271a7305bf51e03eefa497eb03333bff90a8f457c384771c0818f87c050734d0

Analysis

max time kernel
92s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Size 897KB
Sample260710-sscr8set3x
SHA256 271a7305bf51e03eefa497eb03333bff90a8f457c384771c0818f87c050734d0
MD5 430dd6da2099c9d3df56b9cec84d3dcb
SHA1 820943e41a1022680066569ef03d49160a8a330a
SHA512 b3b28a2b09d4d3605462d8f0cbc83e446b95caa4fba109d82f1148decbcc9a23d46f28c560345577c323276462c05436250aa78a0e50907c30bcaec4a5cb4fc7
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Bf:bHuHNgHg1flT/Vk3HYwLfU5Yf
TLSH
T17C157C63DEA498D2D6A648B0CE96C701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 40 IoCs

resource	yara_rule
behavioral2/memory/2728-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c51b-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2c2-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b2e5-45.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2728-166-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d2-239.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3236-240-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0014000000018a52-259.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d6-446.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d7-495.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d8-586.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198d9-617.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198da-672.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198db-727.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198dc-758.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198de-796.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198df-846.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e0-871.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e1-884.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e2-891.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e3-904.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e4-929.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e5-948.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e6-997.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e7-1040.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198e8-1059.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ea-1121.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198eb-1135.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ec-1166.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ed-1179.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ee-1180.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198ef-1211.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f0-1320.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f1-1339.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f2-1364.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f3-1371.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f4-1378.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198f9-1392.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fa-1394.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x00030000000198fb-1395.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 37 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c51b-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2c2-11.dat	aspack_v212_v242
behavioral2/files/0x000300000001b2e5-45.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d2-239.dat	aspack_v212_v242
behavioral2/files/0x0014000000018a52-259.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d6-446.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d7-495.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d8-586.dat	aspack_v212_v242
behavioral2/files/0x00030000000198d9-617.dat	aspack_v212_v242
behavioral2/files/0x00030000000198da-672.dat	aspack_v212_v242
behavioral2/files/0x00030000000198db-727.dat	aspack_v212_v242
behavioral2/files/0x00030000000198dc-758.dat	aspack_v212_v242
behavioral2/files/0x00030000000198de-796.dat	aspack_v212_v242
behavioral2/files/0x00030000000198df-846.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e0-871.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e1-884.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e2-891.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e3-904.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e4-929.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e5-948.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e6-997.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e7-1040.dat	aspack_v212_v242
behavioral2/files/0x00030000000198e8-1059.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ea-1121.dat	aspack_v212_v242
behavioral2/files/0x00030000000198eb-1135.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ec-1166.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ed-1179.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ee-1180.dat	aspack_v212_v242
behavioral2/files/0x00030000000198ef-1211.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f0-1320.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f1-1339.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f2-1364.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f3-1371.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f4-1378.dat	aspack_v212_v242
behavioral2/files/0x00030000000198f9-1392.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fa-1394.dat	aspack_v212_v242
behavioral2/files/0x00030000000198fb-1395.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
3236	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$	patcher.exe
File created	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	patcher.exe
File created	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	patcher.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe$	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	patcher.exe
File opened for modification	C:\Program Files\Windows Defender\MpDlpCmd.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	patcher.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\BrowserCore\BrowserCore.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\SystemSettings.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File created	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File created	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	patcher.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe	patcher.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2728	2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
3236	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_430dd6da2099c9d3df56b9cec84d3dcb_cobalt-strike_elex_glassworm_hijackloader_rhadamanthys_stop_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2728

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 897KB
SHA256 271a7305bf51e03eefa497eb03333bff90a8f457c384771c0818f87c050734d0
MD5 430dd6da2099c9d3df56b9cec84d3dcb
SHA1 820943e41a1022680066569ef03d49160a8a330a
SHA512 b3b28a2b09d4d3605462d8f0cbc83e446b95caa4fba109d82f1148decbcc9a23d46f28c560345577c323276462c05436250aa78a0e50907c30bcaec4a5cb4fc7
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Bf:bHuHNgHg1flT/Vk3HYwLfU5Yf
TLSH
T17C157C63DEA498D2D6A648B0CE96C701D735BD610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 1.4MB
SHA256 5f4b4f01ec63fb1a3fad71d37c9f38415e2eb74ca448c4d460deed734812a568
MD5 3be6798a02c1e796c604c552f679fbcb
SHA1 c8236064ed92ee4a4c0728e38993135265b3f7aa
SHA512 7797b1c32dfba99cf8c6782d31dc343dcf40fe3f4d652133662b786cd8a45bc60e3cce5aae35a73eeca5bc8c3ba3c01d731e90751f42449fcca5d3efbf16393c
SSDEEP 24576:bHuHNgHg1flT/Vk3HYwLfU5YL0Le5ji0hmxNrM:T2agnTkLfUiPji0Aj
TLSH
T1C8656C26FA7486A2D0B3C4B4C9D2974AEA717D910B3086CB9294F32D6E337D15E36731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 911KB
SHA256 161e27c10816bd9967c2dc8814758a086ffef70577ffcac546d543ec7e7a251a
MD5 a0a0354794059f1de67a207730e135cc
SHA1 73d4100b6e961ab8e7864a5bd3e042fc7c29a2d1
SHA512 cb4ac1bf2e0492dafa30937a4532037527b97639c753c2706a202022eda00d5485c8e710b7a0d536b25993061334ff332b9eb0ed08ebef00f95b831f1651d1c8
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BNa:bHuHNgHg1flT/Vk3HYwLfU5YNa
TLSH
T12C157C23DEA498D2D6B64870DEA68701D775BD600B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 920KB
SHA256 e2a307536fceb97d6b102150b95dbcac9b05db63f15d06dbfcb1bf38ea0062e9
MD5 0c36e74ff435bfaf5289434e53747b40
SHA1 b2fd387179134dfc86193e3fd4c63dc27c222913
SHA512 6f7b054d248bc2f3409c1caab7f58517f18cd77a44ea1b37a5327e44c4437c7a2afa040b4bed0f52542b3eff83e33f1b9f3870bd627c5833b65346c397f1f3e1
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BE6:bHuHNgHg1flT/Vk3HYwLfU5YE6
TLSH
T1FC158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 920KB
SHA256 dc3388683f9d470c96670a7cbac4a8c979f97d1ab1d94967150d71c8e2c5dbc0
MD5 babed217145fe339fda3d7e2c4e489de
SHA1 716a479ba1d866b56794d294e2a0a96f047d0e0b
SHA512 627a7423f749800b60316440ef83718a3dc4b92f87f6e07dc2c6b30068c407816d3fa40c6a5b68c73c13c40054f14b49825dba8889c4f0f41f68eacc52b3d45b
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BIu:bHuHNgHg1flT/Vk3HYwLfU5YIu
TLSH
T110158D23DEA498D2D6A64870DE968701D735BE610B1193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 920KB
SHA256 143c384b02a161b59cf1fbbf4b52da5ed00aaded779bf38fd4562e5b36c2dc54
MD5 58f6ddcc236b6de5210e84835e422162
SHA1 a1d1ba9020eba6c4edad8c2e0d7bf1d884068c20
SHA512 42a3e0943cb6dc21fcfea21ff0b4f03919f09de652f729e8733528c4fe63190b53ab4b9aa2a1add83166cf708ff73599c4facd72613836501bebc46fab708561
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Bc9:bHuHNgHg1flT/Vk3HYwLfU5Yc9
TLSH
T16E158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 920KB
SHA256 04f9424e7dd3436691a9a7a4fe8bd32412a558056d6888614a7f0527bb618f15
MD5 06418c1ab293a7db2bcb9f7bbb2baa7b
SHA1 a207293453c89d63bd6294f95d9b55a30c2036a8
SHA512 b941bfe23c1d23357432a4c81a8f1f127e8dd49b44277909e9a3465d3afa7edd0286b41661888a2ff056c9414dc6a9b55e3f14a4fc9b7e70f2282d20841a8bbc
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BEc:bHuHNgHg1flT/Vk3HYwLfU5YEc
TLSH
T114158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 920KB
SHA256 2ab5e033f6bcabc8dbc1d004bd155a224e1a3aa8d610eef1f7c6a294ed688711
MD5 baa6fc3ca9e1fedea3d2c68bb10c47f9
SHA1 02e5e7b213056cbfc479c6517874f2a8d28bcc75
SHA512 b2059110ac64e11b45abe9dcd6ba4d6a9cb010a90463fe4540a500961bc22efe035c5c0576cb6bfff9cd064fad787732cbe5acc460532ec0862f408b46278ea8
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Bdp:bHuHNgHg1flT/Vk3HYwLfU5Ydp
TLSH
T131158D23DEA498D2D6A64870DE968701D735BE610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 920KB
SHA256 3aeef6306d84878848bb4ece2f089908fe3c69a73ec083883b8fcc5db54e83d5
MD5 9b78e647d40251e3ca245c9cfcfbc6f1
SHA1 4ced7ea9d607b01d090377887ed84363ffa9f64c
SHA512 a800f77c1bea7798a577bece7b853ad9644d59069cbab2b43811cb212394a0db0c59cd4e4c06e731cf88598331acee72616487af4b09d1f1974d34bfb0475a88
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Bi0a:bHuHNgHg1flT/Vk3HYwLfU5YiN
TLSH
T1BB158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
Size 920KB
SHA256 61a008ed9bad6596f8d80f5b478a4645e2fc97d01d3cde93889e880b287ee3ae
MD5 32a810900f445a0a71fd774c697896c2
SHA1 64e443d2f6fd291237f53bf6ebaf136d9e66ba9a
SHA512 ad945cdf2b54f02871ba1f881b8ed3379f6169f2c8be0fa0526d4358980704f5692c359a4517f9f86604b8ab683e6c10198dfaa0734f2e09ad897204fc85c8f3
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BGF:bHuHNgHg1flT/Vk3HYwLfU5YGF
TLSH
T151158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jinfo.exe

Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
Size 920KB
SHA256 75b915df7fe2f21121d29d6bcb09e9c9d52661ea4865daf59d28911dfd5da218
MD5 3166bec815e3bcd58ec2e5db1c0a1d5f
SHA1 31004ccde719cfddf1d653d43fd163942c48d125
SHA512 89b73797a727519e15d35f2aefeef1920a43527dc76c6e55883969f7e25fe63a84c99a24567643af2c7d7ff630d037ce4e2a218a8aed2fa1e62aece6001a9b07
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BTC:bHuHNgHg1flT/Vk3HYwLfU5YTC
TLSH
T158158D23DEA498D2D6A648B0DE968701D735BE610B1193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jjs.exe

Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
Size 920KB
SHA256 363483659cfec293a68ebfe80863e9b3c9a0c41a9be436fe49356169d09bb613
MD5 050ecbb66bbb25920d7c0f210351cc6c
SHA1 cadb0b7032996be79f384d1e8cdce1db1ac699fb
SHA512 0b5f2eff66096f2af95270c4f1841b3b6c532744f086db87911a7b49db04473d233b7407b544a73490b0d4b89a014398900a1db892da68b1106ad54c46fb0845
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Bcw:bHuHNgHg1flT/Vk3HYwLfU5Ycw
TLSH
T18F158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jmap.exe

Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
Size 920KB
SHA256 0c1c2227a0dbbe9384512d45444a1c9ed9fd42cd1ddedc8a61111305b0f344e0
MD5 bf30800af409a578822a38bf5b313ec2
SHA1 d4f410b7dc7c2b7b803a74f7c34625c07ca9a618
SHA512 cc1d47d5b5fe4c02d9db697956ce214985337aacb419b37a94039ec5c6a2e579b75e8fad65f9766b9a859369226223232f838f952f13ef7e9fb79779fe09b77f
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BTT:bHuHNgHg1flT/Vk3HYwLfU5YTT
TLSH
T1EB158D23DEA498D2D6B648B0DE968701D735BE610B1193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
Size 920KB
SHA256 3ccac0ad9653c819ba869c7c84ea764c08a0f69c09fcbb38c856a176acc063c5
MD5 2a5150ad4dd1245f3c9a584c66c2afc7
SHA1 d7f810c11818a7daff9ca08cf8fba5b3c1e9ba1a
SHA512 a6700aa0bff0eecb8d2b063f6c94ffd79d83f3242cc6127bf7008131131c726284cf2ef16e443651c15b25e7527402a1a9563b7031defb0a543ea8ac569a41eb
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Blu:bHuHNgHg1flT/Vk3HYwLfU5Ylu
TLSH
T1FB158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jrunscript.exe

Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
Size 920KB
SHA256 6cb6378aebcb956b5af7f48d7615b0a91a32b64ee27e4ac0cf43cd96efc19279
MD5 eaa4452ffe3e2edc422b837bca713334
SHA1 91bd39ec51470be6541f4233a3627594f39639a5
SHA512 55bf3daf8c2af543d24c8280d8bb70f7de7bf4302b3cad5484e7e7dede9b920811de9a9c4738d66c86ac796323ff350d84b6a2245ec5ce9f8da46188583bf37b
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Btb:bHuHNgHg1flT/Vk3HYwLfU5Ytb
TLSH
T133158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsadebugd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
Size 920KB
SHA256 d99711f62f373bd7d3e172459d451826e30fad6b60bb4e61a24230420b617a03
MD5 f24e11a5d0cccd207b8200596312fbaa
SHA1 4283bf8b6c4121a81ed26de7894325878e9cbd63
SHA512 72c975ee3d1e0bae58d93f94c4bbedea5df1df3fb33cdee84e9be3e3ac8dc36fca587e12c636fb45b79dd343bb4f21dc1ea2dbb0a9b8f544b6ec3b6bf026e2ce
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Bdf:bHuHNgHg1flT/Vk3HYwLfU5Ydf
TLSH
T146158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstack.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
Size 920KB
SHA256 d04d7fa16b2a98421fc1237dbcd79a87efa2e6b52caf47355f5e1906dbdf692e
MD5 082d7375fa9952eac3c276d71d050305
SHA1 74c4d620543487a1d1d97a80d0077c3db5b6f2f1
SHA512 d5794696eabf6c589a3fd1a780b9126ac25b1084066208242b3c1646d25b0812ed421ad8e4e42ea4dd9cb5ab4c1b7a5d51183a969e96c1670b40ec0c794dc3be
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BGK:bHuHNgHg1flT/Vk3HYwLfU5YGK
TLSH
T1BE158D23DEA498D2D6B648B0CE968701D775BE610B1193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstat.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
Size 920KB
SHA256 270b5269c6936da50d61cff36075768a16fd1b6baa81c8090ceac768868375d9
MD5 3e541b66c3d29f3bba7c4552b9d8adc7
SHA1 6132dfcf44d288c360795fd96b2c041ab11b6bab
SHA512 d22cd4907f2df4e21ade00fde56eee25bf0bc0d4c719379d664fda82d2bdb876bbe09ef413ec3d4a76c73d2d80384b98c08f6235d0401b181b23739ec7cc73ce
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Bzk:bHuHNgHg1flT/Vk3HYwLfU5Yzk
TLSH
T19D158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jstatd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
Size 920KB
SHA256 69d8b4801c58e3e3914256bf55194f982eced13abfa6da2d5a1c071ff890e675
MD5 d5011ca5aea6ffc36a3d7d287d6a6268
SHA1 f2bd0c1ffd28222c24503773ff2dfa0066e5dba7
SHA512 32ea01c384a157d9d564099c2fce37ec9dd970b711e127f0c34e811de277ab4ada808ebf910d6c75719af5b5620136ab5afacc49ba8e52d81ab8d06ce56fdd1f
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BE0:bHuHNgHg1flT/Vk3HYwLfU5YE0
TLSH
T1B9158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
Size 920KB
SHA256 dbc8bcfce89d930169ce89e447d919a7ece65ea7194f8f830bb26d7d3162a033
MD5 448842aee68ea111b326a51fa9716177
SHA1 b76521d8982980e376af4b43c7129c47f2b31ae2
SHA512 43fd3bfe1345e72fef99a381157c496e3b47ce526242a97b0259b7cbd345286c1e33a997e03b953d8dbc2bea9c682d85b43e895e15abefeec34865b502c7205b
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0B/70:bHuHNgHg1flT/Vk3HYwLfU5Y/g
TLSH
T1FF158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kinit.exe

Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
Size 920KB
SHA256 7be81393f0beecc25675c051b32b75ccf4a9ad22754e469bfef1b73b6bc0f8e3
MD5 fde882afba71b8a7b9ad0804cb53bbd8
SHA1 7384f0bce5bafc11572497a4e54465f43f6a430d
SHA512 754505ffca705e5e18e4d1a974fb194b448f16d9734e716928884e53a7bd4ccfb21f4335625f7686b3ee12155f5a9c3c5e3856f2df204c79e2e20088371f08ed
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BSr:bHuHNgHg1flT/Vk3HYwLfU5YSr
TLSH
T1F1158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

klist.exe

Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
Size 920KB
SHA256 b473facf932e2d6368aa5d641388400ab6a994d24a48f8a479486de0dd729c5f
MD5 178f31ae79ceaa8b2eee60855743b255
SHA1 6a11170d4582163e644974a71acdc0b96a80b891
SHA512 475ada203d15d94fe6ad0570e6008ba50b7f3f63bddef9080c790e63f7d307de280e2e44e7cdab16561d652b84bdc081e37f5076c339b8e74e4d50a34dc4c225
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Bwn:bHuHNgHg1flT/Vk3HYwLfU5Ywn
TLSH
T18B158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ktab.exe

Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
Size 920KB
SHA256 8187acffda10dd02c12332082869d6d695929f815742a477dfa9c476dd21fff8
MD5 bc3be00c16b34dbc224caf2213b38911
SHA1 43deba42f6815fccbc95e7bc5700ae2430c55bae
SHA512 be38d43681266b07c1a0aff9b4cad0bd92ce1fd4ad6c432fb23c7f0fb3a2af41c566a59e8dcc5ee2c8aa460e9d82f96ba0b0cb6e66a98c6bf68e474262c4a779
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BOx:bHuHNgHg1flT/Vk3HYwLfU5YOx
TLSH
T1DF158D23DEA498D2D6A64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

native2ascii.exe

Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
Size 920KB
SHA256 0e3ca65fed6491226a70ba6556b4ad008b328446a9d25c02028203c163154f7b
MD5 78764dc596415c74860154af46cf16c9
SHA1 8f81987e82cc5b9e9bf5b85430650879972424a8
SHA512 46d82dd242259f21930a7ff32b12bc44f39340ac6bc731f9ff42f8068788f64497e8bd2be631bc6884ab9339f169631123a3b1782a2ce771fab5d23cc6246e59
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BoA:bHuHNgHg1flT/Vk3HYwLfU5YoA
TLSH
T16E158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

orbd.exe

Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
Size 920KB
SHA256 a416df7211708160168a4aded16daff40618ab11e6894b336e8d2b161930f8cd
MD5 7104c74e46660bb9eb76693a80ee5c03
SHA1 6b4cade8199fd7e59a37db7883b8397b36444b84
SHA512 b7fa9f0276ecbb6c50e2db09f85bb3ee8c28f57896ddada29dcda4ba098471cac4e82e31ed213c46a0d00059d02d6eb1a2f773fcb44dc5cb899a10df346fe4ec
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BB9Q:bHuHNgHg1flT/Vk3HYwLfU5YB9Q
TLSH
T149158D23DEA498D2D6A648B0DE96C701D735BE610B1193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pack200.exe

Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
Size 920KB
SHA256 b45a5abfb424be0dfb13e003fa79833efcadce926a346b162d01b9cd15418132
MD5 f5af43d68850efb3263cafe96b42b2a5
SHA1 1a27c621345102c38f22899b3648daab7b052de4
SHA512 5fe67d303dfa5cf59bed6753d963528e4b7ef42132bc61559e96b4cd94ba7423e2202faaf7ff267e276005968f22102a32e3e9544441fc786e6414adbec0ca49
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0B04:bHuHNgHg1flT/Vk3HYwLfU5Y04
TLSH
T146157D23DEA498D2D6A648B0DE96C701D735BE610B1193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

policytool.exe

Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
Size 920KB
SHA256 dc9f3600324b95d230dcaf08e7cd256eada353bbea1b48115f473f586703541f
MD5 e9ce3642251173291932cb5284ad0849
SHA1 fa9701815e9e957a8863addad63c6f6f14cb30ee
SHA512 e936f82a79440ea2b550bfada54ee8563cc2bdf16596ec5693b1b53c1e7d952ccd8a3a6fdd63fec8d962a1a05eba2f2b58378e7e142f128d54e672ca17566411
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Bfu:bHuHNgHg1flT/Vk3HYwLfU5Yfu
TLSH
T1A1158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmic.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
Size 920KB
SHA256 1c0df6690dc610ce9ca8d5275eda8c4d6119b792abbe47953b48837f6efcf9e5
MD5 d7cd427add4c54112ba90a1bd34e8b19
SHA1 9ab6ef08937a29c1d14f7f50403c649d244a9695
SHA512 3dc21a71e00e367f1b17a747d42ff080ea759135e98227a223614f7305f632a8da235b01d742568c41a0ba38e6674246f9edb6528ae58bab137eaac24670008a
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0B6j:bHuHNgHg1flT/Vk3HYwLfU5Y6j
TLSH
T12E158D23DEA498D2D6A648B0DE968701D735BE610B1193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmid.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
Size 920KB
SHA256 2845191da435b35207a70ebb5b46c02686f3d8a386652626c8fd4b11a6094037
MD5 750905289651cbe02f63bd9d745be2ef
SHA1 558ffa1558272d2434885fe6cba7cfe968879608
SHA512 f94590427f842ff868930f7ff5d0b2795a7a366b3195c46a7d65d2b46e0379e031c2f77eef9d58ef4ece5fe53808d697c2bc8e493beaf97ccb8886b5c524bfd4
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0Bng:bHuHNgHg1flT/Vk3HYwLfU5Yng
TLSH
T195158D23DEA498D2D6A64870DE968701D735BE610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmiregistry.exe

Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
Size 920KB
SHA256 2fb2c7eefa9c15da9e106611e95aec00762755f20045821ac7be31c857b1f338
MD5 7fb0f540985dc362126afd1bbbea174f
SHA1 ddc0976aab9a4f5189a7a586e5d7cda69a013a91
SHA512 14cc7a354644f5e9f837f3f05f19b9447255890e26c40f7c9402b928bce117c6ee16b7a6beca84caa5230ea41235527799610b2115d9df77eb583a2e5b4a15ec
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0B6I:bHuHNgHg1flT/Vk3HYwLfU5Y6I
TLSH
T171158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

schemagen.exe

Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
Size 920KB
SHA256 66077a26c8e8dab3a1ed2a5c0d48c31a0b7c1014a29b1625b5e8a98ed3d9b8a0
MD5 f48dd4f41111d8a6d05b0e34294c46f4
SHA1 bd41efdc11be4b28f167a219c7b47882a5f989b9
SHA512 146f69ca465bd51c051181ddf1de2b689e0bfc63df32cdcd29fcee42363f552848b518bc3f63386cf1c4b96af74463ab3dc74e809ff766853d9bb7c6d4878b55
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0B4o:bHuHNgHg1flT/Vk3HYwLfU5Y4o
TLSH
T132158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serialver.exe

Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
Size 920KB
SHA256 d7eba4c8b86b0e752f73f6ab958a446a71532a48ebc7fb5dcd5e5b0ba82d4532
MD5 fa97079890446ceb872210e0553b9233
SHA1 8a401d88e14b89b7e9fc620c20ba25f4b7145467
SHA512 267bd1bc15ee71c81fb14928ed7f9fcbdfbf75cf46120961951653ca45fea31c6fb250e2cdf218111b152b85456a8567d017d4275a967f09d090189354cf8b11
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BL+:bHuHNgHg1flT/Vk3HYwLfU5YL+
TLSH
T17E158D23DEA498D2D6A64870DE96C701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servertool.exe

Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
Size 920KB
SHA256 788bd128969d51ef56097c27ff15af58f5559e3c58794dac1ab802a7a13ae59c
MD5 85e428155406cf16766d3da78599a194
SHA1 51a388d255eb542423d17a7a48afd4774656c3d8
SHA512 bb5bf60e952464d5e2feb74cc3eaefb6de5d37fb01ebf87c82d3e9d778963380f8b828219543516b2a9b3f9a3512bef93c6ee94e06fa40542e094b5e4bbf5f0d
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BBQ:bHuHNgHg1flT/Vk3HYwLfU5YBQ
TLSH
T114158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnameserv.exe

Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
Size 920KB
SHA256 174e3c07c3e50c55f6dfcdd691d96b9c7f354a19f510f9501f80edc3ba314980
MD5 2c46261f392f7fa38ae6e495208186b6
SHA1 17c041848d1f15cb5c0daa96c422687de3f8a324
SHA512 043606f1ad76bb892e1d7b2967b8feb0e534af5e0198783e311d07f37c9cf5d1c4b50ea39d68256726f7f6fa4d5a28ef252b606df711b9d263358ab3686e8c6d
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BGX:bHuHNgHg1flT/Vk3HYwLfU5YGX
TLSH
T1FA158D23DEA498D2D6B648B0DE968701D735BE610B1193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 920KB
SHA256 f48bdd3924bd3d01a73479dbbc530a07d95e630f7afaadfaf339ce00e80a5f54
MD5 8a5f69173e8cbdb0b2c2f06cc6bdb4fa
SHA1 d65d71eed49f9d9637761d315d1a642aa07d5ef8
SHA512 9d554c300969d0ba35f9b2ce9f04fd01fe79fb97310fa051798e04c43101c38caaf4388e227b36c552197dd326195b83dab7d553a239d10f18952c63b87803ae
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BAL:bHuHNgHg1flT/Vk3HYwLfU5YAL
TLSH
T1E0158D23DEA498D2D6A648B0DE96C701D735BE610B1193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsimport.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
Size 920KB
SHA256 63d9693d0bcc9bd323991813cdca984c160b65b1d0098820de83ca679350b491
MD5 4faebfadd7494d8de6216703e870e7ba
SHA1 f04460ee7a3bc335d3a0b7c8cb9a9283f92761a7
SHA512 be0e02b3a0220fdf6ad7d7e2f40225a734cc75cddef7362dad98a8cd426213c4e430eabad239ea038932438d73ffe6a18716141154205adbd4f57c96f92bc91c
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0BsFC:bHuHNgHg1flT/Vk3HYwLfU5YsM
TLSH
T150158D23DEA498D2D6B64870DE968701D735BE610B2193DFD2A4B31A9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xjc.exe

Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
Size 920KB
SHA256 2dc719cc49c35ceb77309b6e659d0bc57a37c171d150f8a71c60b970c78956ad
MD5 e5c4c9b39807f03c665b82f3f5e177e9
SHA1 eae4d61296816d9b1061e30242e5abac070792d6
SHA512 4112d8545746accb7053d959885b54fbdc70127b6d45fdc850216967d8fda2c4d72f2a66772bc846ac09805b0ec98af4c9a6c93fd4d7b4a7650fd32091da677a
SSDEEP 12288:bHuHNgHg1JZlT/Vk3HYwnBNUbTYfULVL0B1h:bHuHNgHg1flT/Vk3HYwLfU5Y1h
TLSH
T1AD158D23DEA498D2D6A64870DE968701D735BE610B2193DFD2A4B31E9E337D03E32719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2728-166-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2728-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3236-240-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads