Analysis
- max time kernel
101s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 20:19
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 778KB
- Sample260710-y34llaa16w
- SHA256 2e44680829ee46a7032504b324e07b7bb422a93a5df8cbf4e704ecde4b0e4556
- MD5 63f14df04f97d245fc4f9909e38588cb
- SHA1 3ce1fda671781a4b54272d9a6ddbb662ea97751c
- SHA512 0bdc52547e056ee95d220173a20102b590d6dc82773b41b8cb9fab13c64eae3157ab561cf64ba30f89a2740ee792f608c261ee7e7b69064501d404c09cbfc747
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyba:J/sCv7QExqatgl8beJTTx0yFyba
- TLSH T1FD054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/4828-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c55f-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b300-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c95-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019857-240.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-423.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-489.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-508.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000018a68-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-715.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-783.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-820.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-851.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-883.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1003.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1040.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1059.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1096.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1133.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1164.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1215.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1318.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1337.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1356.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4828-1671-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1472-1822-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 1472 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4828 2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe 1472 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_63f14df04f97d245fc4f9909e38588cb_amadey_cobalt-strike_conti_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4828
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 778KB
- SHA256 2e44680829ee46a7032504b324e07b7bb422a93a5df8cbf4e704ecde4b0e4556
- MD5 63f14df04f97d245fc4f9909e38588cb
- SHA1 3ce1fda671781a4b54272d9a6ddbb662ea97751c
- SHA512 0bdc52547e056ee95d220173a20102b590d6dc82773b41b8cb9fab13c64eae3157ab561cf64ba30f89a2740ee792f608c261ee7e7b69064501d404c09cbfc747
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyba:J/sCv7QExqatgl8beJTTx0yFyba
- TLSH T1FD054B53BA4485A2D416023144EB4753EB71F81A1F11928F27BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 3e6c980c969f77e228429f3f1537a3bae7e22f9a4ca8aeffe4d744c0c8a5a05e
- MD5 6b5001f27e9e698341f25bcb8f4f485a
- SHA1 0b510773baa1ab420b918a2c274fe6273ead991f
- SHA512 dfe134d4b8536ec8051c0906bfbf45c49ca772ec4ef57b08573b32de0af7c809ea3bcfb7b5ea50f637e79a4ed6a1990268590d744366ffb6189e95652c965960
- SSDEEP 24576:J/sCv7QExqatgl8beJTTx0yFybaP0Le5ji0hmxNrM:NDqatgl9TKyPji0Aj
- TLSH T17C555A53FA648672D0228175C4E79686EA31B4461B3086CB13ADD77C2F33BF1A63A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 793KB
- SHA256 443da4bc137dd282fb187db3600eaa0c924ecf2b8c525cab23fc618bef7cb3e8
- MD5 a1872ba41095b8d4c586f1d8be2b4837
- SHA1 1fb19db45637b02954665916c0300ee8fae32e61
- SHA512 2198497ef66396a9bd0faf280ba77c0b11829e9a2c92091621626c25d2cdd1cb1e40e0fab46f3cd4329450af13fa4ea94cf4446f0e4181858234a8d1830e3247
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaRa:J/sCv7QExqatgl8beJTTx0yFybaRa
- TLSH T17A054B53BA4485A2D416023144EB4753EB71F81A1F11968F23BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 826KB
- SHA256 bb2a87a52ab6d3ec6027ee0a3b15da845b9b5e5a5d558cc6e32f9cb988c44bdf
- MD5 4dc908b8795971610218b906d216d21e
- SHA1 7a4c49b6929dae75c1030965f4e7c1db3dd61186
- SHA512 a98c730146d9268e0cbb2f18dd84951d94a1cb075005e1b87bbdf894edfbc7da512264046a1a50e57c97d4af4c66aee64ab904a6b5ddd7d5828edc415999d9c4
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybayb:J/sCv7QExqatgl8beJTTx0yFybayb
- TLSH T195055B53BB4485A2D416023054EB4253EB75F81A1F11938F27BCAB6D2E32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 802KB
- SHA256 b8411ba51ed0bab5787ee3b4df09f5d1ef9c7135daf5dffb4c1960b79c5169f1
- MD5 ac7b511d7195b17b07196d4f56a86d9a
- SHA1 06d4c0cb94a15fcc712c0999b6199ba35065bc50
- SHA512 70eb29a5d76802e50093ccd7b0907347b32350ed3c6a2fadcaec9c2f3cde5da4b50203bca517edbfa86efda89bdce9d1a0189113783015919dcaee289d5ab1a7
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybao6:J/sCv7QExqatgl8beJTTx0yFybao6
- TLSH T13E054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 802KB
- SHA256 30eaad7542b09beb203f313e77edcb7a0b79135ab01686f0d950f67f14332967
- MD5 d0fe49ddacba27677ae8ad1d70e76ff6
- SHA1 2410cbf7d65439f35efdafe48203a21fe9b1bb1a
- SHA512 73e8576267949e7389339eb5b338329efe828bf37d53616b516af2ffa8ee2729762849202abf239d553794d9e1f02208115dbe4f5c0c82c009000f99bec23251
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybasN:J/sCv7QExqatgl8beJTTx0yFybasN
- TLSH T171054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 802KB
- SHA256 9fec1490d5102a1f7ddf9c18b5da77f3e702439dc87a6e48595e15fdca1f9b2c
- MD5 1e952532c6f1f498370effcbce99ed93
- SHA1 557d0463776d7af04840449d522d7144b377c991
- SHA512 b7219b0740014a8795db0474a017a9aa94e46369092e4013ae8c803dc0b129c5fdc3c924d06a03290cc5978fb9ca9eb545cd71583c87d7c67e6be78d30242144
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaif:J/sCv7QExqatgl8beJTTx0yFybaif
- TLSH T1CC054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 940KB
- SHA256 43087f6db48370bd874c6f206c67e9481455a1839097a4d8dd447d9db23cf65e
- MD5 b817a0599aeb71bf8d81b4305ec576ae
- SHA1 54c937ca1295f2f914d266194fe898b566a7ce4a
- SHA512 c9ea9aac2a28155bae1026dfa48e8cd652aec4a2cf84f774204003bc99daea80374ec6c6fb19ef66e0ed0e446d9fd4b0fbe47da3219d81b0d89734494c0cc070
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaQyPz5L87:J/sCv7QExqatgl8beJTTx0yFybahzy7
- TLSH T1A6255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 802KB
- SHA256 d86b097e054f3e4b93510189ccb594b2ae79f45b9e5d624e8a57ff6eeccc90c3
- MD5 27b76abdc48afac8108ee74a0f22a43f
- SHA1 f208fbb7a7d4fada2a6a57e796fbe96cdfc40807
- SHA512 b85b84fd51a3080076e2174367ab01195bf770e596e31dc21e471fbdf97885b6ef3aace1a76943fa1512f7e67c3cf9928d7e2f86cbae0bf106e0059542f8f56b
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyba8o:J/sCv7QExqatgl8beJTTx0yFyba8o
- TLSH T17B054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 802KB
- SHA256 26ff57adfda0bd884826972c4b9e91afd9a7433d508349c5848fc324e1e9d90b
- MD5 f5717fa32efcab6677a5fc96ea32cf94
- SHA1 d93ed996b468153f45708477ef0f30176076ab3c
- SHA512 6fe68d6ac9182d9b9720fc95400f0b1bc554be5a4d7a46e0c8d4c81111e6ebae43f310a5543e5f48d40311cda5e676bffe80dfba29c0a87e4f7313ad6879aeab
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybacu:J/sCv7QExqatgl8beJTTx0yFybacu
- TLSH T1F5054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 940KB
- SHA256 107422db1b6f425c7914a4b52929bf41b7a138fc852f1045e6fa7b0672378766
- MD5 3a1eca0921abe70fca354f2a088a29ce
- SHA1 38f83883665f9a7a9ecfceb71e8e2a9c97df9cc7
- SHA512 efb89cce3525cc1b55f9f5a42be2b6dfa6f3fea344fc261a5bd379f8ed705ffbff6b13c4b4f0cc8d3b2067b4efa731be73629194ba64d8acaf3824c1cfba0429
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybahyPz5L88:J/sCv7QExqatgl8beJTTx0yFybawzy8
- TLSH T169255B53BA4445E2D416023148AB4652EB71F81A1F21978F23BC9B7D2F327F07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 802KB
- SHA256 b9ec29e7df754a06291df7c2f16341dd5f923ba62cd98e1d470140207c221549
- MD5 c76966d578fa8811eee742ee08664433
- SHA1 3c312e4a2d84ffa3663aa1b63da9e0e848a26c45
- SHA512 0942be01391ad79252bede213e4990a24362644ffcd841982806d677e9e8b9e71f2ec0530ec305b883cfeb2968530b78017d0fe492a659cd860fd6a8f288df3a
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybag9:J/sCv7QExqatgl8beJTTx0yFybag9
- TLSH T163054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 802KB
- SHA256 2c3e62efd6be16128c58d91dc9e3daeee9a42068e025284f882fd1f111065fe5
- MD5 dc466ff6337c205da691dd502c5f3ecb
- SHA1 3fb88fedaefd981f3e65491ed957667612674123
- SHA512 8817e87b25e526fdf5731cf7777680b67f8f50bc0e99169ce904d994f36ae3ba709d7b854418ee2d1d01f3b9b7340826e0f80491c0b4eeb449a035e9ca891bb9
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaoc:J/sCv7QExqatgl8beJTTx0yFybaoc
- TLSH T10D054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 802KB
- SHA256 8e743247ef75a94ccc7db0f3c1e78e427c082f18f86da0d969930b7aaa28ae22
- MD5 0ff8b47f7d49b3b5e54ec98b51220a5b
- SHA1 afc6fb9602a77949c39a398490d64e873d55decd
- SHA512 698ff6633a5e05bf1788879278f3ac360daeab02bae661e26a2d0ee086b6b6b258ebf74888391ee96d7b621c70cd45ed641dc382f7003eebf1c32367edfa0dc9
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaBp:J/sCv7QExqatgl8beJTTx0yFybaBp
- TLSH T1BB054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 802KB
- SHA256 61785defa8bd3be450ec9837b9a8cd5e3dcccbcbcc2f55bfc7a4424cdd616d87
- MD5 4fa98cbe5ee20bc8bcf1066b01716b97
- SHA1 e9301eec798c34a51053cbffaba496e42a47ebd9
- SHA512 54a7db9b5984420f55fe2207133190190b5d75f34432885a3fe5c5cbea6ea81906d4bded4aa7c3ff845932ec85203790af25fade79ccb25eb036e17bc4bc92ae
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaW0a:J/sCv7QExqatgl8beJTTx0yFybaWN
- TLSH T119054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 802KB
- SHA256 02cdaf89bfcbbd9967f96254e49d3c4abf3ee04a5671ef4cfd71e64a416642d6
- MD5 7f06db2d5bdb4a58fc93635182603537
- SHA1 c08ae09c95edb05d1d666fd700b6c10180a77055
- SHA512 45023fc8a440d4c3e7ae414afed4a2d974097768868197fbf0142bf375516e3eaae2577bcde3f2014edbf9ecd3337dc9436e356813bb9c688906fa6fd4133e14
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaaF:J/sCv7QExqatgl8beJTTx0yFybaaF
- TLSH T1B7054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 802KB
- SHA256 6971d7d34a89ebf55060236df0fe78b15de61073195ca5dcc33aff2413048b78
- MD5 5f6eb3e7bd921017afdc2f78c1481a44
- SHA1 a251bea9308b42801f939f8b55cace29c85622d5
- SHA512 194f14abef09976cf8eb817b78223e2bd4e287419d73951120ff21743a1c55e7a1908214cd1c401f2996ed82c870f48c706bdc0bdfb3d0071c31c1e650b482fd
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybavC:J/sCv7QExqatgl8beJTTx0yFybavC
- TLSH T193054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 802KB
- SHA256 bf7d92a9b86d1fadef1482c023f1ab440a90942dbee98d95ed59316c96d24d0b
- MD5 2448ce7ae90000fa9f46c1478e9be6da
- SHA1 ac21dec3c5c568b08b2bf82d2d99915254d09228
- SHA512 604a0d9ab7bda750756ff56b0d46551e2a6465bcf69529e96db1a57b29715c40eb456b86a5dbf55900ca729c45142d637a809956220f92f4864388f1a54600bd
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaQw:J/sCv7QExqatgl8beJTTx0yFybaQw
- TLSH T1C4054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 802KB
- SHA256 aa3c8d541754ffa6af4f7fb46d2b081985af37816c8e31e343324e3c054b5090
- MD5 31fb060931a9d7debece561bc73e82a8
- SHA1 25ce1758aaf5e15c2f291dedce8792ec6a8e55f5
- SHA512 a654827c17391516c0652001f343d5267cd4d2ab28efe8085688a67bab5731d631f03c781ffe7c2bb65bc4334fa091e675505af20b123e4797dbb68bb79d64e1
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybavT:J/sCv7QExqatgl8beJTTx0yFybavT
- TLSH T166054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 802KB
- SHA256 02d7ae597bcb04cb8262d5af9dc0b42103dd780c00036be8a260d7a02c832d1c
- MD5 cdcbcc8f12ef5ee25545f4af62aac990
- SHA1 dff1031a1bdb28897fe1b9b5ebf317ea70a6410a
- SHA512 07deeb421220769a91629078206c2fb2a8e51b2f6f6efdc54efe9c680fd9346e2eca0f24cefb1f3778acc2d64dd890b4a52d7b6515516e27a87e96791b5749ef
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybapu:J/sCv7QExqatgl8beJTTx0yFybapu
- TLSH T13D054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 802KB
- SHA256 eb014063414f51b2bbc260d2fd8160662bccc47d4b3be4b0cc6655ca686bedf9
- MD5 0170625b43c4ba8ba5f2414610eceee0
- SHA1 2308372d62623b073004d103dd47d5212165bfc0
- SHA512 c3af30932b9f6c053bc495cc5b8b557f7f6682327469ce9c5fe476f9fd7d668833b6efbe14cd08b9e3f598ba0efbfb52ba65d5b6b96e1fe7548a868527a16f40
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybahb:J/sCv7QExqatgl8beJTTx0yFybahb
- TLSH T1B3054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 802KB
- SHA256 3c4e32159ef82418322cd2897b994b450b5d8dade5373a89b00cb1c096c2198e
- MD5 6d778238a43092f024bdbfcad1ac20d7
- SHA1 ff7031b549ffd7e749cd671be20ad7bad009a646
- SHA512 c126b91225bc8ec23347d3f22d1e67f8357cbad024db8cddf7b1704084530a8dda4f34a54b4b7a58380d30bd923d857117fb59b57b40c0b78144be27a3d6d692
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybapf:J/sCv7QExqatgl8beJTTx0yFybapf
- TLSH T167054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 802KB
- SHA256 ed1e618fa718311e5aa3da45c880c2d25007aad08f09ab054e3460edc792def7
- MD5 056550cde53c8bcecfcc8ca91209f86f
- SHA1 6743748c5aaa0a381102296230a418ff867d5aa1
- SHA512 83ad54b97990e5d52807cbbbca1866896f21b48b50aa85ec487f2fad04a9953909d7f4225e0ecf4f90a52c4d3cc5da31e38f2372caf9df350845bc2051fe9c72
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaSK:J/sCv7QExqatgl8beJTTx0yFybaSK
- TLSH T1A4054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 802KB
- SHA256 e8064e1af23b494de786d77946f7a20ac1a7a5cc142a600a681ec5ceac64600d
- MD5 37933a56339b955e483dff19db4478cb
- SHA1 cbf9fd42627d63fc5ccfc33fabdfb279c093ffca
- SHA512 ea722715faa14a2cd9eb64cc8666d37acd079a3a570b6a8d6add39a7b26d80cc8688c619156c8c24e77ab158775da9b72022c9b4c0ef776fbd67f5dd6ee29114
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyba3k:J/sCv7QExqatgl8beJTTx0yFyba3k
- TLSH T1B1054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 802KB
- SHA256 7296a955e48be8d2ee6e2801089c8612105d870acfeab35ca39f265ecb5c1279
- MD5 7438b699ee3cb25aab4e33487c84e58e
- SHA1 a52af19489df20c10833672997ece93599ab8f0e
- SHA512 63cc16f54ec9c7d8ad99779c9dd651464f11837a1c2b2f622cbd1dabb82490c3136bcd1d48f2cb46631ab4593dfd447ab936b8231ccfeceb959d4b51f2cd5ce9
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaA0:J/sCv7QExqatgl8beJTTx0yFybaA0
- TLSH T198054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 802KB
- SHA256 2fc68dcb5164c81fe8bb19acd47c74ba5320ba590682ff7a23c1c7817fb2dbee
- MD5 2222d1c675f60da5b3e2a81ab286368b
- SHA1 5cc8655ceb65b280db278b930399b1d63eb28ceb
- SHA512 ca78b9ea841d33c3bef0a17e2fe4cf97b2e05874ca07f22a1cba4b928140f21783b4dc495a451e76c5c2d7d25d8d35e0bfd74fc38080a974a930b30ef52e3f25
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybab70:J/sCv7QExqatgl8beJTTx0yFybabg
- TLSH T16D054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 802KB
- SHA256 32b0b88509b1387aec0d2b1881b6bb692327932ae30f00fd06fdf782dd5c1dbf
- MD5 daabe2da295cd2f780916439c41a69c4
- SHA1 9fc5077ebd9f6bb8a8354464ed380552a0814da8
- SHA512 3c73dd8e5a7e1a07b6249398a7fec79b179c13e26ee6fd57425987ee20967661fd1267409ca3a0ddfa56cce4ca28a8111f4de59bb3a74c7b92be9ed59f72fd37
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaWr:J/sCv7QExqatgl8beJTTx0yFybaWr
- TLSH T1E5054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 802KB
- SHA256 713bd3eac864e652aafb6eb21504d97f3a282b5d59aa0b0054f2921a2891632a
- MD5 dbec7944f95650b96eac42d8c308f09b
- SHA1 d8893c220aba20c9a4feaab36ed0159278ddf876
- SHA512 d89aaf708cc9c5d0ef628745c932b9cf90449cbe900920e8f50098705cef73b40c41d0e50452ae4cd419cc2d2d3009316a818b674c2f7112ce1bca5082a55e21
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyba8n:J/sCv7QExqatgl8beJTTx0yFyba8n
- TLSH T18F054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 802KB
- SHA256 431c64a82d6f15f4382bcc22e9c9d3b7c1ce5ec8e806e9278eb32c433d00b7ad
- MD5 f687650590cbc0fdd68303ba9c309bba
- SHA1 4eb0b5ed7d7319219f23077fdf92226106632732
- SHA512 9d7b95bd0de7fa035285092a650c7b6f13b7fc505703af19ad6b84188c82fee21da141fb40f38d2805efcce217c17b3213e0c0b04401a97f5288a976501aef6c
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyba6x:J/sCv7QExqatgl8beJTTx0yFyba6x
- TLSH T18F054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 802KB
- SHA256 fe8e318ff9845f305e681eb1737c9ca19dcd54e050da6373414a5edfcf44384b
- MD5 6e46f38ee1bfe599eb6086fe66c3bae1
- SHA1 4a8679cd1edbbcfc86443f04599f5d1c642f8e9a
- SHA512 a9b51c2efe777f42e67f588da6abd6d1f8e0e2a07a2ec4d9e589eb6ba590cc88e1faf2914ba1eaff01d08cc284487495204360b092e025781e8504fb830939d2
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyba8A:J/sCv7QExqatgl8beJTTx0yFyba8A
- TLSH T1C5054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 802KB
- SHA256 f22fa023e5fb34188ffd294f6770e0b35c55d10097d6b669dc0ff7a5259c0154
- MD5 5603212c37c9128c2d092ed049d2f5dd
- SHA1 1be0ab7aba64c8f0e9004f0e72c2ed42f3d50333
- SHA512 0835df933445e38e470e8214043a617d609d1c3e007488b26f783d212043a9233cbed73fecc0b3e0190d0fa8596b92daed6377433c4fdcd9d5e4d25edd78cc0e
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybal9Q:J/sCv7QExqatgl8beJTTx0yFybal9Q
- TLSH T132054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 802KB
- SHA256 5e7283ca0c1c40b9011b732ee67afd162bd3151bec522ce7f28c391cc808032c
- MD5 b9778b0414e632b2ac4b9cc9e2005ae5
- SHA1 0aabf9f0cc4e5fc970ea61ac3a662b885959fcbb
- SHA512 68b57d7abc209761caa140ae5239c12a142e8be563d6eee14e67087e2ba415b96d9abddf3e2b1e97201dde37114e861862b59f164eecc14bb46f5556a5926520
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaQ4:J/sCv7QExqatgl8beJTTx0yFybaQ4
- TLSH T123054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 802KB
- SHA256 dee2df18e3f1eb4a325cafa82989d0a93a046c4b014abd6a4f1311f31e9cf229
- MD5 1251b945b43a3776c0b131437663dd2e
- SHA1 d427eb87a846f9753200493a197337a4926cadac
- SHA512 0deb56035f726aa9613938b9954aca55540738ed809bb48f2bab1b32cb167de46a41ef4d89577bddfd47fef957c0b534765eec4e834d08d3ab316ebed6e0df58
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaTu:J/sCv7QExqatgl8beJTTx0yFybaTu
- TLSH T14D054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 802KB
- SHA256 0b611090efb51b3b21d8103a920d3695d21fe2344988afd7ba8001f1a111b711
- MD5 1efe5ff36c437d84579fa39f1be212cc
- SHA1 5de341b63947ef9cefcb9905c71a565ea263f5ab
- SHA512 08f088033a8a0896a7d2d078de0a2bba35e62ff12f60c1011d1eb162894b387d8ef5dcf485219748af10ef65bb63e3a20beba73b575983932b644134a3d1f2ea
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaOj:J/sCv7QExqatgl8beJTTx0yFybaOj
- TLSH T1DC054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 802KB
- SHA256 4a252d2066252e91ad2235ccf43c1498a168cdd8bee41947bfabaec7f97d1781
- MD5 d88116877e7453657a4a032074f46528
- SHA1 0feccfa0c016679b6ee1cf9002feeb0607292e04
- SHA512 797bdd2fe07a4a905aaffbc3276da9f1b93f18b8a2c0432f3a28bf150d710a2e4dc89db99af204410dad8bbcc1e6767cf823fbe74deeb7eb50172ebf31bac155
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyba7g:J/sCv7QExqatgl8beJTTx0yFyba7g
- TLSH T1C4054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 802KB
- SHA256 9e4869e346b8649f83e5b286476e50fa032c5ed611c2f974f2ff7a711666ecb0
- MD5 9a7f8cf847d0264f870e2108b3a9ae74
- SHA1 0b4b178f66506309a4cb6c152f98bb1848ff82b8
- SHA512 68fcdf36bf2b4148f4b842f5e5a0a8e178c0c0084a7578d82e5c1ba1b29cd3ce203a68f8440c5dd2b96747099f9c5108ddb8c828e7b8c22d0077d302711a8802
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybamI:J/sCv7QExqatgl8beJTTx0yFybamI
- TLSH T1C0054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 802KB
- SHA256 991440a1508f489b05cf34a51cf66dd336c23f37fcab84cf3544af02b3637102
- MD5 17e74ff282ee5734636e6046c7a16ef1
- SHA1 f9e9a085585ef1b0e4c97aac8b15dc5fd3a44650
- SHA512 ee6adc2f0e72932e016e9dc228704070698cf49062a68c9b31b849afaf9031acc701288b76e80f9241712a75f5d270a576e22b7b330966c19b6af00db6eea035
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaUo:J/sCv7QExqatgl8beJTTx0yFybaUo
- TLSH T10D054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 802KB
- SHA256 9e3a6bee473a9c0a75b6bf4b9d017a2c4d63b53347d0a30610c49417e54b0c8e
- MD5 7ae63a64caaeed6935253eced1c7ef1e
- SHA1 d96519186259bd5ffddffc83b260689fa4f86483
- SHA512 56e1c164dc3adc5e5d1e326af716674f8e96441fd73bc0a9a56db7d2c6b2ccf080c5533269c2915e78616efb40e70603b408e61f832d02d939d114c180bb9a7a
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFyba3+:J/sCv7QExqatgl8beJTTx0yFyba3+
- TLSH T199054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 802KB
- SHA256 af557476d5218dfe57cd48aa66a6bc4224362f025dec925a246afc242dbf4801
- MD5 9377fca1ed5778992a2ed76df778b5b6
- SHA1 37aadc55c5ec91c65227722148b0a0d4f663bafe
- SHA512 938aa2f1fc5e94e12de55eda4c674ce789bd4ece686354ed17f9d125ba3a7f3700a13685ac869e1ee46eb4a1cb66ee3b0ea40ffc516e68fdc9f001b18d8721ae
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaNQ:J/sCv7QExqatgl8beJTTx0yFybaNQ
- TLSH T1E1054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 802KB
- SHA256 501acc03bc73039912a7dbc226387f89ae57f74e2f30ac51b3959f8096fce5bf
- MD5 1e09b6ef5e32414abf4c601641872765
- SHA1 beb134e60b4b5a4ed20ab6d331073969ced6126b
- SHA512 6ba8d443c2629656127e93b549e5647e22c189c0ee3cfe25adcaf41bc14be1056ca93e95396de9e29583e12fbc1f2fbc50924888870d89c8adb700e83e35877a
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaCX:J/sCv7QExqatgl8beJTTx0yFybaCX
- TLSH T1A3054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BCAB6D2F32BF0773A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 802KB
- SHA256 15d484758a841dd99023fbfbe2c1c5a884337f69c9a3b64c991030219a64a57b
- MD5 898d663a2a233a97a4a0e1f215081f6d
- SHA1 1e6be368a8819d70f34b06d4e13c70ea18081ad0
- SHA512 5f595218dc10ec1609c2008d491fadc1dfbb4a28f82a24a008b4c37b28c0ebf9c07b093676ea14ce57ec3c29624b34ff0c8af6b1609e6683ee557b9c47e00991
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybakL:J/sCv7QExqatgl8beJTTx0yFybakL
- TLSH T11E054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 802KB
- SHA256 e484f569c7424cbb2749f4ad1cacb89d53d4b48d044ac69d8309d11f97130d54
- MD5 fbc49a29dba61778b432f4034e2db98b
- SHA1 9067c55d9074c8d7206fb9540d83ee699eaf10ed
- SHA512 a9519a33378863ea80143a70dd07bc84e8e5422e007e8c50eaf8f6f6250d84b3cc17625d2c2a73554c2331a5935cbc9083d63df37d9aa75fd61f7a3da0b01e3c
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybaAFC:J/sCv7QExqatgl8beJTTx0yFybaAM
- TLSH T1FA054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 802KB
- SHA256 f7a02467688730c4504a1830102fb93372a591b1d8355097be229b1c03285be2
- MD5 8cc96be6454dcf6ec5e3df3d15bec1a8
- SHA1 d7fe4ec43626d4bf56e9a857bbc7fb76a620747e
- SHA512 fad83b90be620f95bc8f900ff89956ed5386094ef53567653a925c5bea363c1a315173bcb6a034bcee8c775b3556f6cadc9ed9bc40c01c888534ea9f293dc71f
- SSDEEP 12288:cPE/72wcCvRR5O+BeDuUlEqatglsLbePRx1Tx0yFybahh:J/sCv7QExqatgl8beJTTx0yFybahh
- TLSH T155054B53BA4485A2D416023154EB4753EB71F81A1F11928F23BC9B6D2F32BF07B3A769
- MD5 SHA1 SHA512 SSDEEP TLSH