Analysis
- max time kernel
100s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 04:34
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 802KB
- Sample260710-e7bltset9z
- SHA256 af826aacec94805c6990fefbdd8b07be1d4725fd4196dfa32b4a8cb7e37f0bfd
- MD5 15226ac7433c67d9af75d2806e7e6823
- SHA1 482912095bbc2802b081de86c16be32fdc313df9
- SHA512 db32fed5e2f2be0d577cbe25c5fc4a9135da79fcbb8756f51757fe66eb1311b50e79ba9e8cf9974038a75f40f2d6b573cd7782b90fc1361741ecc95e03b38bcb
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNa:J/sCv7QExqatgl8beJTTx0yFyoNa
- TLSH T12B054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/4996-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c53c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c89-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-318.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e7-469.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-567.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-604.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-623.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-720.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-739.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-782.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-819.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-850.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-869.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-946.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-947.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1002.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1045.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1082.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1125.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1144.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1169.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b93d-1356.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b948-1363.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b949-1370.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018981-1461.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001886f-1510.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a32-1547.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018877-1644.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001887f-1789.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4996-1898-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4672-1983-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4672 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4996 2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe 4672 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_15226ac7433c67d9af75d2806e7e6823_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4996
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4672
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 802KB
- SHA256 af826aacec94805c6990fefbdd8b07be1d4725fd4196dfa32b4a8cb7e37f0bfd
- MD5 15226ac7433c67d9af75d2806e7e6823
- SHA1 482912095bbc2802b081de86c16be32fdc313df9
- SHA512 db32fed5e2f2be0d577cbe25c5fc4a9135da79fcbb8756f51757fe66eb1311b50e79ba9e8cf9974038a75f40f2d6b573cd7782b90fc1361741ecc95e03b38bcb
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNa:J/sCv7QExqatgl8beJTTx0yFyoNa
- TLSH T12B054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- Size 937KB
- SHA256 42af838e89a709d4617dbfd30f6ef8677b37396551e8585cba649de985898b65
- MD5 6028463ca0c9c0a274b973a183d0d5c8
- SHA1 eea233bfae6fefc26b1e7070625990126783bb22
- SHA512 68afe3a16841cd55964a71ddce26f1fefec20173e35a8a8c416e0099795224b0a95f82ddbe5ff715eeae565b913cc3d3141082f4865fecc26c4c2ec033a2b46b
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNapmEZrZq:J/sCv7QExqatgl8beJTTx0yFyoNaoqU
- TLSH T1FF156C53BB8084A2D416023158EB5692DB71FC2A1F51928F237C9B6D1F327F0773A76A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 893KB
- SHA256 385591899cddcb308bfbfc630d5038e29cc6076c88ee6f0750503ea6e0989479
- MD5 9b0427d0d17027806f5276eba6fb0a81
- SHA1 87574a4e99e18bbcf0a0737b9acbb3e15dda8fc8
- SHA512 3ad7b452ac371112e70dc127e29087dabcfbfa3acb3d41918ff9b1f1f8a444fabd9882be10ac8bbd23e0d3f61dd78db645f887fb49e6c49182c3a2e63eb93a49
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaf:J/sCv7QExqatgl8beJTTx0yFyoNaf
- TLSH T11C155B53BB8485A2D416023048AB5753EB75F81A1F21938F27BC9B2D1E327F07B39769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 886KB
- SHA256 61530a93b0978207dc67811893b0bbc7303ba1b41eeb876aa0e4e15b2a8516bb
- MD5 1b15a01c98eba8ccd1037960a278e60e
- SHA1 24714e2c3de97ab9c46d428f113a4550e0622752
- SHA512 a75b03d71711672d1b464717bb1c9e6ae0e211f4d672595d8c39a58096cd9a82acdb02dd93b95a291607e4e8d3255d850062ed722bd47bfa956cb3b46197b79e
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaiYmIjE72:J/sCv7QExqatgl8beJTTx0yFyoNae72
- TLSH T156156C53BA4485A2D416023044EB4753EB75F81A1F11968F23BC9B6D1F32BF0BB3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 854KB
- SHA256 5d077ac627bb3c7a9729c4e641669379152a23da94ca6840f85d9bb29e301493
- MD5 b5bdd71cb7bc5b63d58778c3cc06851d
- SHA1 03f8720ec54003ea6b55f090c145a8c784c4edee
- SHA512 343eb6c0042523994556ee8845365d29501a3baacf9017dc94f0debcc2c8f717f2614c5522b396e1fea270c938488adf33e9f6dd15923210199691e6b45bac7e
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaUFfj:J/sCv7QExqatgl8beJTTx0yFyoNa6fj
- TLSH T128155A53BA4485A2D416023148EB4752EB75F81A1F11928F23BC9B6D1F32BF07B3A76D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 909KB
- SHA256 2704d1a7df1eb68beb9b39bd623b14a6f0bd3a821572fe6dd8c2584a73fce05e
- MD5 d843df6468a539d846c3dca090c99c49
- SHA1 002137176612054ca4a6da13addc7947fa168944
- SHA512 36580c69344956b6d060e29108514038b43fd4e41e13a01fc8a813f5292654a1dd0122635a60e3eb910152adc0a1d9ceebdf8af807e3a81282a8656b366c975f
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaMzQl8Hok:J/sCv7QExqatgl8beJTTx0yFyoNa/hk
- TLSH T1FD154B53BA8485E2D416023144AB4652EB71F81A1F21978F23BC9B6D1F327F07F3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 d16a8d88f64622ef2f388d5c4d2a9976024ce99d42040e8563c7e533c8199654
- MD5 678a727327e24458ab508d839f585bb9
- SHA1 a592d321575756fb66c693923168b2d670fde0e9
- SHA512 81dee9426eeb790eb0a782cad1bf33a025d36906c5c40806bcbb6557590cd882edcdbc3c27a1248c4fdff0e90c1469c00add7c0ef4c33e7cc9941c0d66e16c97
- SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFyoNaP0Le5ji0hmxNrM:NDqatgl9TK9Pji0Aj
- TLSH T16E555A53FA648672D0228175C4E7568AEA31B4461B3086CB13ADD77C2F33BF1A63A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 816KB
- SHA256 467cbe10c8fbe0e39c219b711b406ada145de89e9843bfcc886fe9a73ae61d23
- MD5 78fe6a37b3bb8cb663f848158bac2a87
- SHA1 56ab2d8bc86e9564db742295aca90347f910593a
- SHA512 0a6afe20c2650c6493305edc265adbec9cc7ed9a84e9c3c8f4bda04166ede288f70e5474efe567f4f31c7bccc999147ec0b027e9c76d7f1c3736c3a042224372
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaRa:J/sCv7QExqatgl8beJTTx0yFyoNaRa
- TLSH T131054B53BA4485A2D416023154EB4653EB71F81A1F11938F23BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 850KB
- SHA256 26b98f4a8d2af9b644e5f9f2e023a4fc802884726bdef39add091df2cf7ee933
- MD5 204a6aadaca8f704e726553cb53118eb
- SHA1 ff2db7b1a750bf229dfe2a1a57ffa3a6e33f8917
- SHA512 cdff362edc9f43bb2fe17ffabb0212fe10c410abbe97cb6c827934a2db636544d767086648807c7a656df8d9a8c0f393b5b67a54576b40d7e59003bd8d12d151
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNayb:J/sCv7QExqatgl8beJTTx0yFyoNayb
- TLSH T190055B53BA4485A2D416023054EB4253EB75F81A1F11938F27BCAB6D2F327F07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 825KB
- SHA256 789f49fe5e610cde3b6b05e1c686d953ca03964a974b90132588e25ede89d41f
- MD5 fef90d751afe515e71613f3c380277a5
- SHA1 5032e64d6bce3b2d78893f4bffa44f066fcec761
- SHA512 f5abf13537b1d3899a9a2e8cf266bb6e8841d5ea775a6d33ac42ad9a3c5919399f0d91b701513a24184f29030e77d2857b03c6f2b148b9492fb5bba6e4cb463d
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNapu:J/sCv7QExqatgl8beJTTx0yFyoNapu
- TLSH T146054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 825KB
- SHA256 b8b6ac9040628013f6bc29fbfddc650ba123999895d5b2f07b1836cfed9d59bb
- MD5 4e23ab9d250dc28ea295d1210fd84beb
- SHA1 3efa2a743e55736125149175d05848e1dc53de36
- SHA512 6028d51baa51406d2a942a797f6f148e2582cf1a04e784471a894c51fb2ee89db1ecf45f8fadae01ebb73f634b326fc180c047008a4df438ac4a7eb3c47c8559
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNahb:J/sCv7QExqatgl8beJTTx0yFyoNahb
- TLSH T1F7054A53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 825KB
- SHA256 d0ba84096c133a249fc45d66c55d2082915bb493df561fae762e3ab4f423b638
- MD5 bb3744c7574937976098d4331e9731cd
- SHA1 485f0d7f6fdbb934f9963880905593da96412c65
- SHA512 f1b584851a029656860c8a6d301110a0d9cc07e1cc8da55a58535dc4a421f30d9893f3687b308332305fe409572b423a6fc3fdfc3a283d45ff2b6ced434f9976
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNapf:J/sCv7QExqatgl8beJTTx0yFyoNapf
- TLSH T1F7054A53BA4485A2D416023154EB4653EB71F81A1F11938F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 825KB
- SHA256 fd8d3a75ebca39b4e34e13d555b610f2292ad2be29a06c405b336d8c39c2e946
- MD5 29cd9306d7b92bf23f50f24bf8db87e3
- SHA1 d8e4f21304f9c118605b205657865618c3b98acf
- SHA512 9f4da364e47203fd5c81b6d4638ff427d8b62bd8c56f317b11d1972975408bca5bc87a1efca9b4528c6039cdafa31edf754047d824bbe72d377a131bf1a354b3
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaSK:J/sCv7QExqatgl8beJTTx0yFyoNaSK
- TLSH T1CA054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 825KB
- SHA256 640a547032c7ca33161e1007d356facef082f5bc0f9706c8070ddf889a8d32b0
- MD5 ac601a5f1e240ea956e19f3725fea662
- SHA1 30ff60f6a4653361f7154dcf773b0be06555e229
- SHA512 9be4aa7d89de7673c697fea9b5de247db7d14d0db62e439d065fd9d485f28e56b2a6efc28f8d9606b9b394fb15fe825be609205918c168a6063b93c49d393d2b
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNa3k:J/sCv7QExqatgl8beJTTx0yFyoNa3k
- TLSH T1E0054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 825KB
- SHA256 0f08f1420d32d00d1f741a07e13be99cd8b55b6a300d0c1ef84f06b012ef918f
- MD5 fc6719c0b12eb036667c465ffb2c81b1
- SHA1 bdf65c947bf68611350013e287e07f2a0d15d268
- SHA512 c83d054e1f53d36638c0cb23fdb9a60639c395af17847d2281c6485adff515a3398e5022fa09b8de6e1365bdc7f16136ee091cec0b0178fac3bdadaa3fd3f66e
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaA0:J/sCv7QExqatgl8beJTTx0yFyoNaA0
- TLSH T175054A53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 825KB
- SHA256 7cdfcfd3bb5f4ad067b74b061f45a59e9d446bd797b7f1e3602f18f5fa233655
- MD5 217a3135c48a512c924ac2551f2fa4ec
- SHA1 24adb7537508bca6680bd7ea32e8072001c8605c
- SHA512 f9f8efa58b560159f4de167e337c514cc9179d1512ba377e056a86d7b9a634e3edcf46949a96c302ce32649580853250d5e79ddd86932e1795ff9d037a9f27af
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNab70:J/sCv7QExqatgl8beJTTx0yFyoNabg
- TLSH T166054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 825KB
- SHA256 6ef029d34286f48fd912fe97d6c44e3261ffcc3ef78260fbca1dc0dfa399e17d
- MD5 a8c4ca65dbb2fdc4801d7649c7ae95b5
- SHA1 50cb11d3048177626929eca46f5a9119d2358431
- SHA512 09c486512ff5e25695df9b493eac49ddb0c44addd0162dcd83da3d64b7e924e436f8fdf79005c82978112f4a4ea806080e40f38bac00bc885ecf8b1ced038e22
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaWr:J/sCv7QExqatgl8beJTTx0yFyoNaWr
- TLSH T1E6054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 825KB
- SHA256 00440dce7be623e7fd7c37d2a2aced2ce07cb584d04834745ac84566db65741c
- MD5 4b4ea7b8f9777a8c92a9b660baeff08b
- SHA1 2d0a62da14aa2b650bb020943c9fd923759da749
- SHA512 d7dc85deaaddebae5f630b1bd6de259449d7dcb0d3a44e5fce812a2057694b548d4399b54af27c647541bbc1d7bd5e63f3d6c6937ce763566f3b7007e0b26f03
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNa8n:J/sCv7QExqatgl8beJTTx0yFyoNa8n
- TLSH T11C054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 825KB
- SHA256 e70b08b6aca9c575808bd77daff221e3cbf0f722b993e7dca75839eb6cfe323c
- MD5 4e1af9f6bc4a1496091d783737c92eaf
- SHA1 c229cd63ed787481b9d3ba02ce2a3ee84161f01f
- SHA512 86d6cdf8853805f028f8750d9ff53eab0bdf3363265240e780ea34ccceb094cb0db81e83e2e4caeb4851d111338b09308b563856ef37c04ef28ce80e28fe3060
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNa6x:J/sCv7QExqatgl8beJTTx0yFyoNa6x
- TLSH T1DE054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 825KB
- SHA256 c1a3da1554a321621733b7f18b11361bb347440bcf56519cdb2fcb888b37ad10
- MD5 a7101dee4e1c2a8952ddef7e549a0410
- SHA1 0880bd62178c08a24bef45ee465b6d3c91af6143
- SHA512 1876897b039504a13ad38a9a28320373d6028d8fc397f555950fae0742ca13055bef3716395d69fed21eb00ea5c84ebd2e5c54012b7fed10f0d37f0930300547
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNa8A:J/sCv7QExqatgl8beJTTx0yFyoNa8A
- TLSH T109054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 825KB
- SHA256 b0439f01e5f140b8649ced6d82a3fa7d37a0acb7547c077c2fcd91f49cdb940c
- MD5 f9f4cac20ee1021c2674f8b6b16bb099
- SHA1 7b203112b8aa03beefbdc4dd8a8a04eb3abc85ec
- SHA512 43b231c399c41c46cbba33b19f45d5a65141f9b73e291e50e349ea897b45e64821321629b4a75bb795f9ebc40f7c88e8a1278063c8851d12a99959cb5f9839af
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNal9Q:J/sCv7QExqatgl8beJTTx0yFyoNal9Q
- TLSH T12A054A53BA4485A2D416023154EB4653EB71F81A1F11938F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 825KB
- SHA256 c42f1f439029bd6501a80adfcb916d82d23729c3d91bbf55c59393220c269aac
- MD5 72b8d017f1c24ffa31979276c1ecd5ef
- SHA1 2d812c1c45d0c729663b5dee4f53fb72e6410ee5
- SHA512 91e12c4a2a248c7373ac8862e6bf00bd0531e4fab57c0bc8e495d832a4fb774d4e8af02c3eb921ba3d55a4406b736a3bb6875b0caa3aa6e11bb134ee35fa5016
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaQ4:J/sCv7QExqatgl8beJTTx0yFyoNaQ4
- TLSH T153054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 825KB
- SHA256 23a9860f81a1ddebec0bd87eed1b40277ca383fddbca1dd9c0d466a6587164f7
- MD5 9e5e205d55649414c72403a606f93f55
- SHA1 bd20e94d2f0d2b1b4d7ef0d371b232fa6b588eea
- SHA512 38453ad16daf6d19df6102083591c150c445a25e72fcef293186ea513f4bb536e68470799705c2d89df7c4242853f0781e2f0396664ecedacb9a0abfa8e17708
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaTu:J/sCv7QExqatgl8beJTTx0yFyoNaTu
- TLSH T11D054A53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 825KB
- SHA256 ec3e4ea30e7e35ddbf269ad2ada5d43715909dad7e42eb4796e68394ca2dcbc7
- MD5 4cccafa5cc0355a8ec72769a4d091761
- SHA1 eddecc73651fa19661fe087f40c6959933b8f0c0
- SHA512 41ae09e338c7aa949ba2330b6fdb928b5a7504744b4a8b349a541af8d42ee88565c218cbfe861c9f5cd51bcd6867037bc6940ded95246a5b1100dc2bf69daf64
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaOj:J/sCv7QExqatgl8beJTTx0yFyoNaOj
- TLSH T1CF054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 825KB
- SHA256 fbfe9a9a3bcb9c3c2383430461cbce5044e9e6c790e3f4764f56ae9da67e6237
- MD5 733605469f35043e0a046eb9e4322b0a
- SHA1 874b935032a457ca3265f0d6c9a565f67154059d
- SHA512 85fca36d33b4cd4dbff2a6cf1288f66ddc4476dfa40b91ac5b9e7927af8fc825fa3b4955e11d9f9b76d442e6fae9cec64bb3c24fbe628cfd65d2601a6123a2d4
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNa7g:J/sCv7QExqatgl8beJTTx0yFyoNa7g
- TLSH T1F4054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 825KB
- SHA256 2bd065ae9a4e870a5d444a5306342300321b4f017f2b46e8640e42a43ca5a96a
- MD5 e5dc3b7ebe563b95ad43b4a4f05e95e4
- SHA1 45626b952be0a9c7f4271c542b7b66054b347183
- SHA512 c14e723a39d951e94c0b02ba14a669f23f0bbd7a039291fe03cf954cd7ba5dd6a8df526ada52bb33722bdf2d8470a09c19ec97287c5eb13afa58b8587a999d2a
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNamI:J/sCv7QExqatgl8beJTTx0yFyoNamI
- TLSH T145054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 825KB
- SHA256 728943b3f1819c1439f8e36d3d9159915da4abe4529d351b1f5f4435a6007b25
- MD5 61e8911116ce61f327a2e9bffb9abb4a
- SHA1 3ba8cfc682a262b6f65fcc34a1515d982d81f9b1
- SHA512 8ef1cb8805acfd7ecc0d960aac3d4a0f6a19348314cb257843e043ec5ebe4175d17bdda6b9146c4c4daa96e02b4758d6b7f42c5cc27fd5af943c27d2fd26e795
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaUo:J/sCv7QExqatgl8beJTTx0yFyoNaUo
- TLSH T1AD054A53BA4485A2D416023154EB4653EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 825KB
- SHA256 496cb6ba16e29e47880bb55b4559432cda53e4d5fff5a820b6682e47f03b3602
- MD5 56cb2b2db18c2e9ef2d74f5274a199fd
- SHA1 d977dbe8e05438effac600a1eb7bb701edd0c637
- SHA512 7cd1d5d8f8a4659702ae1815c2119593bb022b9904937b45fbf23d2f91e71f1280ebf4aa20e8781e3d7a04d8501fe94c5296a7606ab6addf2cc3f6f49b53bc71
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNa3+:J/sCv7QExqatgl8beJTTx0yFyoNa3+
- TLSH T1FD054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 825KB
- SHA256 abff2916e3729f5edb31e2943a1ede1c046e84cbb0affbcd29d456a18657d000
- MD5 36ddbc98d63de18b1d70d5cb0fd72432
- SHA1 2a24d2c857f1f4fd18e35cb86df74743220994bb
- SHA512 1c60ecc9373303685d4565157575c658dc480d98d76118a83a62d3ee726cdb6324ee3b5fd04474c24477e664ae977b8f32cde504fb5c7a47999f7a70ae90ff95
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaNQ:J/sCv7QExqatgl8beJTTx0yFyoNaNQ
- TLSH T10D054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 825KB
- SHA256 f0cb7b40eef252f24605a01b28462e64ae4bc3ef978f09528a822e0489efb1d6
- MD5 e3b8f88d2a325de298d524ac0c973882
- SHA1 d5f6e482f3a262a9e3ebacdc02a86612e8c872f2
- SHA512 22f01e8f25bad9fb8bc84c149b9a4fdb62dfece99da13029e9e6a0afec854f6999c5a15c09d0280c395343cb676b7898d377c5ee22c5a4612ce7279febdb0661
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaCX:J/sCv7QExqatgl8beJTTx0yFyoNaCX
- TLSH T154054B53BA4485A2D416023154EB4653EB71F81A1F11938F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 825KB
- SHA256 ea81c6a1c6d3a58276125b348e5fea5443d56b0620a59fdc10c1c1c6b89efdd4
- MD5 9380053009ab8a1417279d5962c0f31b
- SHA1 b5fdea8a13e835441415e09493a838b344da8139
- SHA512 806e06bf4313fe97d5fc6b7f65835874995950ba0c101eccc6fe8c2898e4d17052656f53eb1c81a36c9c6ac7d989f42a8d837997654ff9d27725bc87fcfe7247
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNakL:J/sCv7QExqatgl8beJTTx0yFyoNakL
- TLSH T1EB054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 825KB
- SHA256 27bee348f6bec85161e8573b343547ceab117e05427ac921556ac4cfa35cc52e
- MD5 593463a73607422f8a25a0d30493f601
- SHA1 204494068872655abe03a056079d8745c84a0d2f
- SHA512 b1cb5c1d1e8a524ae4d22bdcc69358241d8ed2c0b2790db76731eb4494d94d2efbb4b13b5f56995e062b93ae6a67b5970cd73e7e07add1b433a6c606e8ffac16
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaAFC:J/sCv7QExqatgl8beJTTx0yFyoNaAM
- TLSH T1E9054B53BA4485A2D416023154EB4653EB71F81A1F11938F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 825KB
- SHA256 f820effcad06d1c5b70177c0cec4b6a5ca6c17aad4fb3138d5e87ae33e6694dc
- MD5 a3429b56b09a8a415878c198af690b96
- SHA1 e694557f07af69c2577cd6e185294a27bc9c1a19
- SHA512 f2b1b4b3bdfdd46998c7fafb83c18d9487012312b19ac0719e6e14da14287ce720f7aee63ac90e186526039f51bfc7ae3c6b70caa17f3bfdba64830568b3c6c2
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNahh:J/sCv7QExqatgl8beJTTx0yFyoNahh
- TLSH T1E6054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\pingsender.exe
- Size 885KB
- SHA256 8c5d901c0bf211cff4c84fe5c27239e38daa1ff99a57149fa2396dc83477df3d
- MD5 aa9465c52f29b6b04c966c71b4d6fc75
- SHA1 b208320201d41ea872c6eda264371c82b3ea3b3e
- SHA512 b5899a098dbb739674d49efe4624de82a111b50e0b990d5be801e33257cd6914235bcf316920bcb76dfa7ba16a224d71f7b087dd4af56922894abc79c134724f
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNaAFdX:J/sCv7QExqatgl8beJTTx0yFyoNa+1
- TLSH T11B155B93BA4485A2D416023054EB4653EB71F81A1F1196CF23BC9B6D2F327F07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\plugin-container.exe
- Size 942KB
- SHA256 0bf0e15bd9264bff3baed7664b6e03a8bdaf38fefcbb4c72e953bf199f2ef609
- MD5 75c0d53ac0bf669b46a5d535fc9eddd4
- SHA1 74acdcaf319bff74c5cedc184f79a074e3e30e76
- SHA512 3333d0ff49e8aecfb152eeca48896beb34a9f440623ae9bc06612cb97cc664da9eef428075e0f6e9cf680a00c18246946e599311435a35bc353e42ba287906a9
- SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFyoNaL6Iam:NDqatgl9TKN6IR
- TLSH T130255B53BA4485A2D416423055EB4252EB71F81A1F1193CF27BC9B2D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe
- Size 866KB
- SHA256 707a8a453d2f2932b278cc3e6689923f37ec3e76a9667c54ae9137fdac3f6f50
- MD5 c515513b0fb1a0257ab28b308a8b8eef
- SHA1 a9463c4b22d71c428a2c256a24e2b30b8da2c605
- SHA512 1700f0d84a5b67bdeb76d36b4ff356e5a6057e1eec935d59429195f3fadd4e46f6867d9952c59a409a07c26e15b2cfe9918fbc071d125efb0d356ea3028c8234
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyoNa3Ihp:J/sCv7QExqatgl8beJTTx0yFyoNa2p
- TLSH T1D9154A53BA4485A2D416123044AB5652EB71FC1A1F1192CF23BDAB3C1E32BF17B3A779
- MD5 SHA1 SHA512 SSDEEP TLSH