Analysis
- max time kernel
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/08/2026, 13:20
Behavioral task
behavioral1
Sample
2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 948KB
- Sample260813-qlgfqsbc26
- SHA256 3d67c82766af2ccaba4c1ea83a826220c1e2d4fef2c0bed650c4c1962125a1d3
- MD5 42207ce18b221b85726ccf94888d7815
- SHA1 b7ccd9003cb0922dac9abcc5765faa246f4aad86
- SHA512 4bd740edb1b575b818c8945174834053d32bc28cf917878cb3b14237e9d147a3b38711e8968126ed5efff742576bb32cc7cc9f79762569cb31379f1aac322c6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aF:A3k03kHRJX
- TLSH T14125AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral2/memory/908-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c44b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/908-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4956-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019849-227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-240.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-247.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000018a5b-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-288.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-301.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-320.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-430.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-511.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-609.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-683.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-757.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-814.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-864.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-883.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-941.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-966.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-992.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1024.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1067.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1098.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1129.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1154.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1194.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1238.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1341.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c44b-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x0004000000019849-227.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-240.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-247.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-248.dat aspack_v212_v242 behavioral2/files/0x0015000000018a5b-261.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-288.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-301.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-320.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-339.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-430.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-491.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-511.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-609.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-634.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-683.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-744.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-757.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-800.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-814.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-864.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-883.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-909.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-941.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-966.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-992.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1024.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1067.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1098.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1129.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1154.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1179.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1194.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1201.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1238.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1341.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4956 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 908 2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4956 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_42207ce18b221b85726ccf94888d7815_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:908
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 948KB
- SHA256 3d67c82766af2ccaba4c1ea83a826220c1e2d4fef2c0bed650c4c1962125a1d3
- MD5 42207ce18b221b85726ccf94888d7815
- SHA1 b7ccd9003cb0922dac9abcc5765faa246f4aad86
- SHA512 4bd740edb1b575b818c8945174834053d32bc28cf917878cb3b14237e9d147a3b38711e8968126ed5efff742576bb32cc7cc9f79762569cb31379f1aac322c6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aF:A3k03kHRJX
- TLSH T14125AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 5266eaca0fba2623948984dc67091e355bb479af5e80457413043df4521e6a39
- MD5 0b4b62e25a6edd9645e7d88fd96f76e6
- SHA1 f1f03300a482a4ce327d28bb837475d3907c0113
- SHA512 5b66cdebc69098e4c432f0723edf8d6c37b6a99ec0bf2c3dfa3ab7491e1750897b173632c24925628cd691490fd058509690f45967e2e2403435a9cb52ceda30
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aB0Le5ji0hmxNrM:A3k03kHRJTPji0Aj
- TLSH T1DC658C17F6A402B5D027C1B9C5D69A6AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 972KB
- SHA256 dc9aa690f18b6aca5c93c6def57c5169e411c4ae429975c9f44b59815036a130
- MD5 6ccc82d7e900827ba35484aa0772f358
- SHA1 e9eceb6a88edc92689f9011bd06747723ded7661
- SHA512 f6780565fc39c68b46c01c0b44f2564f4260babd77782b94c2ee589c5cd5b6f3f335e50474b0c77d5292acf2e73d583909ce988f2551d1e173a1eb87214f99d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+ai6:A3k03kHRJ7
- TLSH T12A25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 972KB
- SHA256 620576c74cd2321d424fcf7692b996c2b2e0d382254fe9da0c31d12929ebf6ee
- MD5 4b23185757c6712ada74613e083603dc
- SHA1 178198f3f65163231d068efbcb8c8c8368979065
- SHA512 f1dd45e7439325f64df63b6a38f784c89e4b3003e48f7e8722226358095483673ad25d7bb47c23d222e791e44e3118cdf57cf12b708dc4994f32edbccd764c67
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+a6N:A3k03kHRJm
- TLSH T14525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 972KB
- SHA256 5d979ecd7ed5e042066700c49728f754b2fb347ac76ad7c0bf0a461d4f8a8b91
- MD5 58afb4e41bb44a17d357c35ee67cfa60
- SHA1 ec96f8fe8d789e4fc795cea9461468ad18a50e93
- SHA512 c872571812a03f3cda5b064d9adf506e432f3792d84abf45130f7b5488c674eb11505c0ec34a1664bf5de71c4ca522de5ec7fd153af2a7519a53f9d59b0abadf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+agf:A3k03kHRJa
- TLSH T1F625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 972KB
- SHA256 b64208509ab7e140c0b7af0a5d4ec9783d5c1440af0fdf8d4f336ac4c9d4a0ee
- MD5 323a2253793fbf17aab7a365f76910af
- SHA1 62c4c4f057c512c6303fb654a016ea0ed9c1ea81
- SHA512 78d61c6c6ce942e131cff8b9c6fed572ad3a7b321e095312b19da992beff69b897561456a4a7273ba743fe734a9554400efe68bf6156c50e0ec815104c76b3e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+a6o:A3k03kHRJj
- TLSH T18025AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 972KB
- SHA256 e7acbc9787afaae6f01911726c454c62a9465d15faeabd213154a062dea9caa1
- MD5 6b5fd547cd70886defd56ad5e509e9c8
- SHA1 490f2ae81a9a97e273142eb49e2a5535bfe4823c
- SHA512 1cbe6d3f523cc21391e0b9038b3bda0e0b13c5c7aa523257fcc6ee77aa2586f203045c2a304bdb8507caf3b674135e86ec95aeb40f1d86d40c3555476881c8fd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aOu:A3k03kHRJ1
- TLSH T1F325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 972KB
- SHA256 7495d50b41c3be90a24c550a17aa639ad5d68e4550d2b08eb5bdd1d46f9a41de
- MD5 e1b7776ba243a9b4b358e5534900a89e
- SHA1 07281ad89182f15ea0f76bf63547a82943a5bcb6
- SHA512 860f5a4ecd2c62b395137cd058897832cae8f6ff8f1c9a8a92b9b80d505d377b5af8436551993f2e5e2903951d7a4b9841e1d367deaecef4db503af1f3292bd2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aC9:A3k03kHRJA
- TLSH T11725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 972KB
- SHA256 8c96973b5e2cb91deff4828593739e9d6cff8b56eda918310df28b376585b1c2
- MD5 1826dffc05927696fedf1bfddf12af76
- SHA1 f6ab56a72571f3fa4d09ea159743f29334af7606
- SHA512 6ff8112c56453c63e661213d9d365a96e64ec57ee6bfc552fdf1734ccf48c3b639b25bbb5cda142e9a35ba9b77c1aa7c1814b96545eacee3d866ede8232fe082
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aCc:A3k03kHRJx
- TLSH T15925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 972KB
- SHA256 f90a70ce7d0efc0088e6ec8d0379304c7e284dd661f17aa1b455225600664c23
- MD5 0fb7db5ac3deba9e3dc5bbc5b66c1009
- SHA1 457d781afdda55685fd201b93e0b74c89652dd38
- SHA512 074e255a85efde716ef213081adacd462d64db9bd6a1174308b595df17015aa9e192be73109f50781de8fdfab5a59d8f86dcc08ae4364779c54696dfed81761a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aLp:A3k03kHRJP
- TLSH T1BF25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 972KB
- SHA256 d408c3d3fe9ab9fcca036701b177738fbd2b81631071d41ad252c080036170c6
- MD5 ee362bfbae41541e3eeb6e03d42218b7
- SHA1 b842ae8e1273f881c51cbbf4fec7d3d5a1cf5bd4
- SHA512 39ffeba15233eb293b8e23e5f1533677448c000e30a2bf96bdcae2eff3348b0a9c59a0319c5d50807b284773d8b697d2ad27923f769eaa444a6a1a088bdfa96d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+acN:A3k03kHRJE
- TLSH T1CC25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 972KB
- SHA256 579821f7321964c153242564a74ff02233bad2a3c0a72222e4e44a3e798869a6
- MD5 d72c7aa85f3abc3a6d6ba8a6ddd68524
- SHA1 ace83fb4f71752bc050194bfcfdee4c097380e22
- SHA512 df6cbb46a6a14346ea25fbf2d7ad4f8530f78aff40ee80fd2828a3041ba9a7e7925273433fd731ca13e1cc8d9e46d5dd2a87724115bd0ac9f2fa4628f2451a29
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aEF:A3k03kHRJy
- TLSH T16825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 972KB
- SHA256 ac07e59ca901cc3ac5d36c7cce20d6f27bbb478856fb961fc62a76d9cbc0dcf7
- MD5 8a0a737efa83df6c98aa37bcd4ae9564
- SHA1 f6ffca4ea2f1b3a201a7f61b90950b62ea57b3bf
- SHA512 847d95ccc87da415139726a0bab5dac66a34552f6c82da17d0e0ca8feeb6bafce648c2f50ea292b86aa48d62652fa107ae237f9bd773dd067f791b70f483f7a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+ahC:A3k03kHRJG
- TLSH T10C25AE13EB9504E9E10AC174AAD64A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 972KB
- SHA256 db9079fdf555faf9273761b6409d5865426b47059c6130b12682d2c7488e311b
- MD5 6d248c02799952597a251ac81adde49b
- SHA1 5a513e86d1683761249617ba5150d341b348b42b
- SHA512 3a0d93f45e1809453ceeac259196739720b506e4cbfb72254e9022619e6efe1228d4f6e43c4062e3a735808b03ad0df08ce33ef973932a3e81980f2752aeedb0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aiw:A3k03kHRJz
- TLSH T15F25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 972KB
- SHA256 416c2faf5bd114358a8bf505cd44a9d197dc8a9e51cc973b56ce3590989ba744
- MD5 01553e53fd9ae805e126be8540c8fe08
- SHA1 a66a78a4a0e6b2b2794bd224347835a16f8e2b47
- SHA512 bb0c811bfc818c6279b6cdf31f05e8f35cdba449ff4a07b55fbdb3ce76b7fe764ba2fb48ca9cb7e77958d46e2bfc7c932656ca1f42f569cebe80959164eb8d65
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+apT:A3k03kHRJ/
- TLSH T11225AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 972KB
- SHA256 73c8f25ada4fa86090e299898e167aa6ad94a51376c3fd0bf5830ad9634df36e
- MD5 43e1038853315cee7f0c78e77190e4d6
- SHA1 ac2195936f2f0c3be88663e88f0ab3ed36cd1a57
- SHA512 e6b36293a444b3f4233b0e15859bf0671a432647a3d1eedfc4dbf43dfb3d49350c1d34e219a84cd7004ec5f8ab46a19bb39d39f3a38729cf7a6107e03e3aa2dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aHu:A3k03kHRJQ
- TLSH T15525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 972KB
- SHA256 bf45bbb2abe96986fd5ec608acc292a4c4343934a6df4f3c80e88f8dfb6e25e5
- MD5 fa0a23d0155a3e31ab1e7f9d7b40bbb8
- SHA1 dba4bc0844e3b6c860719cbd039f2023069129d7
- SHA512 5dfe00f1c0e4d8243ec3342094c61c023ff63ad49c0373ecd269da37c0bd14eebdc41fd9d7e159c974d698d3aa4cc2c8b57bba727cb82615b519e0331e1de1e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+abb:A3k03kHRJJ
- TLSH T11525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 972KB
- SHA256 2066ba3ea2fea07a52d5c5c559c7c9408fbf83e92182168d1116fe183313ae8d
- MD5 ba97007944174be63e8de5703fbfacb3
- SHA1 f3fd6b2790a7b0cf817a6f2ee984331e395b8262
- SHA512 0f9b3682d7d887a0230fb72cb082463ac933764174713cabfe0000f42c7c3cb1522fd5b5b806dfde6a55cf6f929ba62c6a56dfdde81b8d687ee9d7e010f060bc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+avf:A3k03kHRJZ
- TLSH T1A225AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 972KB
- SHA256 9e89ee610aa45666e45cf97da11f74cfa7892135ed3cffd7ec52ffa28b96b81d
- MD5 b72d6fae04b4c9c15bb486b85b47a1d1
- SHA1 ed0746fcddb416804a34b4746a7cdfe675980eae
- SHA512 403cdb187043f6b0da582669b40ba1b0c00f925bea3867be4b9353ab9eec73bb73743857f8050f059b9c3362f021be8064e244d96f951b29d04d9e9c482ed6e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+a4K:A3k03kHRJx
- TLSH T19925AE13EB9504E9E10AC174AAD64A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 972KB
- SHA256 b1f9fb9c3acb2f650ac84db1f90e2bdf5c310d7543a1c983e383f62c095b722c
- MD5 afe5d7c9cafd4b81b5d2b62d9ad8ed73
- SHA1 1ef3f4778a42a0b872f1b8a87e81c236fde40752
- SHA512 71839ea64054210f20ece2c6b09698e67bdd570302b76b5b48c344a2409ed6ec39a75f86b35efd93c99736763ef58724543147ce05658dbd43e38ceb5dfd54d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+alk:A3k03kHRJY
- TLSH T1B625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 972KB
- SHA256 98bfb5f28aa27fdac59aa3f47e1c1c330fc1063416f890456ccd09c44b3aa6d0
- MD5 4d15c9918722fdd4c068a1a16cc0359b
- SHA1 c5191b2353758f3c6d293b9f4b086f3998b22819
- SHA512 30e80e372ace12542881cc058f8c6354f18498f644443fbe3c2a866f9cd277f489be0f4d327a904d9d793f7c28c91332dd98ae12a7514f8e957065637202f646
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+a60:A3k03kHRJR
- TLSH T1F425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 972KB
- SHA256 dac4e753c10b32dea124ad640d140484e161e84927bfec5aabba191a0dd4eb9c
- MD5 8732a8aaa0eccfb1b070527dd149914b
- SHA1 25b81cb0ef6c88e718dbb70ed3a76cf8d68b6048
- SHA512 0103040693a7d2faec35903941339f8cc6b005563e182c420711bfb39ba643a101dd0b733c40089e7b500469a792bf3d17159ef1e1013955e5ac55b33d06a862
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+apg:A3k03kHRJw
- TLSH T1EA25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 972KB
- SHA256 c981f63a583b3e549e12ad0bea1d8ab09b8c40b090733b008c68996e05ed3f28
- MD5 b817d2bcb98ce48dfdc300772decbe2a
- SHA1 c41a6a8bf8efd09b4c54bfb1f46e7e54195f9f7d
- SHA512 35e5cac5b3bbf97e52eab58cf46aa95962d8b349d6096302ad70b38055971de7cec432c3804a7c32a08c2f9bb5799b239ba942ef352540278c040ef2bbcb6bc0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aQr:A3k03kHRJ6
- TLSH T1F025AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 972KB
- SHA256 3874d111763208ff68a035cc06fe9afda9715e5a0e1595754ec27d6f4df1ea54
- MD5 c5335de252794f8db7ed528977ca07c2
- SHA1 8cbe6afe4a3988c889d7b42b838e293bfabaa157
- SHA512 e69e9ea5568246735a1407add8aa48c89099ad9bf30ce7308e841e1fd9e64a11663f3d8ca6e81bb1c0f55ebf0045c1f15a2545a910c99280901da13445866f4c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aOn:A3k03kHRJc
- TLSH T14825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 972KB
- SHA256 3ff67adef2c8cd38adc280a81d4e5596d549f31cec9b774a4784bc3548e59abf
- MD5 c78e333db82f5d33bf7f0d5ada0a5377
- SHA1 ffb729692364ffb77149b2fcb10aff9d9719dbf8
- SHA512 632b80a7691d6afdda26be70da087925706a70308049d04452006edf9f4babb79850f1e6920f0ffdf38cea3fffdde3d0c82087d1ec4d479c4d4edf5cffb244c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aEx:A3k03kHRJK
- TLSH T1D125AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 972KB
- SHA256 01280c435a1e8ba8767e16c0ae750dcdc6d1711bf2c68dc3f6281774e5df111b
- MD5 271a43f782ba55d555c4b1f23789a3a6
- SHA1 1446c5100a27ca65e9a8e11537124ee6e15adce6
- SHA512 3f1aaafd49702fe0e48f5ca5649857655ee120f9d54117c6dafcfcb9e2cf6715b2693c9e1f0c23fffc305715dd53ca4bb71a3f542bdf6c0804a531e0f20f617a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aOA:A3k03kHRJJ
- TLSH T13D25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 972KB
- SHA256 12659187f17107a3008a1aa772feafc608e3a3d089b51e29a9faa304273c9a3d
- MD5 50669fa7143e35832b98d70a76c99841
- SHA1 75a0dd1436a7915023d481a24379b88f2c8dc325
- SHA512 ff920296be4f64367b5ce2f94284b02f576738650b03d3a9b86c01ef96cc694d93c1e14f460175281361655763586db2a5c3db8fc71d6c403cffe7c415e082c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aH9Q:A3k03kHRJQ
- TLSH T19A25AE13EB9504E9E10AC174AAD64A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 972KB
- SHA256 ff788f080f9aeca5e3404c515dcec5852bc8e90f80eefa76d402c7b50b08a61f
- MD5 085064dc7ce204c9d564233acdf35f6f
- SHA1 2f9d8f768f68fdae9ae5002f19939a1a5a103c3d
- SHA512 9054b7916aec9c9e871eef742fe77bf190efc2b1efecef4e75a144dfd05111eb6f0098316882ee42e75a7322fbfb3582de971064611da3c37eb361a9d210c2fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aO4:A3k03kHRJL
- TLSH T12E25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 972KB
- SHA256 5f642ba1976a263e62155bb7d98dff9a1e867b387576a938514f52b2727b47e7
- MD5 59720521d94d2a8f121ef31bd0129936
- SHA1 e1ed547063f9302e6663e61d507ce82312c924d6
- SHA512 e690ad5a165f893f0f2dd5678d0d57b6fc96eac6248f99d23efbc6aa63788659962fa04494fafbe2dba20de9be0525facd1a378ccd9057372a1d0071551bfd34
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+atu:A3k03kHRJ+
- TLSH T1C325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 972KB
- SHA256 7c8afb5e864f142258c8c849e7dd198a743ebda86b1427a0b065b53e812c5934
- MD5 0da2efd38ee95bc9c47b2e46391a632e
- SHA1 b089813d73efcd4b8722d2dd24bc7dc0425917e4
- SHA512 c8fdfe3339004e315394e027caf0d094c03b03423779f01d3dc64d7bd1170d9b8dee35da032f8aa59fee2fc7b6098056a61b4a15e1848005ac40f6aac432832f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+agj:A3k03kHRJw
- TLSH T1A725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 972KB
- SHA256 c671c2ab7f3bee986e2cb2bc10dd68ff9f9062b5845ea1f5f90c151b1ee85dfc
- MD5 91f2249a8b7e64912d9b15163fe71ba8
- SHA1 65f73560e15cebbdaa3cc6e92fd832efb2045d24
- SHA512 f47636835efd352e0596a9fa43f3c253cb86300f0328d10a781343b56c403741cff8c0b3426087a7004ae76843d0527b397ea586d2b365422f1423739a03b1cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aRg:A3k03kHRJI
- TLSH T17525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 972KB
- SHA256 b81957e3df1ad5f1c0b1ff340603b166e32cd14d185341654aae80dfb163c2cf
- MD5 22e7e5dc44a66c718ad31a7a0884523e
- SHA1 1585823b0bff785654fb48d137832c5db4f6eda6
- SHA512 29b51a5cc8a40668cc29d4f579ab1cb669c5c55bdba35d326b0f6444662844cf2fa011f77a4a00d0cd4bbe758fe1aa1fbdad23697f9bf0a1798a8bc6535ba2aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aII:A3k03kHRJ5
- TLSH T17C25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 972KB
- SHA256 458b7968aa20a1dad8e2b0e84acdcbb17e7f3a6218226b37a6d9f13704bfb8e7
- MD5 7b65f20dab9019d5ef78554210d90a8f
- SHA1 b43818f9769ffeb8ff96927a23c159ded9388ad3
- SHA512 b316a110726b855204c62e3d37f3325461ebb52d3f385ca0e90c3d492117cbfcb3042b58f67277c5b70f0fbbc557f089eb2d563c76c1d712dc18997b6cf4946d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aqo:A3k03kHRJn
- TLSH T13925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 972KB
- SHA256 be5c1e96cb5e968ef4ae30fd7189bf7e0cc4e2ca062cd7de69f2efc100cfb645
- MD5 705fd1a2d182f7161a8f58118064da16
- SHA1 aaf2c4f98fa7eb590a569b38908e748abb8328db
- SHA512 6364a6dc3055d71ce1bc917bd6aff72e686accc952398bfbdf2deba2857720cb145d4ce2bda90d5f1fb31241e5184c5c9ec937dfb6aeee2fd622f2190fae3f1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aB+:A3k03kHRJS
- TLSH T1D625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 972KB
- SHA256 0fe16b990240a74ea8ebb4b7659f4e8d4ed873a188e889936033be2831259026
- MD5 50557a2ee450ee3ae3a749b2731a02a1
- SHA1 b08b0eac81050afa8d5891189063cac24d621acd
- SHA512 6be7c495481f3a44f79cef1cc8a14af35cb62c9d0cafb6bec114cb013572754fa676428afc5871eff36257cc571b71a02ed01eb06db330d0a6345d313f5c5eed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aPQ:A3k03kHRJG
- TLSH T14925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 972KB
- SHA256 b00cd5c90a6f647d7c70606d1daa271a2c8dd9c7036a6724194818a3a60e7a7a
- MD5 68fbb05ea39393be6b7f2793f38e8ebc
- SHA1 ff1504995736916d26decb7bdf72ec58486d689d
- SHA512 6b0349c313337de02fc93317f981932b19902c0a9f5907731812368fcdd3f0e52a3589ed3ca521a41fc4e771a3c68bff819cc174ac31ef0b333f0307108c3ead
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aUX:A3k03kHRJm
- TLSH T19F25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 972KB
- SHA256 5d2af8bddc31d2779478513fe9d078ead6b7615e7c900203d54fde7e43af9833
- MD5 8c0622f7020e983fa7fdf000df68f1ab
- SHA1 e8465de8abaf7cdd6eaa47a5f71c7873d51c4adc
- SHA512 8429381c1096f125b56b6718c750ed2d3657ed7b2e6c677d3bcc7ebaf5da4376fa7633c2cb1432ae8b2ca3803dfbeb94b99e0ca3cd88b868e91ee1a70cccf307
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+ayL:A3k03kHRJo
- TLSH T13D25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 972KB
- SHA256 ddb39e7cbaddf35465a6e17850af35f26028c395d99a1950139734bea0369d5b
- MD5 42f298cfbd4604c92bf0ffa3b74dbd72
- SHA1 f3056afcaca2cafb1259cdd95b0cefa0ea7be8cf
- SHA512 4712063ce62bff33b41dabe3b268fe32e7a5979b2d5026f0cdd7aae0cf01e4437f0b125960d346dda5c9fe0febb5aa0121ae5244514c5d554534e4850071aaff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+aWM:A3k03kHRJp
- TLSH T1EA25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 972KB
- SHA256 70777bd76aa7cd844c7869c186ffb765ee63fc7fb94d0acb566977e1f9a277c0
- MD5 b2089d601866ff9e04d437c85fa9db6b
- SHA1 866c9a6e7314c35f8d70fad84bb76bfc8ca605b4
- SHA512 30a0548bb482c246baa3000cfc18a04412cccfbaa41f7c29805b4f9cac8ca2c7d114c7fdb236ecb5b8eb5b3a1c1570bec239aef1a3be260009d5982b78579da4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSWsJf+afh:A3k03kHRJb
- TLSH T1B625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH