c3f970dce7c2f6d24efba48cbcb8c4da5ca04401b1122ebb215232c3510dd437

Analysis

max time kernel
99s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_32925644c4efceb4b6d8491c350b8d97_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Size 948KB
Sample260730-hs2fgsde27
SHA256 c3f970dce7c2f6d24efba48cbcb8c4da5ca04401b1122ebb215232c3510dd437
MD5 32925644c4efceb4b6d8491c350b8d97
SHA1 8981ecec491194d1eb4955a28470f3b848638538
SHA512 06c5711cf29bc44de6c411fb5ca78903f4a9f5893a7e3118a9f5abd5685da3f1dab063607a68554ac4301b48e7b8ddfab35c0061c847ef45b2ae7485004708ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPc:A3k03kHRJv
TLSH
T1D625AF13EB9504E9E10AC1749AD68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 43 IoCs

resource	yara_rule
behavioral2/memory/1512-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b871-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b313-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1512-21-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001b318-40.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/6052-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000400000001985c-222.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-441.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-497.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0013000000018a6e-588.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-625.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-710.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-741.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f5-790.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f6-821.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f7-865.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f8-885.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-892.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-905.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fc-930.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fd-949.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fe-1004.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ff-1047.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019900-1078.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019901-1128.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-1148.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019903-1173.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019904-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019906-1319.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019907-1338.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019908-1363.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019909-1370.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990a-1383.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990b-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990c-1393.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990d-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990e-1395.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001990f-1396.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019910-1397.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019915-1398.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019916-1399.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019917-1400.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 40 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000500000001b871-5.dat	aspack_v212_v242
behavioral2/files/0x000200000001b313-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001b318-40.dat	aspack_v212_v242
behavioral2/files/0x000400000001985c-222.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-441.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-497.dat	aspack_v212_v242
behavioral2/files/0x0013000000018a6e-588.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-625.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-710.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-741.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f5-790.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f6-821.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f7-865.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f8-885.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-892.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-905.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fc-930.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fd-949.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fe-1004.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ff-1047.dat	aspack_v212_v242
behavioral2/files/0x0003000000019900-1078.dat	aspack_v212_v242
behavioral2/files/0x0003000000019901-1128.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-1148.dat	aspack_v212_v242
behavioral2/files/0x0003000000019903-1173.dat	aspack_v212_v242
behavioral2/files/0x0003000000019904-1180.dat	aspack_v212_v242
behavioral2/files/0x0003000000019906-1319.dat	aspack_v212_v242
behavioral2/files/0x0003000000019907-1338.dat	aspack_v212_v242
behavioral2/files/0x0003000000019908-1363.dat	aspack_v212_v242
behavioral2/files/0x0003000000019909-1370.dat	aspack_v212_v242
behavioral2/files/0x000300000001990a-1383.dat	aspack_v212_v242
behavioral2/files/0x000300000001990b-1392.dat	aspack_v212_v242
behavioral2/files/0x000300000001990c-1393.dat	aspack_v212_v242
behavioral2/files/0x000300000001990d-1394.dat	aspack_v212_v242
behavioral2/files/0x000300000001990e-1395.dat	aspack_v212_v242
behavioral2/files/0x000300000001990f-1396.dat	aspack_v212_v242
behavioral2/files/0x0003000000019910-1397.dat	aspack_v212_v242
behavioral2/files/0x0003000000019915-1398.dat	aspack_v212_v242
behavioral2/files/0x0003000000019916-1399.dat	aspack_v212_v242
behavioral2/files/0x0003000000019917-1400.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6052	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-30_32925644c4efceb4b6d8491c350b8d97_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_32925644c4efceb4b6d8491c350b8d97_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-30_32925644c4efceb4b6d8491c350b8d97_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-30_32925644c4efceb4b6d8491c350b8d97_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-30_32925644c4efceb4b6d8491c350b8d97_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\orbd.exe	patcher.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_32925644c4efceb4b6d8491c350b8d97_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-30_32925644c4efceb4b6d8491c350b8d97_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1512	2026-07-30_32925644c4efceb4b6d8491c350b8d97_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
6052	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-30_32925644c4efceb4b6d8491c350b8d97_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_32925644c4efceb4b6d8491c350b8d97_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1512

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 948KB
SHA256 c3f970dce7c2f6d24efba48cbcb8c4da5ca04401b1122ebb215232c3510dd437
MD5 32925644c4efceb4b6d8491c350b8d97
SHA1 8981ecec491194d1eb4955a28470f3b848638538
SHA512 06c5711cf29bc44de6c411fb5ca78903f4a9f5893a7e3118a9f5abd5685da3f1dab063607a68554ac4301b48e7b8ddfab35c0061c847ef45b2ae7485004708ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPc:A3k03kHRJv
TLSH
T1D625AF13EB9504E9E10AC1749AD68A23FB757C56176093DF2368C2152F62BD07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.5MB
SHA256 6a3bf19aeb4b68dd6dc5d6f18ab96fc9577b17ff4a9658123f6a939cd5635b25
MD5 fac28aaca1fe3ec08487372d3c6a6cbe
SHA1 9b841d01afa8257bd156393a804ca216157f9716
SHA512 44d2a942197eca9f862c64e80376cb150c702da89c402d3bed69b417831c84b6710167eb0225c86a3dbf578c78abbea85715e24b341bd9d3c361c77a711df17a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPk0Le5ji0hmxNrM:A3k03kHRJbPji0Aj
TLSH
T12D658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 963KB
SHA256 99386b193c1ba5655571aa0b42d00bd29e967cdd959b2f9b6a86e7dd2bb0f5ea
MD5 fefb5af4a5f29ec6b9e929115d80de26
SHA1 772a3ed3acb3663d54be280a63b30ee9a3b45b07
SHA512 3b089b0eb978a79dbee5c9c7a1865f5f1574d942df8ae8ec8f0c8ae708173ee9b9c14f3306f370571a07cbd2eb0d84ea4c16d938db12164c9e245115079297b4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPOa:A3k03kHRJ
TLSH
T1C525AF13EB9504E9E10AC1749AD65A23EB757C56176093DF2368C2152F72BC0BF3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 972KB
SHA256 adbdb1da1d2f03d8d7adfc7ad49110f88cbe4fbf88885ddfcb1f8b54507c7f2b
MD5 da03a0c444c09e7766c046f6264aecb4
SHA1 1794e49761726d5df3a5b7a04bdbd8426ee880bf
SHA512 a3688a12c9a5a3cb420f03b905e5b6970b629ca97c88ccdef925a0ee1d65e551cb0f150eb88b04a4c66d366f153c46f8f980c81ad6805b2ebfe20bebcc9b8d70
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPv6:A3k03kHRJj
TLSH
T16F25AE13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 972KB
SHA256 a9bc97ddaa3cd73c1d23e4557d99004e51eb190469d4c40198fc99a9de1e5dc8
MD5 6680ceb76e4417f424efe27deeba7daa
SHA1 859d1e8bdd284e61862654dcab3cbeced944b7b8
SHA512 e41e432e03e5ce77edf0f3fc1059757f7c5e5b0f8adce80b7f3f1d17fcafc13df3c524de0aaa5620a2808385b9c0c9291828edca271f3456394e8bc4b3b06e80
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPxN:A3k03kHRJe
TLSH
T13125AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 972KB
SHA256 7988c2759d827a99051a5084f997bdb442bcca9d44c8160aa656c77090da9759
MD5 c99f5d2e3ac29edfcbf75b1b6635b6d6
SHA1 db1570721594fceefb35fc5e51f754c0eac01ca3
SHA512 248011b2d51507c0f667da071649475a040b67ab9be12bc56d2f04de27e855161f0b921aca4fa5df683e38100ca5b500195422d9fe271f5a9d3c28960c0c24f7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPnf:A3k03kHRJy
TLSH
T11A25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 972KB
SHA256 9fd8fec0305edc6a69eadaab9bfeb516adb0cd8bfbb21fabd1788bd364a94760
MD5 0205f474d5dd01eb040ceaee0805777a
SHA1 e495f97a693e0bb21fe2c6375b60ad4532a77e76
SHA512 b9bd6df4e4a3694b8bdf3e83b2e32742a4522fd576c94e13056cc0ac1145accade0612790df1bf1a221bf5c3ac7a0b653e238fee6e79e54a4ab97253aecbf690
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPpo:A3k03kHRJ7
TLSH
T12625AF13EB9504E9E10AC174AAD54A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 972KB
SHA256 0404881519950d6fbac999d07339604f397888903992d9b3e31660e7a53e4da9
MD5 f9906d7c009bf3f0aa74c7e2ad5dddfb
SHA1 30c0e715260a0cbfd105ae9bb96f9c8ced362174
SHA512 aa62a3d585c7bde7fdb113c2bba426f1a17d06bc4c231ba5afed3e6890e2eb3cc4c9bdb29f1557a2d3f1fcbbd0d81a1b6805a069064d4b709795687f47108199
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPZu:A3k03kHRJ9
TLSH
T1D725AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 972KB
SHA256 59dfeb0b5428c9de8cd2fe1ff77c8c2b6ceec1e4e4acc6245fd66c3ee661c11f
MD5 16a0ad52d7bbc4b7ff0a4d18c6855de8
SHA1 6b0f01d54a6bb2388a74ea9a731acd6e997fe1c8
SHA512 2104b3637e96de152a5ce98ed59071f49c116434f1022d89bfcf6f17599afe4945ea6b5e738e1865bc8705c01b7c2d06d37497a35372e6eb958f1f510dedfbe1
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQP/9:A3k03kHRJI
TLSH
T12225AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 972KB
SHA256 898d88adbedda008bc7f657451fe48bc8425c70367905b5922b98a58fb68e1ed
MD5 a05fae8b48901ce1e7d0833892bb2063
SHA1 99e7134265f33994f05a0dd38ae481bf700f2e05
SHA512 9b7d5831cb64e53889bc82870ac940a255c0c6c02379e1a60df1d77a09f36ef064fc7145a1ad38a13f7e74c384249c91a6df04cf416b273d145b69f3b2d96494
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPbc:A3k03kHRJJ
TLSH
T12B25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 972KB
SHA256 1c1cf8c93a52e8a32e09ee32ace6fe3f7d43e94eedc6eb9b213a0ac959467b99
MD5 2b178924c5753c005745d96c0f29a0cb
SHA1 3242fef9926aed301ac2daf15187b59ac7229935
SHA512 615dd3bfc00bb7f1b56c242271e05bf456edc12716356d77bb0998c845698a274a6bbd5dddf923971f1f6d32ecf00d5a83eabe722064e191bf730c62a9e62fc2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPEp:A3k03kHRJn
TLSH
T11C25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 972KB
SHA256 ee0e93bb52acf9f6f9d8e1b405f4260aab97ff09b2ccf3e82e4e856fcc5831b8
MD5 369999128a161a614841f17db37d241d
SHA1 1807870ae56a21d3a8683893df75720ce47e0626
SHA512 8819ba2594403869cbb0facf03711707d8c8e11b446a8705bc1ffecadfecba211a09a25c7afe5547671cc47e10ebd5fdc07d6c9198122f2db071026435db96e4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPLN:A3k03kHRJs
TLSH
T10D25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 972KB
SHA256 bf2a4ce0a03ea844e6567b08831ad3b3381fc19566ef9b8bc59124054b156606
MD5 31ee3429ee9c91b5aeb8e1bb3db341a9
SHA1 f01d9f60f11c4adad657932a950768d7e80c1a27
SHA512 cf0a64947fa9ae8be836a61edddfd47bc6683abbc92335b39c566bed883dc33ff929c99e213654cb57f0347473564145d27662a66c9a8f449292145052da6c2d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPZF:A3k03kHRJ6
TLSH
T19725AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 972KB
SHA256 8437085e074d6ef737229d83edd8687c2a9d7a3e6b1b3a37d8ade38401a2e711
MD5 6418622384c8235d4b14a4e47becf645
SHA1 02cf28ab6b10262f3e2e247727238efafd203f34
SHA512 c87ea14603638856768a56e06f51ddb0ee1965afa4730d1c364e058274e7b1540a08ba7f6f589df9c59fd830564882606e0f8f325fd20ebbd8406aed63bc5c10
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPyC:A3k03kHRJO
TLSH
T15925AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 972KB
SHA256 71dc9ac8f2dbf1e8b1d2ea5e254cfbfb5ff97d468a1834337d9f4ff42b467527
MD5 02b3f39a405b11b9244c40b5d287e1fd
SHA1 3402a2bb6980fe6fe6f480f0bd56971c9e6d145b
SHA512 bafb75da58cefa21fd4197834896bc6eb6d31986737a682c0e5467645be55c530b9417d04715c2fa8e6c56678d3bb02bd2158bbe320c9d6cb7a2534696d7c0ad
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPtw:A3k03kHRJb
TLSH
T12B25AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 972KB
SHA256 b80c82c3256bef18857b9382df3126b7be44254f10bc54b475cd536858bddccc
MD5 4dd8738f4393c92229f87640912261d9
SHA1 70fb653b43f57550778552aa2947f210b09bc505
SHA512 94ef04cc8b46d34a9bd992664b3702fc498e6e65331ecfe289042916edf92e059a2caf8f487995ffea8f5e76c8dc1afbb245888e2f030d01ba2f2665eb462c9d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPcT:A3k03kHRJH
TLSH
T1B425AE13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 972KB
SHA256 ec6638b60d9ac3018f79323dd74cfa2e93f901f99b2ee26232abed54a022804b
MD5 cf9929b0ed086aa85eb952975a5af104
SHA1 9fa678aa3f36feb634451da9b447dc07a69be7b5
SHA512 39fc96f5e67e67fefaf48f3a1a3c71192ffe3f671413629b4b55e214798ff22518cb5550292824551e27b54794dab9c0df35a57c53f273745abc0fe8047bd7b6
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPwu:A3k03kHRJI
TLSH
T19425AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 972KB
SHA256 cd87d27e9b895797e79c33b20591d0ac75f569d1d36c81f26f078f0d94def702
MD5 1016882883652a71d0098dfdf8ac36ff
SHA1 d5ac5c407c16bc2dcb9a17830cbbb3b69a00015d
SHA512 1cdf78955c6839b4ed21c738e0095f4ba9c6b745b151e70e305e553d519904e052159e6b22fbad819621898c2b91774ae350afdae2d4b37142020aa23a341af0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPOb:A3k03kHRJx
TLSH
T17B25AE13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 972KB
SHA256 f9f3d0e9e91a68685fe4b60a3d4e19d9d2bbadfa2b9c5ea5401fc1f752dd31fa
MD5 64b55d41468571d156fea36f1115b3f4
SHA1 0b84916a2ed6e17ec8043f9401efd6b56647b8c0
SHA512 9d2c71addcac5af21a355151346e117f5bfef531f2327ada09ca4bc954acfb059c5368818b14c4a2d21a674e87eab48dc764eeaadf717a69c10b2713554eed41
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQP4f:A3k03kHRJx
TLSH
T11925AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 972KB
SHA256 f3d07788c77c74a49d2dc3326c0f4178ff8bd0586b0e4b83ce0fc13680a79728
MD5 e73feac0f2623ae83513aded4995aea3
SHA1 f648e5ac5f285e3c4275c1323bae8d4aca655e1d
SHA512 999788adefbb3808358f45a6896c8f668a574bd09d8b1629f68bcc538046d4cf7e22fbdf6963dc4d2ff11d39af2fbd685ccfe4b3a1dfb0a2d18c0c87af2cf206
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQP1K:A3k03kHRJJ
TLSH
T10625AE13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 972KB
SHA256 184bf5765c62aef160dc888839a6118456d44f454daefc5c76e888d79bfb5498
MD5 ad7fa34724e4fda2cf440fd906c055e2
SHA1 cf600495e7837175d50881f7e1246e98e9f55bb0
SHA512 d8c37fc7d98bcd26c3467cfb1aaeef50be5d7706efb5f32eeed443485d699946c483e5b7e1c6aa05aa0c87bf9071d7211b78feadbea8aa7df83a62a2092060d2
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQP2k:A3k03kHRJA
TLSH
T18E25AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 972KB
SHA256 5d7e1713684fc1727e0a7c2b41fc34c61b536c87eba6c879caab657b5d254abe
MD5 83a57bd16bf2bb7f28aeba60f0fc2469
SHA1 781e4cdce7643e05eb3a9a610de23ed9f9e084fd
SHA512 4844171d19a776a08972ba683d3353f469cff7d9b753c23b14b988c5cadbcb4314bd23f76fa64be6064b99d472b0ff01f2e0baed5f8a1dc87e6dec2eae46e012
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPT0:A3k03kHRJJ
TLSH
T1FB25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 972KB
SHA256 3c2c8af1756013e3702950aa479cf1960f6e0b04477fc45a9f467c82d0dba934
MD5 ea9af5a0ed897fce421418692476e0f3
SHA1 7d9fcbba57a936594dd7fc156d4c03a3fd85e34b
SHA512 7ee72d804054385c2ad59337a9c82f2a3586a81baa1586c6b498bd90db396e5950541bb5ef7487d2154094c0b4e05fc14f786f6dba03490d15ec384d7c0783f3
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPig:A3k03kHRJY
TLSH
T15A25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 972KB
SHA256 0848d757e4c75205df1beb6ed5fbe9e3c6cdfcc042d76cfc8f03cfa8912f2be9
MD5 92e525e0b6f4b466c317da9d8aa5bc6c
SHA1 e5646bc9d1b411ed5709405aef387e12e7c1d261
SHA512 d3629f20eed0e52cd4f6ba7171fbf93246f7ede57cd09241f8c6c6917cea27588cc87a414601f4c6e8661760c945eaf726fd7ac8f61979b2acd8bd6a74d6e7ba
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPDr:A3k03kHRJC
TLSH
T14525AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 972KB
SHA256 fba3e693f85b3b852b5c558688e663d4c126af2b0bbd31f9b5d47dc724771aa2
MD5 3a45a35397d9a192cdf3884104f137f4
SHA1 67dd4c400d383c80130b3a54cb6a65b7db62b331
SHA512 5c1daf7f97dbe9d5ddb7b23477354b2236c147b26de739e10005015b37de00a96d92476c0ca05fb55f633268cb3b96365e314dbfe80a6e48df19a18de0799f8a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPln:A3k03kHRJU
TLSH
T1F625AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 972KB
SHA256 157eeb6a39cd3233896266fb6cc6cc90e50aed63e228e47b74944ea191374c20
MD5 b90fd403557414d17d1764565444487f
SHA1 a913647fed27aa767c7c945493bcbb2d20b73173
SHA512 11fbcceccc5307ce5039241ed3e7aec272b74a91763fd4f0c2bd4459433ff7acc301d20a20ee5ccda9ee5a0fd6103d105f06f7cba8a48038aac9a7bbed9f1f8b
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPRx:A3k03kHRJS
TLSH
T1C725AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 972KB
SHA256 1b5bad3b387e23c5c51868200edd604f7cd863e60b21e36698f37326e4f479eb
MD5 8d8794eb06d19a73eedcd1f5b2c00337
SHA1 d17583b842c457d0884ef35bcffca05c8be82071
SHA512 54c854a191eeb26d25014f186048bb1eb343ad5916fb9c42213f5e679753be718715555ae86d806a484978eb2e9802d634ea2d9ca2812f3c37ea3866de0c4931
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQP/A:A3k03kHRJx
TLSH
T18125AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 972KB
SHA256 280b6e5a77491483b57285a5a81db2575ccf8c6b7107983b03d120b628ef119c
MD5 b59958b3a98f6e903a19b178975c3ae6
SHA1 249ba6385cc7242a8172e35c5364f17f674b7e10
SHA512 b21bf4674f7a658de81bce09c096ce3aef2119e9377315024b0bb5c9bb03559ea4234e60ec6752eae7fc3b003f1259d6f23477ebbc319653f5f02283615ebfb4
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPQ9Q:A3k03kHRJI
TLSH
T14725AE13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 972KB
SHA256 7763a4d3124cf2d064e751d7cf4d748805d67543da8e3a9938e480391514fb56
MD5 a1737246650439cbaca4018227289792
SHA1 dd475d39fff9c8e65362e4dc6c7fa9d9fd1a3407
SHA512 e1e19b339d319ec5f3410fa25baf9854cb4f35f126f7a862214bb7190d68d28c581dd6a1b5882fc99ba525be4ac9cd1b173f37c67ac8bd6ab0892e64f22f1127
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPx4:A3k03kHRJz
TLSH
T1B425AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 972KB
SHA256 9e99905ac6871a553a7caebf05f54eea8bb5ef2653ab3c49fa875a24d1c2e14b
MD5 a34142b9eb3e1924fcafeed12bc84d59
SHA1 89949ba42a63aca6d45e2c58a464ef2e816fe730
SHA512 d57e78ddf1c60cece0164755ea0d26ba6c1aac84859b2cd6de07e69172e1069298016c73d4f4a80aebd97d059d4344c2761a324c9689e11ee66b7bee4f92c66a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQP0u:A3k03kHRJW
TLSH
T14E25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 972KB
SHA256 eecfc36f35055ebc0c2c47d5dbddc2a6a6a277b164c3166fc47ec72b8e2ed4be
MD5 49bc48e5a8540a700f0cd01ddd637805
SHA1 55a3b45981ce4531afe9af0d2cac962b67861792
SHA512 6844b28176b66d3ca03d8d9794323b1812bd8789bc4cba0b5ae6770476ecae2ee33e3fa6cfe8adc4ee60775b3f7294926230e1f23e823fe87e5a52e8a832335d
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPFj:A3k03kHRJo
TLSH
T1CA25AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 972KB
SHA256 eb93db8e3e83524dd40ca4b4438686af02038af57431dd205ec4a203c25f842a
MD5 a960de238260bc89b541689933e716de
SHA1 30aece322fff4360de06bd3ef0ed33dd0a604a65
SHA512 9f5638707ef9ceef989d6d3990170ebcda7c8a2c783a572c43a880c1bd37f89695d48fecb2a7266aad7917d32e2900469be5012bc3bf1f708c7c318fbff140d0
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPMg:A3k03kHRJw
TLSH
T1D725AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 972KB
SHA256 dad4432dce20a97542b0a8ded0bae206622523c963e8f5a215aed6d7b4e15750
MD5 e71a15b1438e669263be70a04cae97dc
SHA1 4830e43b43c20b37227b6c42991540b067be2265
SHA512 dc8eb58eb1493e3fd49ea878b8d5eb14fc0c7df8df8e67729b5aff3dde1992cc1b39669d5b2926c13e045b31fa64eb7bbfc7dc05600346f7db9a8669ba2667c7
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPTI:A3k03kHRJR
TLSH
T1F025AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 972KB
SHA256 8b41c0c38fd820a3f82832bce0917bed2e0d04f76a1966fc9a9e786dc489a6fc
MD5 9fb7bcabd854890b749ae69eaa2cb4e6
SHA1 1481c4850e67555c70d55a20e614af1e3d40214e
SHA512 764892eb6f7079160d639dc57bf5f552ad13d471ff3037a288e8003a1bb9af2752e3fed939a347bd8c063cfb08e780d9e82ca719d01b46e853e00db508f10c2f
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPpo:A3k03kHRJv
TLSH
T10A25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 972KB
SHA256 e73e84e9a6543c93a3e1c986b5ed49249d391065a600bff27eaf52748854b528
MD5 7eaf91cf157345abd3c906196dd899cc
SHA1 c2cbed97c9a9e5a0b5e9e87d50e34949bc2e82b7
SHA512 e99967fc857f46cb8c4d55ca9e07b35a808e8e5543ac13797ab79870bea04d0f73ac2b94e236a5aeb4f12300c875d4035591270447e7145340256c3c69e4b98e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPa+:A3k03kHRJa
TLSH
T12B25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 972KB
SHA256 7337a415e4f6ae7fa0b2fc3b3d510af33ecb1a08ad249882dd3e531196f75eec
MD5 326e8b26649da748c0190ab9eac42a19
SHA1 7aac72074213ddeae13e6db891c0b0ab66a29edb
SHA512 adca6f0cba56c2732324fefd4f5d61424f99fa4896d116ad1fade0b2fa86092beb1be0f58594f55379d74d18cf6d1526297c7438c2182bef6ab9772e1cc7b1d8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPaQ:A3k03kHRJe
TLSH
T1DE25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 972KB
SHA256 3f53199b986a5aa34bd840678841fc74c6a801719c07248d642d132dbda4ba22
MD5 7c6d2d48635f075ab0f3e12dad71d67d
SHA1 b9d9e23e9651a84b2e3d4fd7e7c135f7539808b1
SHA512 af61fd751ff96c8e98a0163cf6ddacbeaacd2106cf74be1e6df62024f63c8400e2e2dfc4a0998ea58b7b47f999dad5ece525574f65405d59c8f00842a4db8dcd
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPrX:A3k03kHRJ+
TLSH
T17525AE13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 972KB
SHA256 43a9d4012ddb4a38750699d99fceea7c04d1de4b1727cab5a6356c80ee29529f
MD5 a97f606b073a9a144037319d291e4b40
SHA1 5d6d125de74cc1b51ae92ee336e1031133d637b3
SHA512 f6bb7d0c42bcc68cf54fea768a2012c5db0cc77f88f3b4de12f2c96fcc4fe92a5e72b316977021927fcc496b03d5269c3f080f33495d77bebc8e8adb350e47ed
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQP5L:A3k03kHRJQ
TLSH
T11325AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 972KB
SHA256 b59ba8af04b90984826f1bb287239a4f8fea0abb906d7be74103f88fa08c5ec1
MD5 a283a07a601782113ed1cbaa57a6a153
SHA1 516b2d5d9b05234b4194e04c68f28ffdc9c97c86
SHA512 9f382c86e2d673f01d32b5aceef051b6b9a0d10451fd3d83eb107b8092d1f2d0421310e4f571ee4015d7c0dcf182f4da676bbd179880ad185ff1308000112295
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPnM:A3k03kHRJB
TLSH
T1DA25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 972KB
SHA256 831207b75ccedd0585987b9da05baf39de8eefc59189ed1e13a36d27f3ca9938
MD5 2e07cf981c58069fd9a2e12405dee98d
SHA1 0fe563707a173c9f20557f6c1a2b393f1a7dc4b2
SHA512 03b982f1591381212ce9b42e830f8b636e66e870aaf6f0c8bfefb1f57b7d8fc705340ea2835153214553558015026414d38792ad59e353769eed3c45e960d555
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKerEjQPQh:A3k03kHRJT
TLSH
T13225AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1512-21-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1512-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6052-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads