df9674a036
MD5 760188567aa737f2be25cbc012f19a2a
SHA1 43873888348c8c7aa57e6ada16e965a2b5a8c48c
SHA512 845880211e5ce58100f5cb3f051e8f11378b47cbbb2095376cd684c29ef0396669e137f698101ae547e023126700bc8fa4412c3e358fdab3a93657e2f599ca78
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKTN:A3k03kHRJE
TLSH
T1D725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 957KB
SHA256 e56ffb7b4007ca4f31318a37681b6faf0be98ec53b65d0d395c381c57402f56d
MD5 61300dcba1bdd092ba87d68491fb051d
SHA1 746b6e4ea7cca6c0f91c81a9166ecacb0e418bcd
SHA512 666cbb95e8aaf8be50e5251ff3af98a9872a18d92c3ae67ac0e1a297d550733a737ba6e210c0805ee726e7166efa7aeafb664e49bce6e61ddf8905a0a023fbb8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKhf:A3k03kHRJE
TLSH
T15C25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 957KB
SHA256 8034d50d28941a8fcbfe40bedd8766b091cd376988392d32dad065d15697367d
MD5 4fc61f8f7ba928591204eacdc4e0a365
SHA1 20c6ccd6da9d9de90357f1e522ff41d890796f5d
SHA512 10f3003b052dd63c6a555d5534b9bfd7fcaa4fe5701ae7d47e2959923122427c48f06afce22ba82c2cd3e457946e4ad4c54f78785a8fae06e33d4b89e7e12275
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKDo:A3k03kHRJZ
TLSH
T1A025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 957KB
SHA256 4fcfaf59ab13927d49d421428590569244ebed422b1ef20f8f6c50578f61ba7e
MD5 1929b8d6e7916e1b1dfb15138278307e
SHA1 0b5aaac0f088e113ce9a93c1995fedbe6a0e9191
SHA512 d07f15b85f82b56b19a1d2ddf942539bc501e14f7cd5903d3433b02643d901266b58278f7f2514d12f1dc320f2786e29ce8e1184a60eecf2715577939abc160e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcK3u:A3k03kHRJb
TLSH
T1FA25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 957KB
SHA256 c2803169d41b419e6e33f0526060870151718023aa95fa7654a7ebc174913c11
MD5 4e641629330e028c517881af1e3f9959
SHA1 4d297d0e72f6ff9bb14ca5701bc78c3c05fb22ea
SHA512 c02d4ca55269d29a4518fb892b06ffc5108beb1153c7881a316e363a2e11b3ab28116b5a114fbbb2cf8e325bcf03c1ac69596af52070b6ce23427fea2ec93574
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKF9:A3k03kHRJa
TLSH
T19325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 957KB
SHA256 9e042c338780b4c6cf124002b469fcb928a5d98c9216d79caabbf03c530e0243
MD5 12bb52460a642a4726df4494ce6067d5
SHA1 d7076b8c0fb22ed8f136f56a04ae62fba12f76cd
SHA512 dd81d8f0f0ab6e9afdc61dede5cf4f4192333e4022c4eff199df709fc6f3bb976c639d604f6ce8fd2ab66034756d494ba34040188539598032c7fb01ed4ce8b2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKhc:A3k03kHRJ3
TLSH
T18725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 957KB
SHA256 dfeeace9a66bf59e329f35022e0a21395861672181c8300f034ce9c1c7663c96
MD5 e57b30979944b1eb95f4b91d6b0758f1
SHA1 55e976255c2125cb56b6bc220e2cdfea1fe8954d
SHA512 3a38454c822c3751ed894092093cb9e2e95bc1b78c5158324abc0ef4d500e8b6d06e7b7e05caf3f093d1477a9ac08fdd02f12bb3aa85cedc6d0d0a1fb3bee981
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKKp:A3k03kHRJt
TLSH
T12225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 957KB
SHA256 2c977df5f4c5a0f717a666b28bf8a0e35786f255a1985510f483b33070c3d2b3
MD5 3ed2a4c9e806689cb566bd4376de57a0
SHA1 733a8ffc2d0e0e5673b606509388e0ee32fbbe7c
SHA512 4f8c1aa943b164637d8b4228f3b7a435d3a71b549a4413e284cad5925409785d3d1f2df6623811dafb5f41e7733e8ba9250042e050121b374d7ba844ed5d4577
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKtN:A3k03kHRJW
TLSH
T1C625AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 957KB
SHA256 ebe0a93198cc61619b5fc8b1eb782336dfe7c61fb4711080a643f5f71af567d4
MD5 995ef50325fd6d26caf9c9d94928ba23
SHA1 610a4eb9d88cf2f1451affa754801498d1f21f33
SHA512 6d700c8222301694c01de51225e366e8935fcb10302a4d9fd192187d3ed7a16fd530268839a52e58c50970d361f4101663be1b4d5a5ddc3b886720760cd8f0ce
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKfF:A3k03kHRJ0
TLSH
T1DB25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 957KB
SHA256 3bfae7c8f713cb1408b9c2ba10f6defb66ba9e0cef7c85a0e1f11db395e1e32b
MD5 3715027d55becac1deeac060794ab6ee
SHA1 7c576d664037c5fb06fadee34b0ebb3afebf35a9
SHA512 fdbbce110a1310f42ba6ed5f9fd4199dcd293badbace0307abcd7dd33e548e9fafc08be075431d14debdb35f2be6bc431f838e93850031d59564e05bd36c5e4c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKAC:A3k03kHRJg
TLSH
T15325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 957KB
SHA256 09fb0539349fb5a0225da2517667b4583f9f70409dcaddd2f8c4707f5321dcaa
MD5 b8c26b0c62e3907d58870f1f1c90c474
SHA1 36f5666d49a8c4cda8c2a3fa779e06b35d299800
SHA512 58871c5021b5e12d514b0875d0bd7c83ae389a2563b35788d331d073e2876620e6c06421e66f58c1d7ecb6e5722168919cb50fb0b4fe314de38611eee10c0bb8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKTw:A3k03kHRJ9
TLSH
T10625AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 957KB
SHA256 d86e0dae52ab27f2a2af3f7f0cfde9fb4bd15e4ead9073d18ee0f90111cdb04a
MD5 aa8d00ad930a6c853fa005dbcaa84604
SHA1 3691b1afae5b972745dbb8f51939c6b50d90b21b
SHA512 4e423bc00bf956ccd69d9f4e7e6f3456e3f55d2c7b821e9a11bb565fab9290afd319bf763d1faeeeb01645b3326285b6722ee686aa9fa647467527d12fab7eba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKaT:A3k03kHRJx
TLSH
T16725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 957KB
SHA256 5da32ecad1d1b6350827ffaaad4f6919d59d6e0819687f22e4da50aa8bee61d9
MD5 9b7fbf9ca772f6806c3ce0e609dfc4d3
SHA1 300ef4d25cdad87ce3c3585583fd98f7ec5a50bb
SHA512 9fe9cb5ca330594c772224fb3f9a03d1318f8d4b37b0dfd1efc68da3bcce4769549f34c442d64846713d54faad62b67adf4be8582a58589c7d599873f4df91f0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcK6u:A3k03kHRJm
TLSH
T1DB25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 957KB
SHA256 df968bd45f671be40866cbdea5e0248ade3de136f78c9b7540c87e8c5858920c
MD5 3be814c912a0a7fa2c5441ab75048b21
SHA1 c3c12430a2e24ad0a79fa1e025a96308ca232ddf
SHA512 f0a296e9d6b6f72ee830ddfb608bbafe4b6c96b50ce54b60b35b18777814b46cfd9294ab698520b427c91e96b41e2fd30f3f16b848906576b3ac051f3ba11862
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKEb:A3k03kHRJ3
TLSH
T1A925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 957KB
SHA256 90c5bd9250283e251ab22864a6716fe0e141bebe2dccbdfafb9f2aafc5a412e6
MD5 f2408e5d234dcb2508e5d38d6a8d813e
SHA1 65a13bbc54ea3ab0596f741bda6195562d167cce
SHA512 91577f9f1103893aa365971d114a08aae74ead269ca389e6115617f4ec91cd1214ce095ea745b86b0296656a7b7f5198f10bc7961ccfe0c6b8c629f29b4863b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKKf:A3k03kHRJf
TLSH
T10725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 957KB
SHA256 7f31b7550da8ff5fb7337104219083a65d7030494b30b24f72868b6133e0e72b
MD5 34d776ebca17d735d0627a2cca53da9b
SHA1 658a8c6c7ddeab53ee284110b6fa76f292ec4893
SHA512 02159de0ef35a9ec43118e47dee66c70676818323966bb9b9c6be0bb4e07cc7e40d910dda27c3e31841fc02f8dc578ffc73352885e204b2b94873063be86f24c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKXK:A3k03kHRJ/
TLSH
T1B725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 957KB
SHA256 2fc31eca008932a18ad855a566c39390d9a46c58dc07a241ad3507c54483b3ce
MD5 d715f7630693ce458be85abf0fec23a1
SHA1 607f9b50312cc108bebec47f1207766a784983f8
SHA512 a70d05b864662068bb0a6d15e123dce8ea27f260ceee256a546ab7c660df669e06328b12419e609b384989bc9aef8fc6419db9e4297efbcac61084b7fecfe6c5
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKgk:A3k03kHRJK
TLSH
T12B25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 957KB
SHA256 3a72924e9a2c9a0176f204b11c21a903fec42ff5fbb049504e91915fdc0e2aaf
MD5 dcc7a5faa8eee12f831e5d5c77d1e952
SHA1 941eff418aa609b2d65c719736f747790b41e632
SHA512 e7f4d644d8dca80937b43474e3ef0b9881320d40d384ae9c14b0b6400762455d6e04b9923cc6e3082201ec3ea7755964b433f50d91d724210c547210eaf4bf71
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKR0:A3k03kHRJ/
TLSH
T16B25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 957KB
SHA256 958ac686d73d47682d17e382dbf04b38a175180fb184188aedfc749ea1779f7d
MD5 e5e2d112bb33eb9eeefc8fc045f65561
SHA1 79262876c7dfffdae9d485e90d1e36618b603217
SHA512 5e061ce75d115fe3635e5838f9c1afe54854955aa43ae1d5f3fa5ce2644408045bd068a7dc3cd0d535e06e5ba3aaa89434c79f3bd27be7a565eb192de677def0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKEg:A3k03kHRJi
TLSH
T16525AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 957KB
SHA256 726b8f1aa565f0308ee89a66b94b7b63f9170c93fe423774e3f0f6dcd7f85dc4
MD5 6f4505d54deebf69dd59a487b43cde30
SHA1 3871b788802a0a1656eb9314fe25fb15d45a4fce
SHA512 07a0ee6c9d652593a722ecb24a6952a53dafb26d4553a5a95bb502430004a8b88d822850cb8324be30518ac90e022cc545e128e8064f1d08b29b336e6b33ba51
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKhr:A3k03kHRJs
TLSH
T15525AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 957KB
SHA256 75854f9be886eb81264ed41810615be6369f24b34e82c4aa5ff5a233da67e50d
MD5 916cb1d53af248a9a1700ef01af8d984
SHA1 e7100c1c96c6c5ffdf2827185db64f6a36e31416
SHA512 fc012cd0d484e9db7f186c1462435c64e5811bc5684669e579d98e6c63627655cba0636f75f67a552cb531c4dfe5e76e21ad401666cfe07d193e6acc4de61edf
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKjn:A3k03kHRJW
TLSH
T1A325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 957KB
SHA256 508f166b6eb120919223b7fb2342d03edb989a7fedb8a81f8ca14f3f5a2ea627
MD5 e3e6ec4e0132dc31428d05cd5ad16127
SHA1 56d938bd36b3f7332b1d71a1cf3ae45872590291
SHA512 c974eefcbcda8a7eaacd88c446dfe37d8483e146dfac5e6eac949288087a3e358a10f6bffe10c76e4844a2ba4614bf6581d6d92c03c835eab76c694290ccc433
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcK/x:A3k03kHRJM
TLSH
T12B25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 957KB
SHA256 8b51e3f4f0885a4859ecbbfdedf4a070ef2d9fa239a68b53dc40e209f495754b
MD5 3896a65308012e033aca738e5ba86da3
SHA1 ed2496a257ecbe1c92acebf0a72aa4397c76a8ae
SHA512 ad70c1435f231ebdd44478189ea7861005bec41baf86410d6e37b94787c133bfe2829da9f7644802de22b15edf1dbc88caea91892f162d7935b8b1d2edc0238f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKlA:A3k03kHRJX
TLSH
T19025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 957KB
SHA256 904efdc499fa2528bdfade6933da3596daf7093f8948f2eef2b055eebe66bb05
MD5 b5dbbb484069e5fcf8d7fb3e75e0dfec
SHA1 593357a9af6f2ef5c7d0b43bb204d94765637b00
SHA512 78da7899c86aadcc36fa0cff4016bf9c3e388980f6d2d8c4ca6f4874912aa1fc145fc1f7ce87e1c686decba3b762fc9f1dcbbe9c4305c6db4dbbf0c4afd2adff
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKe9Q:A3k03kHRJa
TLSH
T1A225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 957KB
SHA256 e102a9b7a23ef428514b45e864357341498aebc4e7f578179c0ef4e7a7be870a
MD5 fddee86d7a63072afbb0b15f8a706539
SHA1 0b0a91ba123c7083ba7acaec8ad2249e9bc6a308
SHA512 6808af2637ce8d11809ce9ca9a535b1db983999f9d7be3947106090cd1817b0962d331919768e57babbba8a0f3cf55d2b4abb1a37cfe576c2c13ebd842208a37
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKL4:A3k03kHRJ5
TLSH
T1DC25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 957KB
SHA256 c3343ebcd7fe18f7e067167289ee477a4b3b5c9054a37726caf66d0c790ed12a
MD5 8345a98d96638750c5d379c2d4eb71a2
SHA1 eb03794fbb6be12b873aa4e1139929a6fd3dc482
SHA512 242a0b695790bae4ad9ac58b0cf07b909b84e4f3944b1e1e1bab61baccd8ebc97826d4bdba3359818a0b28053c3792868fd2b0564937e0bfe29414a96a60b052
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKCu:A3k03kHRJE
TLSH
T1EB25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 957KB
SHA256 d6bf1a755d7a237dff6ad82c5591da3514f82ac9b4948aafc5025cd7a921d66c
MD5 434fd85d492c61484e0d5b4a5f9b2175
SHA1 f3d72f858dbe8ba35ce5ae34a74fe745035a2fb6
SHA512 dd67c473edd173db7ac14778d2ff4b9f8497326bef810497dee713360eb72ddc2fd2280859dd4ed4cc805983d72705b9f2004154c40226ddba8637fed13d7abc
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKTj:A3k03kHRJG
TLSH
T15525AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 957KB
SHA256 ef849df50a6ff353944074d51fa1c3772142c4ccbf2a173201b1af2dabe67ee1
MD5 b0b6d4134d0db0b206fea9d1b3a12291
SHA1 3907eb58d354eb22d7cdbde0aa7412108642cf65
SHA512 c2996563f16f3e2d344c45823089ec7bae619d287a4e5f3d127ca493e639e3aa9a2030a11ffae269b1e738bd3b380f4c23403a2f483abcff5998f4d526f6915b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKeg:A3k03kHRJq
TLSH
T1B325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 957KB
SHA256 24b418aae9a4881e4dd9a2450b9b370fd9e0f9e447abaa49ef013761195dd46f
MD5 f3bc332d447706a14b6deb88085119f4
SHA1 2ddee50b79729a34cdb883b785d68fa975b6cdfb
SHA512 c101ef2ccbfee3b9cd69b6d59587a4445de2020899a060a157f1feb72cf455dd29f5096a34567ac158cd6e6b3b700eca137da8fe324bd95bfa438940a86e64c1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKRI:A3k03kHRJL
TLSH
T11725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 957KB
SHA256 29fa552ac4827022b181b829d75596fc0d3ce0ebd0efb104a48edd7d7ef7de0f
MD5 1472ea73e8af08fc06affbc378c0fbb2
SHA1 71665efe716dc6310003afba4bb9efec37641e43
SHA512 9134ac63b3881f6f16c23229def9c70956007baa2623630a8c09fb898ad72063828c10685c8b5678e68f49e0600dd687e62f9c666e99d0e19a404b4622f8201c
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKTo:A3k03kHRJV
TLSH
T11925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 957KB
SHA256 dd1b7b0d8e64eb25a5a17cba7b5ed8c57679f208da35cc19e13e92ceef25981f
MD5 a8e65fd7b17cd77df3a412fb554f240f
SHA1 3da42cfc535bebfceea157cd547da2be5a8b1d53
SHA512 28006544b18247ee1361d121dd6dce52ea2cfbcd4eb4f4cab66790173d07dfd42e9d603ec5c21007f70f4396290c501eb3c02a5385b5027eeb4a3d3718c9eec3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKY+:A3k03kHRJw
TLSH
T10825AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 957KB
SHA256 f8004238e503a1ba87cb35db772bcefb62e83a977af710a27c88aca2619ed0c9
MD5 15d8cf6f57a5a1a58628995008fd9f49
SHA1 daf1f292093db8f7bf9cfefa61c017834682dff5
SHA512 d10771c9dd6b4a7a900f056b3585a9fcd4c00fe165018a75b6310b56708831c8038bb0e4cbec980f9247a3876610d36d7ce4ba1f5126a4007dfa9f0be5d823b1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKwQ:A3k03kHRJA
TLSH
T1E725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 957KB
SHA256 084f56e11cc13a6fa5b5cb889d2368de83f8921582b6c1b5fc9e7764a8900deb
MD5 e11d4bdb618196b63160892087e0b099
SHA1 2b86c30a0cd06ed3f417cd4526a36d3d08f575a6
SHA512 3b95aa7f4b1efae05658b0434b248bb16a1425e6bc6127674abcf664a00cce7cfc4119c2983cb1dd4d976605c88dbb4f42b3f22385756aaeb4ead204c4f663ab
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKZX:A3k03kHRJw
TLSH
T18625AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 957KB
SHA256 badba14185860370ea940e87e9d6318c557a743fae35f335321f1353a7b461dd
MD5 73dc2b258ff7037f20a136120058f16f
SHA1 12d97a987aa9aecbdbd05dc1287a7dc4e532948c
SHA512 38425ee260789b989614ebd8f5810c8eaa34056ac9bed4e3341189223c4890528155a6810030deaae56ba60a037417ec69c0d02062fd9dfd642f5e6447aa034b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKzL:A3k03kHRJS
TLSH
T1AC25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 957KB
SHA256 36408dcc16c7e535c40f3f4ca1bd24e0ba53d6ac7fcc265837469dfa57293030
MD5 31c7c31e5aa2cc620e624869535430cd
SHA1 bf280f8c935f8b9a808997c9555016b03ecf239a
SHA512 a660a7a9b5ec386dea50a49b82291a0e733eb83d14efa24b4fbe1f65a84aeaea14c0ccdfdf4a62a77a148550a2e43bf093b243dab37cb045c6521e4f8554ff40
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKZM:A3k03kHRJ/
TLSH
T12D25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 957KB
SHA256 9eb4254231967f1eadba86c51e819746b1f073cc7f343d0a842939846f4a167a
MD5 52abe1c724c9c9c5d90eafd069d2a17a
SHA1 93504cd5fd35d2dff22655cb2d89fc1d162743e2
SHA512 e4be10623677174f29375786c12f379e30ba70f56c34c2f1ef4ce1269370986a5422be1a50f428bd63fd057e7f81efa23b5d7e46cfe5a0ef6f4ed95e5aca0af8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCyoUcKih:A3k03kHRJx
TLSH
T15025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1356-179-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3912-166-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/3912-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads