Analysis
- max time kernel
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/07/2026, 15:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 755KB
- Sample260704-sdblmacw3m
- SHA256 f8de01ca632b1834ad07f35da7977e1300f19a2e66839fe4683a431b3cde265c
- MD5 94f8702fc24d31c644444ba9429be5d6
- SHA1 b24346f3e7bb4bd06f721601c0de2f415ae5defa
- SHA512 f3971e700aca62290719a4b5b249e5d41a7f19df136d457f14bd86aad5c1ab2f410d4fab5771c40671c52573b17926401aa27e7169fcb7e874c8bc867bbb6aa2
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFza:J/sCv7QExqatgl8beJTTx0yFza
- TLSH T1E5F44B53BA4485A2D416023144EB4753EB71F81A1F11938F27BCAB6D2E32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 53 IoCs
resource yara_rule behavioral2/memory/4532-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5f9-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2be-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2df-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c75-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a4b-222.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019838-223.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-242.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-256.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-257.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a48-264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-295.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-314.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-345.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-408.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-433.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-452.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-453.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-472.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-503.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-522.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-639.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-749.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-756.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-806.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-837.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-868.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-914.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-927.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-946.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-965.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-966.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1021.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1058.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac6b-1228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019e15-1344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019e16-1382.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4532-1440-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2752-1459-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000066aa-1826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b2-1911.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066ad-2002.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2752 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 62 IoCs
description ioc Process File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4532 2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe 2752 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_94f8702fc24d31c644444ba9429be5d6_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4532
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 755KB
- SHA256 f8de01ca632b1834ad07f35da7977e1300f19a2e66839fe4683a431b3cde265c
- MD5 94f8702fc24d31c644444ba9429be5d6
- SHA1 b24346f3e7bb4bd06f721601c0de2f415ae5defa
- SHA512 f3971e700aca62290719a4b5b249e5d41a7f19df136d457f14bd86aad5c1ab2f410d4fab5771c40671c52573b17926401aa27e7169fcb7e874c8bc867bbb6aa2
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFza:J/sCv7QExqatgl8beJTTx0yFza
- TLSH T1E5F44B53BA4485A2D416023144EB4753EB71F81A1F11938F27BCAB6D2E32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe
- Size 853KB
- SHA256 7eaa98918123c15ba3275cd5e23a247aded22ee2f03081a9e05ffac2cb9589c6
- MD5 40a7bbe4258cc5aff6c110719bb1e06f
- SHA1 5386f312e8ba9fc62d173ecc8a8848b10a4e3c8a
- SHA512 612b7f68d1d7734bef31a405ddde340a00c8a81417e8426118b1fcca7ad63369139142e934866aceefb84db9deec95809c8c19bf65a3d39e12d1def890046801
- SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFzakGsrzBli:NDqatgl9TKNsrVli
- TLSH T1A0055C53BA8485A2D416013044EB4652EB75F81A1F11978F23BCAB7D1F327F0BB3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe
- Size 971KB
- SHA256 9a7188d6db15c3ef18fae60e03dada6928a621be2e3450bbb78f83847e905497
- MD5 ed46344ae97ac3bef3e96eb9017b08f5
- SHA1 2fc728355f497eb2a5317d1b20edd603b9e249dd
- SHA512 6c948dad8e04427702560f1286a2004a8debe9890eb79a680f51951cbbe7c233f41a97d3159fd35d130a98eb87467df0f231ec49634a09c14a599e7f2580bcb8
- SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFzaKA35i6c0:NDqatgl9TK9pX
- TLSH T153255C57B69444A2D026417049EA4643EB31F82A1F109A9F13BC976D1F33BF07B3AB79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 853KB
- SHA256 df26b7f5d0f582b97f5b66fd4919c325b5c4df0f9da8c9bdd81f01c598a122f4
- MD5 e9351b9ec9752d2462c3cd8ccf985e30
- SHA1 aa301a1fb08969f3c215421e97dd61a1267efefd
- SHA512 8073366500d313571f292a8f511b342e981f80627510d0f618ff0778505d7a468d8e01f94ae108fbc0862c160e870738e5b538251831b308370b74662b2f6042
- SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFza82MqDBxc:NDqatgl9TKFMqlxc
- TLSH T1E2055C53BA8485A2D416013044EB4652EB75F81A1F11978F23BCAB7D1F327F0BB3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 678a7cef0b783924b973f0e052538cd1ec5c7e4c778f68b9bf31459b0d35a4e3
- MD5 5854d1624816618591cf0a5a8453c286
- SHA1 ab8de37c33438ef6f9360929dca4dfe481c86ea5
- SHA512 7ffbc932604dc01ccf666c215726d7b45b6fe7bda13a663bbf2ac7bb396ba9404801b7438c65e53227c7346e93fc0045c26ac988be6412421f2a7a0aff9ca3d8
- SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFzaP0Le5ji0hmxNrM:NDqatgl9TK9Pji0Aj
- TLSH T1C5555A53F6648672D0228175C4E79686EA31B4461B3086CB13ADDB7C2F33BF1A63A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 769KB
- SHA256 f22739fee198affb42fc329d14a8488b701a048a73c881fffe993deb47e6fee0
- MD5 10cdb498b305e55742c405ed7461c4e8
- SHA1 a9774cfe14ac7894bd7fcc41c15e25d358f88191
- SHA512 7f49d9d2548b26afb337448eac8d7d974e139f4a8ec380f0b3132343ca94efef2a6ebc2a9eaf6375943eadc8084c73de72bec53d86e8e6801f099b659f2c0885
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaRa:J/sCv7QExqatgl8beJTTx0yFzaRa
- TLSH T144F44B53BA4485A2D416023144EB4753EB71F81A1F11978F23BCAB6D2E32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 802KB
- SHA256 0d7199b94cbd7e97c0de4986dca2258ae0e957606e5d7126e6e5a1a9fff92a57
- MD5 515c7a6d68f10d2d240ce586e9ad85c3
- SHA1 d2cf701db842f0857e64ee690bdbd3d06651ef35
- SHA512 9ab2bc588a2c9b0801d5a7ec79d5827b1735c2dbe0a9d4e79dde7d9c3bc5af28c0d0b8f6a4256f7f85ec9cedf0a9c58637314eadf172c24c5f4f2cccdea9ffbf
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzayb:J/sCv7QExqatgl8beJTTx0yFzayb
- TLSH T1F7055B53BB4485A2D416023054EB4253EB71F81A1F11978F27BCAB6D2E32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 778KB
- SHA256 0934a2fcb9b6d766b5b2805bc5ab337481f94bd1f1dc8498418d558f95d56a4b
- MD5 270b7e478bc84ea586808a6cb1f2da66
- SHA1 a1e6394698872aa5a3bec9ba85769ce03f2d1b30
- SHA512 d0f0b24ffcde8b9aecb88646531400bd3256de8ffabed830f807c31223df3d7a52dc4ee1b14d8620ead1676f0c8baac411aad94770ef79cef03bde2d6ff7b69c
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzao6:J/sCv7QExqatgl8beJTTx0yFzao6
- TLSH T1B4054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 778KB
- SHA256 f849f42a63033878bb34754d06a50a52c3c63f33a0d37f5da8994ced85b1409e
- MD5 5104be1ffcebbf7ce29aab82c8119b9f
- SHA1 40fef3a5954c012f33fdbaa709d63aa1fe8ee3e2
- SHA512 7d2c82d5f66b00a7800818389d96047069a5335a23efe040d2ab9305a8bc4c0c2f641874b8ca3e7be362e809a0617940ce798ab482a1e2688bbb30b01c5940ea
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzasN:J/sCv7QExqatgl8beJTTx0yFzasN
- TLSH T17C054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 778KB
- SHA256 42bfdc26d501388f1d731517aae53e85c2fd60dcedf643ed87562a1054aa1c4d
- MD5 8e289bde6359f665ed8520545b676191
- SHA1 e3b02a5d6f1b79cd86c58c010d1022e1d8e68ebc
- SHA512 0135d2bbeebc7a43ca66163a4a4cec90d91f77d69f63d42991535ea047d57de95a948081027c5cf7309747c870fc80ff6572b8ed08e35130833842b50a96eb97
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaif:J/sCv7QExqatgl8beJTTx0yFzaif
- TLSH T1EC054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 916KB
- SHA256 610f4dbb5720ace29ee8fc6ea463149e3811ca830db0d074bd1ebe83794e8472
- MD5 d9ae4255b9b2d85d4bd3f51367f857dc
- SHA1 79f33559d4cc8ebe2c368fc42151f162b5922d85
- SHA512 2d0d041a45caa512318cdc81a2450c0cb604cf2e27a2d1e4303df5bc73e3c9f8a91e67275c510c26b0030626d8569dcaef0f73fd2909d7ee962e23bd7d8ca748
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaQyPz5L87:J/sCv7QExqatgl8beJTTx0yFzahzy7
- TLSH T1C8155B53BB4445E2D416023148AB4652EB71F81A1F21968F23BC9B7D2F327F07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 778KB
- SHA256 d15ae5b35db083794cdc4120fdc38b832c47e2a307d2da8c43e36ccaa5f1f1f3
- MD5 c50fc5cd33ed2baac8e9b4adc940d227
- SHA1 26db398d7051f02061b456229f799051c16fa5b9
- SHA512 9e81ebc0e0265b5b97abdaf0c362400abc2833f786950d526fc0c14a1c547f8d19c0bb08c16d8fd624fd9c313e7c3733b63419dfb0ae345bd0510316e1b651a4
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFza8o:J/sCv7QExqatgl8beJTTx0yFza8o
- TLSH T198054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 778KB
- SHA256 63ac35072f56f6c1b06ef5c2bfe6f880c55c611a0d2a7ee708b6653999a91664
- MD5 0cd2f2dc2c77a8286a8fe562eac7c5a3
- SHA1 8cb1de7a93be9053826112b34d8b0e1a9ffd2407
- SHA512 8bcac24d309fef1d5072303ddcfdf028093fe3e13cb16f8cd49573241bb139eb7bfb7de9c282fae3c453469d6576f0ebdf0551ff90a8a35d73d2e22d3bdfcd97
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzacu:J/sCv7QExqatgl8beJTTx0yFzacu
- TLSH T128054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 916KB
- SHA256 a1a1520eae836da389ec35c595c3fa6c5a66479ca01a20d0d4f68e516e776dee
- MD5 97662816efa039de694ec136879f16e1
- SHA1 9107f72970780589b6f216ab9394062e4f68da2d
- SHA512 4b8debf4fd236c65483c68cca856042d55cfdd4d6fae6e22d26b2ae7e54071b6d74c2598794acf9cf0ab641165bfd313aee9dad0499fded8924eaacf346ccc5d
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzahyPz5L88:J/sCv7QExqatgl8beJTTx0yFzawzy8
- TLSH T13D155B53BB4445E2D416023148AB4652EB71F81A1F21968F23BC9B7D2F327F07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 778KB
- SHA256 d5930df4a21196d5f88fdd7c2250bc870ac4f8f7d1cf620836cc159770fddff3
- MD5 279b1c2127f3a6e793d4811d3073878c
- SHA1 d1e87cfd09241e3c85f950c56aaa735ad8a02e6e
- SHA512 b996720baf9f9d5002f47d20912fdbf532bd69dfd092e7c13b84b3640ba684b8cdf6bd1e8aa664d269a5215bf4303c2f1f8ab3a4d078a6535d2e0f7d4eaf6a5d
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzag9:J/sCv7QExqatgl8beJTTx0yFzag9
- TLSH T133054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 778KB
- SHA256 dfc621fbbb8f612d6ead1e086dc8b12ca26320531ac6cc939d0d0ec07b4e1fdc
- MD5 87fa3c193d44dabd1420c151c0748b00
- SHA1 7dde122a4d04ada8c980b842819c16d7da6f9b59
- SHA512 da6c74f075802c27d2ebdded98a7346acb1e31caccdd274873c81952f760c0d1fc852e95c2e2ccc1a8453d9dde95c7912568ca53144fdefa994afee627c2ed77
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaoc:J/sCv7QExqatgl8beJTTx0yFzaoc
- TLSH T173054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 778KB
- SHA256 bcd6c1b9d2810c4f1aa7dbcb872b530534ea92acd935a4f7831aa1ccf33a4aca
- MD5 d7d9df47afadd0b8b5dde58eb36ca447
- SHA1 4bf8023a09d5bd64f1a16f48c7ec319d39778d37
- SHA512 6def72cff0a15d0a8740ff8444c6e5c20618668218a499ec74930f2919366864b7f878e16324f953a9ea1a4e1f35f8dbb0e902791813a25dda3b5b63543d93ea
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaBp:J/sCv7QExqatgl8beJTTx0yFzaBp
- TLSH T148054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 778KB
- SHA256 27b7ff3f8ed9cb8e069b0cb30b05e0cf77e7866f2c866e356b99af24da38dd97
- MD5 02d4237d8d7c6842a6bc690f68084467
- SHA1 74b1f1601fc0b0ec9b84a80ed3c36feb57a97ccd
- SHA512 377b62a17f936d7001720ad3c9835a8398869c0f9262f1cccc06be4d0306eb5512388d09bec0cfd3f31b5f5dd36ee126f8ad5106d07f41106fa75c7f156bb17d
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaW0a:J/sCv7QExqatgl8beJTTx0yFzaWN
- TLSH T10E054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 778KB
- SHA256 ba87916cf298d94580e83680467e5a5e2aa9a067fe4cdd6e46511a91e8a6167e
- MD5 839fd06a588505b5d90b93e66e52a925
- SHA1 16e3060dfeb34b5b2f760b222e1b3e806b895db2
- SHA512 8dc433d47fd902dc685a255dd41ba98c5efd613988a161287daceb3b365ef2a3e5a6e3a7d1d85e479f67c62df6e2e0181ec45592a0afafb9381843ffa0601992
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaaF:J/sCv7QExqatgl8beJTTx0yFzaaF
- TLSH T12F054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 778KB
- SHA256 5fcd8f8285184c8cf05de532d1f42491b4578c4ddea01130a07a94413987443e
- MD5 7fe0dc0ec3b915ed03a45a1f2dcf6e74
- SHA1 942fd5203d8689f94a797844af33c7f06bf20617
- SHA512 7fbc9c150bda1d93fd0a33b3fa806196e589bf35ddc590f6735e417a4d55ee5181bfad5e078356868f7d083dffab5d1a20ce4b504b03c2ee0635db52e4d808a6
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzavC:J/sCv7QExqatgl8beJTTx0yFzavC
- TLSH T10E054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 778KB
- SHA256 7b46a06c7796180b172317dc45c7b2f19c31a60ae77f9c57948cbe2e9402197c
- MD5 b82c61727da570ad03d1f057b82f7de5
- SHA1 d6969418aff592c6cee3328d99ccc5967f3bd6d5
- SHA512 376a43dff3113ca2907f6cd4e4d8920962b45360d4e41063878ebbaa5486a63ab3970127801cfb4685552d2c726407a0a58dbcb0040ae1ca8f52ef3061c052d9
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaQw:J/sCv7QExqatgl8beJTTx0yFzaQw
- TLSH T154054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 778KB
- SHA256 46b6e2406556a9c0e2b0c2bc9072dc35778970d2f375f9376dfe06a048134945
- MD5 baae8486830bd7e40f6737b6268b1370
- SHA1 cccfc466d051930e34b841da085ddb51bc4125db
- SHA512 03acdad47c2751e851471fa586b0e798fc1f538534b1c031b31f03a4c6c7cc1a6f2d5ef41da4b72faed32cc504fd03cd43f489484e0abd71149a19e022621747
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzavT:J/sCv7QExqatgl8beJTTx0yFzavT
- TLSH T1BB054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 778KB
- SHA256 57bfffdddbe9ac048377b33c6c35f1710ca5debdf6e3a2a7c7d070fe0850174e
- MD5 79abfd028fa4a85d3b5af4d263a0281a
- SHA1 873aaca535ea4db4b8e9e96646762af2d92e6d35
- SHA512 0d27403ddb232611dc72643fe90c1afab18452688e8e25b63d45d829cb9b4b1c1d4df2b50a06f29e917a7f863e2f54c58a6e98b0ee1a2e0b69d6e86ac8271c52
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzapu:J/sCv7QExqatgl8beJTTx0yFzapu
- TLSH T1EC054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 778KB
- SHA256 fc12df6fc1dcbb43e02c47a72199c39124494003fafd8d9e3519cad0086ae878
- MD5 a55d47766a8caeb8f5b9776f378ef84d
- SHA1 f046ae3ad6bd83128a8f4c7cc8abd8a15b23f823
- SHA512 8d0e9374aa1f34392a1d3518c5728a561d7b8c42f02e44a6df8cb512dc2986af1f5c8b00763978e0ef83d5edd7fd8b037f2142f927e8f3e0512e8abc1ddb3948
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzahb:J/sCv7QExqatgl8beJTTx0yFzahb
- TLSH T170054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 778KB
- SHA256 e0b07fcabbfc4045ae37553cf4df33802e09b91e5c8aa619c8e64a8ef41601f2
- MD5 211a2c8c867555c40ce376015c5699a2
- SHA1 458135b2c05e9248b3cb764c44eedf0cd48ab9a2
- SHA512 57af8c6e28174e84f8a8cc85bf45b4843760c45070c45ea2adfb02dbf96fa5888d6dea9b9fcf0f83396ea1058e5e74e8c6254aeaedc02b46075faf7c85f654d6
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzapf:J/sCv7QExqatgl8beJTTx0yFzapf
- TLSH T14A054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 778KB
- SHA256 69eb3a6f58053754706fcdf71a460e5af4e88233be407196bbe6d3b4f7eb356d
- MD5 ea2546c05d2da6c9bb5d46ae428bc500
- SHA1 23be8776ec1274866e54550c8e2b02d6fbbe23d0
- SHA512 a53e17310bc880e238a2b86a921df730bd045bd7cbe3e2f323b3287a23828720f7bfa494b0f9b5365cc8a83f46f06ce75efb007f8b64a70eee2387284ce9c010
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaSK:J/sCv7QExqatgl8beJTTx0yFzaSK
- TLSH T1D4054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 778KB
- SHA256 809e2bc580913b81305390adc084abe33044e9b39d516cffb41a161ffae2d94b
- MD5 eac617c3e7f96838647ff3bd373f73d4
- SHA1 a02c6740dd718ee2b5e59e26deed8c6415cdd335
- SHA512 7a271599cba3fbfc794f9042ab68bdbbb1ae65d9c89c42872e164f4212da6c21bb452f0c93a6a71465cf201b14b2e58563a6232e9aaabcb5f183cdd77e62352e
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFza3k:J/sCv7QExqatgl8beJTTx0yFza3k
- TLSH T11A054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 778KB
- SHA256 cefdc80606bece37c38d3ad98a9cefc6c29eeca4b54cca3e7243f6b9929dad44
- MD5 8d31d0aa1c5399d3cd3f440db8ffb826
- SHA1 ef0b849d52a6ece69895e7e5db9ccec10762bd03
- SHA512 55458579faa314167f5e392642d0f4a0d660f956864d4c5d84119c00d9e6a54de17cfe9446c9fd22de7422f913b6ca4506fac9305c9508c4b16df10b1c97f795
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaA0:J/sCv7QExqatgl8beJTTx0yFzaA0
- TLSH T1DA054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 778KB
- SHA256 279f1b34ffb9b7ce73443c2dff6e4c91cad5462fb0d7bfd55035dcbc91fe83c7
- MD5 6841f0db6b8aefd100b07d12c28fa6c2
- SHA1 5dbab3ea7d9484cd472f196ddbb1556b3d6a99ef
- SHA512 2c7265cbc215cbe00f16bd2ad121f927b7ebcf8e147bcc2e1e71a2cc4966207af340fc4af41b65c004342b5914e7ec24091cd3a9f53760932d54cecb13f50d38
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzab70:J/sCv7QExqatgl8beJTTx0yFzabg
- TLSH T155054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 778KB
- SHA256 83560ca15046b47131acd5411aa10ae272ed2f4fd067c158133d20bcfa1d4e17
- MD5 7f58892da6d4f8d077be3f7b205e07a2
- SHA1 84932602fe6226bff7cc9c853d1a1a99d7f0ad82
- SHA512 c3bac6daf6a7aa513cee508b812e343372d0dff8b46725e81872cb15810324e5c1617c433d1accda6982c4d1c460560a91ad29d0ea8373732dbad0bb4d241b91
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaWr:J/sCv7QExqatgl8beJTTx0yFzaWr
- TLSH T18F054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 778KB
- SHA256 bab684b05e154c9bb32216436764f436826cdad5fc0b794cf14f661d45c2c5f4
- MD5 aa7781d51c0dd0ccbbab260af9f6159a
- SHA1 e743bf7752741c392b3fe1e678fe83510dc392af
- SHA512 346d71ed3a4d36e44caf2de8ab58a17f43e6b1d16e09ef7f74f5937b05d352a704ba6c578bf83e67c9ee7075480c86515d960bb7c6922f60101517145ba73c41
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFza8n:J/sCv7QExqatgl8beJTTx0yFza8n
- TLSH T1AE054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 778KB
- SHA256 69d05ada36f76ed3c8615cdba66be5dd1a7529a77cf96dcaac4c57f87cb4a9f5
- MD5 955ec147bc1dc9eb74466109cd39e156
- SHA1 cbd0615cc44877bb94415661b82fa7d1d173adbf
- SHA512 b3e55560c68263c8fc64eacebe5ac0aaa4ca460f9aafda1dfc05045894b080159f20abd98c2a75fe9e0776bfe0a12603c26155cd8dc56360cd2767ca990ddb04
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFza6x:J/sCv7QExqatgl8beJTTx0yFza6x
- TLSH T1CD054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 778KB
- SHA256 948578d88b4440944496c14c25d6b6ef4c4f18774b96e71e311d43dbf18a6b07
- MD5 375c3da2f975afef6ff89a01c7c9bffb
- SHA1 542b86574b7fceff0be72f8012d4d679de9f8dcb
- SHA512 a08bae750e939b880161046aea18d3289ddb3c21e29c2fce7642c589e12c39c3864e712157ac0bfaa1553b193fe65ffefc2624ba5793505ae3cbba1126dd2407
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFza8A:J/sCv7QExqatgl8beJTTx0yFza8A
- TLSH T15A054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 778KB
- SHA256 262d96778871ca43781212220933ede5c8680192aad85cacc114d17cfd0cd5da
- MD5 441a35215353f5e8161232312c60d3c2
- SHA1 b0d0df08b8ea113541f3ec1a4911b644bc02a46d
- SHA512 b7c8f157651478ed47df77218ce5d9cedc8630fcf77df77752b575be64f0d0ec31420a8a5d98a0bf15c97047699549907f37329c5ca8282d403e1726f187ce78
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzal9Q:J/sCv7QExqatgl8beJTTx0yFzal9Q
- TLSH T1A7054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 778KB
- SHA256 4754c081b749690543d4d3743feea7d99c68950c354858a13756ec6a12fdfa76
- MD5 0f7218f7f411a0b6d63e4db9b7707507
- SHA1 34d7c1aa9261abc31ff625810eb9a3e25fae9758
- SHA512 2c8c4afa6190ac9a7fa6fb4f18841ffedc5bfc39c5a779a0971d7bcdddb32edbcd8882d5b19b7a0fb25303e6c0a53de5429c544f9cebf3ecd39212e37c6d1662
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaQ4:J/sCv7QExqatgl8beJTTx0yFzaQ4
- TLSH T108054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 778KB
- SHA256 88e461603b1ce658f7b2606421827a69d65811ba8b3b776f125c3ffd5e57923f
- MD5 f5339a5e6175427b9f0b5c940f322196
- SHA1 5d508e9f7236c2d6f077eee4367c13e3c07850c3
- SHA512 1364acb5c560a4b038e7ab126d43bf05cbb98dd3c1c42967c59ec21fd61513376a596db00c80d54b1fbee1d51206ebad4b6118dc7d7d356fa5735109c8b1ad7d
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaTu:J/sCv7QExqatgl8beJTTx0yFzaTu
- TLSH T162054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 778KB
- SHA256 54d0b1c6456ba820e5d7c552acc9093a63f5c83cb241b58813c679277af8595d
- MD5 5bfb27bc5f9624ecb6ca26ace0d93248
- SHA1 737420ba6c42cf344c688e57348d6bb14fb73de2
- SHA512 8eb95f15d30f1805095d64d05b3f297dbd6e78c33621dc032660598a4e9c85f61d82cd4d44ff7c6a5027dfe00c0e5921d871822dd64a5377004b48dd7c49f0d0
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaOj:J/sCv7QExqatgl8beJTTx0yFzaOj
- TLSH T16F054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 778KB
- SHA256 6556ccf05a332f5ba9981965ae5c06556ff0c9be78bafc46b39b109e462a1a24
- MD5 ac0c6ed5f08a7521af787817d79060a9
- SHA1 ae0526334b6c8cca267477cd06fd6bf588b7f5ae
- SHA512 c89df91cb057ab06fbc97e1e169051ad739a6e6d0d885e9b21aab6a70f324fba1d697f54cde428b9456764d8946cfd78fd4ea3863e3c7314a5c3e8133ef1425f
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFza7g:J/sCv7QExqatgl8beJTTx0yFza7g
- TLSH T1CB054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 778KB
- SHA256 f8db860c01d73e607dd173a8f98a5eb8afc11fcfc90c3783ca9ebf2be248c52b
- MD5 40ab02145bc49f08310d492f543e0810
- SHA1 239261acd715f7ba046a781e80e8c3f8f334f84c
- SHA512 8f3fe13bc6c09141fead44069f6ddd9a1ece89ea08882511dae497ce10635ef937d169b0c79ee39d2d875ec0eea4ec4ef4bf6bd7212efd16b1a8778c3c9f3d25
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzamI:J/sCv7QExqatgl8beJTTx0yFzamI
- TLSH T1FF054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 778KB
- SHA256 665dda4592c281e725377f8761fb59f69b57ff3046d1ea1c0f3184c94fd33c21
- MD5 22e0414062da11a7179eebd45069a812
- SHA1 0d76a0f902fad2c4ae4f1df69a875e538aee20ba
- SHA512 c408b7f34b156f70211af49d822af6528cc5c5e115859a38f95e1e7acfb3ff0cd6e6f8e00f28c998a2e1cd2e59ab3cd8490b5f965de577aa390f06b0cf30dd79
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaUo:J/sCv7QExqatgl8beJTTx0yFzaUo
- TLSH T14A054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 778KB
- SHA256 ed1ad239ea01c1b918d0c440e4b035f1f630a5bc2e6722ddc5b054bb155d0bcb
- MD5 b0acd73b7be91863a82bc5c5cc389e6c
- SHA1 bc9974aaa961437c8dc101cabef41ef3fc821708
- SHA512 60c3b2860b180c9c98a1fadb68455d639896bb86862726a4a5624f8bb52ab4728aa9b94ebca0d0c4d96a0d7e50620cc49bff7c9ca8d2c87d65e0c869962527e2
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFza3+:J/sCv7QExqatgl8beJTTx0yFza3+
- TLSH T138054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 778KB
- SHA256 b17e884ed26d3fafee091a6db5eb7b8d52265d1ed49a89dd3fd2f7c7db986b79
- MD5 5737c3abec2cb3e332813ab8d214a3ae
- SHA1 75925fe5aeaa735ce3a844d0e666bc1adfedda5a
- SHA512 9ac29b139421b894db3f9c91014c7caa7fd9fad79e4f7bef743abaef606b3bbbd1a659ca43aab3cbba3694c33a6d11e9b07f209ea480bb1a90e59a3731b0a651
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaNQ:J/sCv7QExqatgl8beJTTx0yFzaNQ
- TLSH T1CB054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 778KB
- SHA256 834e0970878da67aa2581dbc96359d743299fb4cdcb305ec82c9a4a1165ce0a8
- MD5 6ece0b1f559d3e090df612a0985ddaca
- SHA1 85ea2833fa3ee58ed64fae11dc6de4b0c65ee7cb
- SHA512 f71d6ecce19659f7da07ad41e7d159decd027100b530d5793fdfd89707bdd09a2ffc2067146407fb316b53fee1cfc7f752f3ff1eaf8698532f33cbfa4e47517d
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaCX:J/sCv7QExqatgl8beJTTx0yFzaCX
- TLSH T11B054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 975KB
- SHA256 557fa0447bd762cfda917667c286581758810c616584fb0698803f2d3e98914e
- MD5 93964e81f2de2c110925e3d71240d644
- SHA1 3600f4dd44a02350b9e477107c4360de5e7b577f
- SHA512 9e6767dbb38c50e69863eba8714200489bcfa81274353af9e8a99784d7b52726fb2de947642fb197aa3ff892842337aa2ae33661059a0e1eb9035a2463e687d5
- SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFzaJjCXF7IwZ:NDqatgl9TKTC17IwZ
- TLSH T173254B53BA4485A2D466023144EB4752EB71F81A1B1192CF23BC9B6D2F337F07B397A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 778KB
- SHA256 023d9f87405f6df2e9828797bf8800b60c8fa145f2a26608aa12e99976d1875b
- MD5 1097b33fae128210dca8a94fdc2ccd56
- SHA1 0ad22860d06fbf9325ebb0445c8679fcd111c8ec
- SHA512 25981bad4afd60142b3de575463f32429bd6b0010fcd9efaf34eaf4e6ff8d3b2c9aa9897c08220610f2d79a31f22aa8370ad251b16fb090655b6f3a1ec4b7e71
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzakL:J/sCv7QExqatgl8beJTTx0yFzakL
- TLSH T166054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 778KB
- SHA256 b9c7ae5b231ee2e685eebab019bfeb375cfac09c9e99379f2bae1935cdfbe532
- MD5 04c0f2ef6d315e9637ed9fc08a2660bf
- SHA1 7604d4df0ea1de09623c2da9729b34898c43824c
- SHA512 c3c53803ea6e6ef563054e97737d46065486ba38e5cb408ebf00f61d7b269a2fc5bc2f71e5c055f1d6392102c05a95b7723322fc739638a42d9bf841d219d82e
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaAFC:J/sCv7QExqatgl8beJTTx0yFzaAM
- TLSH T1A4054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 778KB
- SHA256 b2101e3784824293a7aaf5702cc4898f18943afdfa1a02dee624313d0943a1bf
- MD5 f98418fc03502f4a7fe090e18f41bd1a
- SHA1 5a99ab989fbe3084d2763d5f1f9b83b97110a567
- SHA512 5482253a55d7a96693d6ddbd48adac27e3c5072676c3a0fc0372642c49abd1da8793095a70beb1f914afb397940b818312378f9c2b4d94d959f5e77c25c23907
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzahh:J/sCv7QExqatgl8beJTTx0yFzahh
- TLSH T17A054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 810KB
- SHA256 b1adf5fcb995b9b7d809547a5176468a971795fc29dbe49b9f01b46002fbb93c
- MD5 5da5d5f29cfe9227ff17eaa1f59454b6
- SHA1 7e0e0a2343a98a5b89128064cd79fc32d6dd10d1
- SHA512 97831d20050b4a706af5895677b2770baa7dfa872000769966068c1bbf441ac6e927b23800d745eaaad90ff57d1d9d47e355cf151235c1e9d7fba3253c4ae2fc
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaB2+:J/sCv7QExqatgl8beJTTx0yFzaB2+
- TLSH T1D7054B93BA4485A2D416023144EB4653EB71F81A1F11938F27BCAB7D1E32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 816KB
- SHA256 b9276751957adcf3eb8a8aee568224ff13de434aeb367efbe692ec107b347d98
- MD5 e813d42a5f720d421cb45f547c57251b
- SHA1 3b2e7ec0abb25e1e815c7d77ce62395ef5347a9d
- SHA512 ea7426a2cf513927bf7f01b898e690b67568e364b4d4828415794990ea820a551403884560a725c20d503fa850fdf240843d201fb4ccdb7e35a5121ac6550d48
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFza16:J/sCv7QExqatgl8beJTTx0yFzaE
- TLSH T1E0051993FA4485A2D416113044AF4652EB31F81E1F11968B26BCAF6D2E32BF0773DB79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 834KB
- SHA256 9c677495b0c094338dbbac1214a1f11ba6e39958401f787ccea1b83473979afc
- MD5 3d01b3226b698075e6c48d35b185cb4a
- SHA1 2691352128c6a0ac62aca4af5ae0f2db2e69bbf7
- SHA512 6cb99ca67fe96027e85623ad6587eaa0801f64994b95665cc8882deab5c5e8e0598384977abbb2fbd871aa0a58ed962680f84d6b5f2fbd492e0cfb5d4639905d
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFzaLF:J/sCv7QExqatgl8beJTTx0yFzaLF
- TLSH T1EE053983FA8485A2D55601308CAB4752EA31FC5A1F11969F23BCBB2D5E327F07739768
- MD5 SHA1 SHA512 SSDEEP TLSH